Skip to main content
POST
Get signed PUT URLs for an owned image reference upload. An 8 MiB image has at most two parts. Save the ETag returned by each PUT for upload_complete.

Authentication and permissions

string
required
Send a VoiceCheap API key in this header. Authorization: Bearer with the same API key is also supported. OAuth access tokens are accepted only by MCP, not by this REST endpoint.
Required permissions: thumbnails:write. An active paid subscription is required. Permissions do not change team roles, resource ownership, media credits, or plan limits.

Parameters

string
Optional at the transport boundary: the server injects an identifier before validation when omitted. Supply your own stable UUID v4 to recover safely from a lost response.Format: “uuid”. Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$.
string
required
The uploadId returned by this domain’s upload_initialize action.Format: “uuid”. Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$.
array
required
List of values. See the complete input schema for its item structure.Minimum items: 1. Maximum items: 2.
The JSON Schema below preserves the exact field names, nested types, defaults, bounds, and accepted values exposed by discovery. Additional cross-field rules are listed in the operation notes.

Idempotency

Use a UUID v4 in requestId or the Idempotency-Key HTTP header for each mutation. Reuse the same identifier and identical arguments after a network failure. If both are supplied, they must match. Replaying a saved request does not repeat the operation or charge another monthly call. Failed or interrupted requests are not restarted automatically. Every mutation can return HTTP 202 when a retry finds the same request still running, even when its first execution is normally synchronous. If execution completed but resultStored is false, a retry returns HTTP 200 with saved request state instead of the original result. Retrieve the output through its domain history, result, or download action.

Request examples

Replace example resource identifiers and media keys with values returned for your account. Keep the request identifier stable when retrying the same mutation.

Response

A successful first execution returns HTTP 200 with the operation result under data. A replay may return saved request state instead. The example shows one supported response, not every optional field. An array of temporary signed PUT URLs, one per distinct requested part number. The response contains no image bytes, ETags, or per-part size fields.

Result fields

Recover and poll this request

Use the same identifier even after a lost connection. If resultStored is false, retrieve the output through the corresponding history, result, or download action. Never start a second generation merely to check progress.
HTTP 200

Operation notes

  • Requires thumbnails:write; no additional upload scope is needed.
  • uploadId is the UUID from initialize. partNumbers contains 1–2 integers, each between 1 and 2, and every part must exist for that session’s declared fileSize. Duplicate requested part numbers are collapsed to one URL.
  • PUT raw binary part bytes to each returned URL. Content-Length is signed and must exactly match min(partSize, fileSize - (partNumber - 1) × partSize). For the 7 MiB example, part 1 is 5,242,880 bytes and part 2 is 2,097,152 bytes. Do not send JSON, multipart/form-data, or base64 to the signed URL.
  • Save the ETag response header from each successful PUT and send those values to thumbnails_upload_complete. Treat signed URLs as private temporary upload capabilities.
  • Only an upload belonging to the connected user can be signed, completed, or aborted. These aliases accept only JPG, PNG, and WebP sessions of at most 8 MiB, even if the session was created through a different upload family.
  • The production upload session expires after 24 hours. Signed part URLs expire after one hour. Completion and abort remove the active session; sign-parts and complete then return Upload not found. Neither response includes an expiresAt field.
  • Use a UUID v4 requestId, or the HTTP Idempotency-Key header, and reuse it with identical inputs when retrying. The integration layer records each mutation and returns its recorded state or result without rerunning it. A failed or interrupted request is not automatically retried.
  • To obtain fresh URLs after their one-hour expiry while the session is still active, call sign-parts with a new requestId. Retrying the same requestId returns its saved result, including the old URLs.

Usage

Each successful invocation consumes one monthly API/MCP call. Media credits and the operation’s own generation allowances also apply.

Errors