> ## Documentation Index > Fetch the complete documentation index at: https://spreecommerce.org/docs/llms.txt > Use this file to discover all available pages before exploring further. # Upload a file > Accepts a file and returns a `signed_id` to send to the endpoint that uses it — `signed_id` on product media, `avatar_signed_id` on a customer, `attachment_signed_id` on an import, and so on. Two ways to send the bytes, one response: - **Presigned** (JSON): send the file's metadata, then `PUT` the bytes to `upload.url` with exactly `upload.headers`. Use this for anything large — the bytes go straight to storage. - **Multipart**: send the bytes in a `file` part. The file is stored before the response, so `upload` is null. Limited to 10 MB by default. `signed_id` is opaque: pass it back unchanged and never parse it. It stops being attachable at `expires_at`, one day after the upload. `visibility` picks the storage: `public` (the default) for images and videos customers see, `private` for documents, imports and digital products. Public uploads accept web images, videos and CSV; private uploads accept any type. `checksum` is the file's MD5 digest, base64-encoded — the storage service verifies the bytes against it. **Required scope:** `write_products` (for API-key authentication). ## OpenAPI ````yaml /api-reference/admin.yaml post /api/v3/admin/files openapi: 3.0.3 info: title: Admin API contact: name: Spree Commerce url: https://spreecommerce.org email: hello@spreecommerce.org description: > Spree Admin API v3 - Administrative API for managing products, orders, and store settings. ## Authentication The Admin API requires a secret API key passed in the `x-spree-api-key` header. Secret API keys can be generated in the Spree admin dashboard. ## Response Format All responses are JSON. List endpoints return paginated responses with `data` and `meta` keys. Single resource endpoints return a flat JSON object. ## Resource IDs Every resource is identified by an opaque string ID (e.g. `prod_86Rf07xd4z`, `variant_k5nR8xLq`, `or_UkLWZg9DAJ`). Use these IDs everywhere — URL paths, request bodies, and Ransack filters all accept them directly. ## Error Handling Errors return a consistent format: ```json { "error": { "code": "validation_error", "message": "Validation failed", "details": { "name": ["can't be blank"] } } } ``` version: v3 servers: - url: http://{defaultHost} variables: defaultHost: default: localhost:3000 security: [] tags: - name: Authentication description: Admin user login, logout, token refresh, and current user profile - name: Allowed Origins description: CORS allowlist for storefront and admin client origins - name: API Keys description: Secret and publishable API keys - name: Categories description: >- Hierarchical product categories — tree management, repositioning, and product assignments - name: Channels description: >- Sales channels, product publication across channels, and per-channel order routing rules - name: Custom Fields description: >- Custom field definitions for products, variants, customers, and other resources - name: Customer Groups description: >- Customer groups for segmenting customers (e.g. wholesale, VIP) used by pricing and promotions - name: Customers description: Customer profiles, addresses, credit cards, and store credits - name: Email Templates description: >- Customer email templates, the email layout and shared partials: drafts, previews, publishing and history - name: Exports description: Async CSV exports of admin resources - name: Files description: Uploading the files that product media, imports, logos and documents use - name: Fulfillments description: Order fulfillments — shipments, fulfill, cancel, resume, split - name: Gift Cards description: Gift cards and gift card batches - name: Imports description: >- Async CSV imports of admin resources, with per-row status and failed-row retry - name: Markets description: >- Markets — geographic groupings of countries used for pricing, tax, and fulfillment rules - name: Option Types description: >- Option types and option values used to build product variants (e.g. Size, Color) - name: Orders description: Orders, order items, applied gift cards, and applied store credits - name: Payment Methods description: Configured payment providers and their available types - name: Payments description: Order payments — list, capture, void - name: Pricing description: >- Prices and price lists for currency-, market-, and customer-group-specific pricing - name: Products description: >- Products, taxons/categories, product custom field values, and bulk product operations - name: Policies description: The store's legal documents — terms of service, privacy, returns, shipping - name: Reasons description: >- Merchant-owned vocabularies for why a return, claim, refund, cancellation or tax exemption happened - name: Promotions description: Promotions, promotion rules, promotion actions, and coupon codes - name: Refunds description: Order refunds - name: Settings description: Store-level settings — store profile, tags, and configuration - name: Staff description: Admin users, roles, and invitations to the store - name: Stock Locations description: Warehouses and physical fulfillment locations - name: Store Credits description: Prepaid customer balances across all customers, and each balance's ledger - name: Variants description: >- Product variants — the individual SKUs (size/color combinations) sold under a product - name: Webhooks description: Webhook endpoints and webhook delivery history paths: /api/v3/admin/files: post: tags: - Files summary: Upload a file description: |- Accepts a file and returns a `signed_id` to send to the endpoint that uses it — `signed_id` on product media, `avatar_signed_id` on a customer, `attachment_signed_id` on an import, and so on. Two ways to send the bytes, one response: - **Presigned** (JSON): send the file's metadata, then `PUT` the bytes to `upload.url` with exactly `upload.headers`. Use this for anything large — the bytes go straight to storage. - **Multipart**: send the bytes in a `file` part. The file is stored before the response, so `upload` is null. Limited to 10 MB by default. `signed_id` is opaque: pass it back unchanged and never parse it. It stops being attachable at `expires_at`, one day after the upload. `visibility` picks the storage: `public` (the default) for images and videos customers see, `private` for documents, imports and digital products. Public uploads accept web images, videos and CSV; private uploads accept any type. `checksum` is the file's MD5 digest, base64-encoded — the storage service verifies the bytes against it. **Required scope:** `write_products` (for API-key authentication). parameters: - name: x-spree-api-key in: header required: true schema: type: string - name: Authorization in: header required: true description: Bearer token for admin authentication schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/FileUploadCreateParams' multipart/form-data: schema: $ref: '#/components/schemas/FileUploadCreateParams' required: true responses: '201': description: presigned upload target created content: application/json: example: signed_id: >- eyJfcmFpbHMiOnsiZGF0YSI6MSwiZXhwIjoiMjAyNi0wMS0xNlQxMjowMDowMC4wMDBaIiwicHVyIjoiYmxvYl9pZCJ9fQ==--a9cd29e72a70654182038480207bd929343f6a07 filename: products.csv content_type: text/csv byte_size: 48213 visibility: private expires_at: '2026-01-16T12:00:00.000Z' upload: method: PUT url: >- http://www.example.com/rails/active_storage/disk/eyJfcmFpbHMiOnsiZGF0YSI6eyJrZXkiOiJxcmZsMnNod3YwYmR4cWF3ZWFocDZvYjhlYzh5IiwiY29udGVudF90eXBlIjoidGV4dC9jc3YiLCJjb250ZW50X2xlbmd0aCI6NDgyMTMsImNoZWNrc3VtIjoiaGdKTXJSNkRFQjJYTloxelVRVVJWZz09Iiwic2VydmljZV9uYW1lIjoidGVzdCJ9LCJleHAiOiIyMDI2LTAxLTE1VDEyOjA1OjAwLjAwMFoiLCJwdXIiOiJibG9iX3Rva2VuIn19--d4e8daa252ef4ddb8e82ab74394aab7d435572ec headers: Content-Type: text/csv schema: $ref: '#/components/schemas/FileUpload' '422': description: content type not allowed for a public upload content: application/json: example: error: code: validation_error message: Content type is not included in the list details: content_type: - value: application/x-sh code: inclusion message: is not included in the list specific: false schema: $ref: '#/components/schemas/ErrorResponse' security: - api_key: [] bearer_auth: [] x-codeSamples: - lang: javascript label: Spree Admin SDK source: >- import { createAdminClient } from '@spree/admin-sdk' const client = createAdminClient({ baseUrl: 'https://your-store.com', secretKey: 'sk_xxx', }) // Returns where to send the bytes: send the file to `upload.url` with // `upload.method` and `upload.headers`, then pass `signed_id` to the // endpoint that uses it. // `client.files.upload(file)` does both steps for you. const { signed_id, upload } = await client.files.create({ filename: 'products.csv', content_type: 'text/csv', byte_size: 48213, checksum: 'XrY7u+Ae7tCTyyK7j1rNww==', visibility: 'private', }) - lang: bash label: Spree CLI source: >- spree api post /files -d '{"filename":"products.csv","content_type":"text/csv","byte_size":48213,"checksum":"XrY7u+Ae7tCTyyK7j1rNww==","visibility":"private"}' components: schemas: FileUploadCreateParams: type: object properties: filename: type: string example: registration.pdf content_type: type: string example: application/pdf byte_size: type: integer example: 51234 checksum: type: string description: >- Base64-encoded MD5 digest of the file; the storage service checks the bytes against it. example: rL0Y20zC+Fzt72VPzMSk2A== visibility: type: string enum: - public - private description: >- `public` (the default) for images, videos and CSV files anyone may fetch, `private` for any type. file: type: string format: binary description: The bytes, for a multipart upload. required: - filename - content_type FileUpload: type: object properties: signed_id: type: string filename: type: string content_type: type: string byte_size: type: number visibility: type: string enum: - public - private expires_at: type: string upload: allOf: - $ref: '#/components/schemas/FileUploadTarget' nullable: true required: - signed_id - filename - content_type - byte_size - visibility - expires_at - upload x-typelizer: true ErrorResponse: type: object properties: error: type: object properties: code: type: string example: record_not_found message: type: string example: Record not found details: type: object description: Field-specific validation errors nullable: true example: name: - is too short - is required email: - is invalid required: - code - message required: - error example: error: code: validation_error message: Validation failed details: name: - is too short email: - is invalid FileUploadTarget: type: object properties: method: type: string url: type: string headers: type: object required: - method - url - headers x-typelizer: true securitySchemes: api_key: type: apiKey name: x-spree-api-key in: header description: Secret API key for admin access bearer_auth: type: http scheme: bearer bearerFormat: JWT description: JWT token for admin user authentication ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.