> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.beatapi.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.beatapi.io/_mcp/server.

# Upload a file for workflow inputs

POST https://api.beatapi.io/v1/files
Content-Type: multipart/form-data

Use file upload when your images, videos, audio, or subtitle files are not
already hosted at public HTTPS URLs. The returned HTTPS URL can be used
directly in `images`, `reference_videos`, `audio_url`, or `srt_url`.

Limits:
- Images, audio, and subtitles: maximum 50 MB.
- Motion videos: maximum 100 MB.
- Images: `png`, `jpg`, `jpeg`, `webp`
  (`image/png`, `image/jpeg`, `image/webp`).
- Audio: `mp3`, `wav`, `aac`, `m4a`
  (`audio/mpeg`, `audio/wav`, `audio/aac`, `audio/mp4`).
- Audio uploads must be 10-300 seconds. The selected Music Video tier applies its own task limit: Standard 10-180 seconds; Premium 10-300 seconds.
- Motion videos: `mp4`, `mov` (`video/mp4`, `video/quicktime`), 3-30 seconds. Duration and dimensions are detected during upload.
- Subtitles: `srt` (`application/x-subrip`; multipart uploads may use
  `text/plain` only when the filename ends in `.srt`).
- PDF, generic text files, octet-stream uploads, Matroska videos, and zip files
  are not supported for launch.
- Send either multipart form-data with a `file` field, or send the raw
  file body with the asset `Content-Type`.
- `Content-Length` is required and is validated before BeatAPI buffers
  the request body; chunked uploads without a declared length are rejected.
- Returned URLs are HTTPS and long-lived for launch.
- Uploaded audio files are duration-checked during upload. The response
  includes `audio_duration_seconds` when the uploaded asset is audio.
- Uploaded videos are signature-, duration-, and dimension-checked. The
  response includes `video_duration_seconds`, `width`, and `height`.
- Workflow task inputs still require public HTTPS URLs. Localhost,
  private network URLs, and data URLs are not accepted.


Reference: https://docs.beatapi.io/api-reference/core/files/upload-file

## Authentication

- `Authorization` header (bearer token, required) — Send your API key as `Authorization: Bearer <BEATAPI_API_KEY>`.

## Request

### Body (multipart/form-data)

This endpoint expects a multipart form containing a file.

- `file` (file, required)
- `purpose` (enum, optional)

## Response

### 201

File uploaded

- `data` (File, required) — Uploaded file metadata and the public HTTPS URL to use in later requests.

## Errors

### 400 Bad Request Error

Malformed JSON or a field, value or combination this endpoint does not accept (`bad_request`; the message names the field), or input refused by moderation (`content_policy_violation`). Not retryable unchanged.

- `error` (ErrorError, required) — Structured BeatAPI error. Use `code` (or `retryable`) for program logic and retain `request_id` for support.

### 401 Unauthorized Error

No API key (`missing_api_key`), or a key that is wrong, expired, disabled or exhausted (`invalid_api_key`; the message says which). Send it as `Authorization: Bearer <key>`; the key works with or without the `sk-` prefix. Not retryable.

- `error` (ErrorError, required) — Structured BeatAPI error. Use `code` (or `retryable`) for program logic and retain `request_id` for support.

### 429 Too Many Requests Error

Too many requests (`rate_limit_exceeded`, including the free-model limits) or too many tasks processing at once (`user_concurrency_exceeded`). Retryable after `Retry-After` seconds (also `error.retry_after_seconds`).

- `error` (ErrorError, required) — Structured BeatAPI error. Use `code` (or `retryable`) for program logic and retain `request_id` for support.

### 500 Internal Server Error

Unexpected internal error (`internal_error`). Retryable; keep `request_id` for support if it persists.

- `error` (ErrorError, required) — Structured BeatAPI error. Use `code` (or `retryable`) for program logic and retain `request_id` for support.

## Types

### File

- `id` (string, required) — Stable uploaded file ID.
- `object` (enum, required) — Object discriminator; always `file`.
  - Allowed values: `file`
- `url` (string, required) — Long-lived BeatAPI HTTPS URL to use in workflow or model requests.
- `key` (string, required) — BeatAPI storage key for support and diagnostics.
- `mime_type` (string, required) — Accepted MIME type detected for the uploaded file.
- `size_bytes` (integer, required) — Uploaded file size in bytes.
- `purpose` (enum, required) — File purpose; currently always `input`.
  - Allowed values: `input`
- `created_at` (integer, required) — Unix timestamp when the file was stored.
- `audio_duration_seconds` (double, optional) — Present for uploaded audio files after server-side duration detection.
- `audio_duration_source` (string, optional) — Duration detection method used for uploaded audio.
- `video_duration_seconds` (double, optional) — Present for MP4/MOV uploads after server-side container inspection.
- `video_duration_source` (string, optional) — Duration and dimension detection method used for the uploaded video.
- `width` (integer, optional) — Detected pixel width for uploaded images and videos.
- `height` (integer, optional) — Detected pixel height for uploaded images and videos.

### ErrorError

Structured BeatAPI error. Use `code` (or `retryable`) for program logic and retain `request_id` for support.

- `code` (enum, required) — Stable machine-readable error code. `unauthorized` is the deprecated name for a 401; since 2026-09-29 a 401 is `missing_api_key` or `invalid_api_key`. Treat a legacy `unauthorized` like `invalid_api_key`.
  - Allowed values: `bad_request`, `missing_api_key`, `invalid_api_key`, `unauthorized`, `forbidden`, `not_found`, `insufficient_credits`, `idempotency_conflict`, `user_concurrency_exceeded`, `rate_limit_exceeded`, `content_policy_violation`, `processing_unavailable`, `processing_failed`, `processing_timeout`, `result_transfer_failed`, `invalid_signature`, `realtime_disabled`, `realtime_capacity_unavailable`, `realtime_session_expired`, `origin_not_allowed`, `invalid_client_secret`, `transport_not_allowed`, `internal_error`
- `message` (string, required) — English sentence that states the cause; for `bad_request` it names the field. Written for people and logs, not for parsing.
- `retryable` (boolean, required) — Whether making the same call again could succeed. Present on every error; branch on it instead of the status code. True for 429, 500 and 503 (rate_limit_exceeded, user_concurrency_exceeded, internal_error, processing_unavailable, processing_timeout, processing_failed, result_transfer_failed, realtime_capacity_unavailable). False for a request, key or balance that must change first (bad_request, content_policy_violation, missing_api_key, invalid_api_key, insufficient_credits, forbidden, not_found, idempotency_conflict, realtime_disabled and the other realtime credential codes).
- `request_id` (string, required) — Correlation ID to retain for BeatAPI support.
- `retry_after_seconds` (integer, optional) — Seconds to wait before retrying. Present on every 429, and on a 503 when the wait is known; the same value is sent in the `Retry-After` header.
- `docs` (string, optional) — The public Skill page that says what to do about an error. Present on errors answered by the capability endpoints (`/v1/capabilities/search`, `/v1/capabilities/inspect`, `/v1/capabilities/run`); absent on every other endpoint.

## Examples

**Request**

```json
{
  "file": "<file: string>"
}
```

**Response**

```json
{
  "data": {
    "id": "file_3xYz9",
    "object": "file",
    "url": "https://media.beatapi.io/inputs/file_3xYz9.mp3",
    "key": "inputs/file_3xYz9.mp3",
    "mime_type": "audio/mpeg",
    "size_bytes": 1048576,
    "purpose": "input",
    "created_at": 1782210000,
    "audio_duration_seconds": 64.02,
    "audio_duration_source": "mp3_frame_scan"
  }
}
```

**SDK Code**

```python Files_uploadFile_example
import requests

url = "https://api.beatapi.io/v1/files"

files = { "file": "open('string', 'rb')" }
payload = { "purpose":  }
headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.json())
```

```javascript Files_uploadFile_example
const url = 'https://api.beatapi.io/v1/files';
const form = new FormData();
form.append('file', 'string');
form.append('purpose', '');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Files_uploadFile_example
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.beatapi.io/v1/files"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"string\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"purpose\"\r\n\r\n\r\n-----011000010111000001101001--\r\n")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Files_uploadFile_example
require 'uri'
require 'net/http'

url = URI("https://api.beatapi.io/v1/files")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"string\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"purpose\"\r\n\r\n\r\n-----011000010111000001101001--\r\n"

response = http.request(request)
puts response.read_body
```

```java Files_uploadFile_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.beatapi.io/v1/files")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"string\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"purpose\"\r\n\r\n\r\n-----011000010111000001101001--\r\n")
  .asString();
```

```php Files_uploadFile_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.beatapi.io/v1/files', [
  'multipart' => [
    [
        'name' => 'file',
        'filename' => 'string',
        'contents' => null
    ]
  ]
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp Files_uploadFile_example
using RestSharp;

var client = new RestClient("https://api.beatapi.io/v1/files");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddParameter("undefined", "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"string\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"purpose\"\r\n\r\n\r\n-----011000010111000001101001--\r\n", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Files_uploadFile_example
import Foundation

let headers = ["Authorization": "Bearer <token>"]
let parameters = [
  [
    "name": "file",
    "fileName": "string"
  ],
  [
    "name": "purpose",
    "value": 
  ]
]

let boundary = "---011000010111000001101001"

var body = ""
var error: NSError? = nil
for param in parameters {
  let paramName = param["name"]!
  body += "--\(boundary)\r\n"
  body += "Content-Disposition:form-data; name=\"\(paramName)\""
  if let filename = param["fileName"] {
    let contentType = param["content-type"]!
    let fileContent = String(contentsOfFile: filename, encoding: String.Encoding.utf8)
    if (error != nil) {
      print(error as Any)
    }
    body += "; filename=\"\(filename)\"\r\n"
    body += "Content-Type: \(contentType)\r\n\r\n"
    body += fileContent
  } else if let paramValue = param["value"] {
    body += "\r\n\r\n\(paramValue)"
  }
}

let request = NSMutableURLRequest(url: NSURL(string: "https://api.beatapi.io/v1/files")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```