Skip to main content
POST
/
v2
/
files
/
sign
Upload Large File - Step 1: Sign
curl --request POST \
  --url https://api.tess.im/v2/files/sign \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "filename": "<string>",
  "content_type": "<string>",
  "size": 123
}
'
import requests

url = "https://api.tess.im/v2/files/sign"

payload = {
"filename": "<string>",
"content_type": "<string>",
"size": 123
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)
const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({filename: '<string>', content_type: '<string>', size: 123})
};

fetch('https://api.tess.im/v2/files/sign', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tess.im/v2/files/sign",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'filename' => '<string>',
'content_type' => '<string>',
'size' => 123
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"strings"
"net/http"
"io"
)

func main() {

url := "https://api.tess.im/v2/files/sign"

payload := strings.NewReader("{\n \"filename\": \"<string>\",\n \"content_type\": \"<string>\",\n \"size\": 123\n}")

req, _ := http.NewRequest("POST", url, payload)

req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.tess.im/v2/files/sign")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"filename\": \"<string>\",\n \"content_type\": \"<string>\",\n \"size\": 123\n}")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.tess.im/v2/files/sign")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"filename\": \"<string>\",\n \"content_type\": \"<string>\",\n \"size\": 123\n}"

response = http.request(request)
puts response.read_body
{
  "uploadUrl": "<string>",
  "objectPath": "<string>",
  "requiredHeaders": {},
  "finalUrl": "<string>"
}
Use this endpoint whenever the file is larger than 32 MB. For files up to 32 MB, the single-shot POST /files endpoint is simpler and still supported.

How it works

The file body is uploaded directly from the client to Google Cloud Storage using a short-lived V4-signed PUT URL — the bytes never pass through the API server, which lets the endpoint accept files up to 200 MB. A single upload is three calls from the client:
  1. POST /v2/files/sign — the API mints a signed GCS PUT URL valid for ~15 minutes and returns the headers the client must echo on the PUT.
  2. PUT the file body directly to the returned uploadUrl. The PUT carries exactly the headers from requiredHeaders — no more, no less — they are bound into the V4 signature, so a missing, extra, or different header makes GCS reject the PUT with 403.
  3. POST /v2/files/register — the API verifies the uploaded object’s size against what you declared at /sign, moves it server-side from the temporary staging area to its final location, deduplicates by content hash, and returns the standard FileDTO (same shape as POST /files).

Step 2 — direct PUT to Google Cloud Storage

Send exactly the headers returned in requiredHeaders (currently Content-Type and x-goog-if-generation-match):
cURL
curl --request PUT \
  --url 'PASTE_uploadUrl_HERE' \
  --header 'Content-Type: application/pdf' \
  --header 'x-goog-if-generation-match: 0' \
  --upload-file './report.pdf'
GCS returns 200 on success. The x-goog-if-generation-match: 0 header makes the PUT create-only — replays return 412 Precondition Failed.

Step 3 — register the upload

After the PUT succeeds, finalize the upload. The declared size does not need to be sent again — the server remembers the size you declared at /sign (for ~16 minutes) and compares it against the actual uploaded object:
cURL
curl --request POST \
  --url 'https://api.tess.im/v2/files/register' \
  --header 'Authorization: Bearer <TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
    "object_path": "<objectPath from /sign>",
    "filename": "report.pdf",
    "content_type": "application/pdf",
    "process": false
  }'
Returns 201 with the standard FileDTO. If a file with identical content already exists in the workspace, the API returns 200 with the existing file’s FileDTO instead of creating a duplicate. The optional process field works exactly like on POST /files.

Supported files

Same as POST /files — Text, Word, Spreadsheet, PDF, Excel, PowerPoint, Image, Video, Audio, and 30+ code extensions.

Limits

  • Maximum file size per upload: 200 MB
  • One file per flow (run the three steps again for additional files)
  • Storage limit: 30 files

Errors

StatusMeaning
400/register validation failed (missing field or malformed object_path)
401Missing or invalid Bearer token
403Caller lacks API permission for the target workspace — or, on the GCS PUT, the headers do not match requiredHeaders
404Upload session expired (~15-minute window) or unknown, or the object was never uploaded — start again at /sign
412On the GCS PUT: the object already exists (the signed URL is create-only)
415Unsupported content_type at /register
422/sign validation failed (missing field or size > 200 MB) — or the uploaded object is larger than the size declared at /sign (the object is deleted)
429Throttled

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

x-workspace-id
integer

ID of the workspace. If not provided, the user's selected workspace will be used.

Body

application/json
filename
string
required

Original filename including extension (e.g. report.pdf). Used to derive the stored extension.

content_type
string
required

MIME type of the file. Bound into the signed URL - the client MUST PUT with exactly this Content-Type header.

size
integer
required

Declared file size in bytes. The server remembers this value and /register rejects the upload if the actual uploaded object is larger than declared. Hard maximum: 200 MB (209715200 bytes).

Response

Signed PUT URL minted.

uploadUrl
string<uri>

Pre-signed Google Cloud Storage PUT URL. Valid for ~15 minutes.

objectPath
string

GCS object path the file will land at. Pass this back to POST /v2/files/register.

requiredHeaders
object

Headers the client MUST send on the PUT - bound into the V4 signature. Contains exactly Content-Type (the value you declared) and x-goog-if-generation-match: 0 (create-only). Send these headers verbatim and do not add others.

finalUrl
string<uri>

Short-lived signed download URL (~3 hours) for the uploaded object. For a durable reference, use the url field of the FileDTO returned by POST /v2/files/register.