Reserve an Asset and mint an upload URL
Reserves an Asset and returns a presigned PUT URL to upload the bytes to. The URL is valid for one hour, and expiresAt says when it stops being accepted.
The client uploads directly to storage — the bytes never pass through this worker, because Cloudflare rejects over-limit request bodies at the proxy before any code runs. Read GET /assets/{id} once the upload completes.
Send the PUT with the header If-None-Match: *. A PUT without it answers 403. The URL can create the object once, and never replace it: a second PUT answers 412. A 412 means that the bytes are already stored, so continue and read the Asset. To use a different file, reserve a new Asset.
The URL is the credential: anyone holding it can create that one object until it expires. Nothing is known about the file until a read inspects what actually landed, so size and type cannot be enforced here.
The reserved Asset stays pending until a read finds the object. That read completes the Asset and answers it ready or failed. A read before the PUT answers pending. A list does not answer a pending Asset. The daily sweep finalizes a reservation that nobody read when its object exists, and deletes a reservation with no object, one day after the reservation.
/assets/uploadsAuthorizationBearer token · headerrequiredSend Authorization: Bearer <credential>.
Use an API key (acr_…), from the AdCrunch console under Settings → API keys.
The credential names the organization, and no operation takes an organization parameter.
See https://docs.adcrunch.dev/api/authentication.
application/jsonfilenamestringrequiredThe name of the file you are about to send. Shown until somebody renames the Asset, and never used to look one up.
The reservation. Send the bytes to uploadUrl, then read assetId.
assetIdstringrequiredThe Asset this reservation made. Finalize it with this id.
expiresAtnumberrequiredWhen the upload URL stops being accepted, in milliseconds since the Unix epoch, UTC.
uploadUrlstringrequiredPUT the bytes here, directly. The URL is the credential: anybody holding it can write that one object until it expires.
The request does not match the schema of this operation: a field is missing or has the wrong type, or the body is not valid JSON. error is invalid_request, and issues names each field. Nothing was changed.
issuesobject[]requiredOne entry for each field that does not match.
Show propertiesHide properties
objectinstringrequiredThe part of the request that holds the field.
bodycookieheadersparamsquerymessagestringrequiredA sentence to show a person. Written to say what to do next. Reworded whenever it can be said better, so never branch on it.
pathstringrequiredA JSON Pointer into that part of the request, such as /filename. An empty string is the whole part.
errorstringrequiredA stable code for the failure. This is the field to branch on. It does not change for a given failure.
invalid_requestmessagestringrequiredA sentence to show a person. Written to say what to do next. Reworded whenever it can be said better, so never branch on it.
No API key, or one that does not resolve. See the security scheme. error is unauthorized.
errorstringrequiredA stable code for the failure. This is the field to branch on. It does not change for a given failure.
unauthorizedmessagestringrequiredA sentence to show a person. Written to say what to do next. Reworded whenever it can be said better, so never branch on it.
The organization has no active subscription. An owner subscribes at paywallUrl. error is organization_unentitled.
paywallUrlstring<uri>requiredThe page where an owner of the organization subscribes. Show it to the person.
errorstringrequiredA stable code for the failure. This is the field to branch on. It does not change for a given failure.
organization_unentitledmessagestringrequiredA sentence to show a person. Written to say what to do next. Reworded whenever it can be said better, so never branch on it.
The caller does not hold asset:write. error is forbidden.
errorstringrequiredA stable code for the failure. This is the field to branch on. It does not change for a given failure.
forbiddenmessagestringrequiredA sentence to show a person. Written to say what to do next. Reworded whenever it can be said better, so never branch on it.
AdCrunch could not write the reservation. error is reservation_failed. Nothing was reserved, so send the request again.
errorstringrequiredA stable code for the failure. This is the field to branch on. It does not change for a given failure.
messagestringrequiredA sentence to show a person. Written to say what to do next. Reworded whenever it can be said better, so never branch on it.