Skip to main content
POST
/
files
cURL
curl --request POST \
  --url https://api.timbal.ai/files \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: multipart/form-data' \
  --form file=1
import requests

url = "https://api.timbal.ai/files"

payload = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n1\r\n-----011000010111000001101001--"
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "multipart/form-data"
}

response = requests.post(url, data=payload, headers=headers)

print(response.text)
const form = new FormData();
form.append('file', '1');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

fetch('https://api.timbal.ai/files', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.timbal.ai/files",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n1\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data"
],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"strings"
"net/http"
"io"
)

func main() {

url := "https://api.timbal.ai/files"

payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n1\r\n-----011000010111000001101001--")

req, _ := http.NewRequest("POST", url, payload)

req.Header.Add("Authorization", "Bearer <token>")

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.timbal.ai/files")
.header("Authorization", "Bearer <token>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n1\r\n-----011000010111000001101001--")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.timbal.ai/files")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n1\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body
{
  "content_length": 123,
  "content_type": "<string>",
  "created_at": "2023-11-07T05:31:56Z",
  "expires_at": "2023-11-07T05:31:56Z",
  "name": "<string>",
  "url": "<string>"
}
{
"code": "<string>",
"message": "<string>"
}
{
"code": "<string>",
"message": "<string>"
}
Utility endpoint — not org-scoped. Upload requires authentication; the response includes a download URL (~24h). Anyone with the URL can download until expiry — treat it as a secret. Not for sensitive or regulated data.
Ephemeral staging only (~24h lifecycle); there is no durable org file record behind this route. For durable storage, parsing, embedding, and reuse across a knowledge base, use Knowledge Bases → Files (POST /orgs/{org_id}/k2/{kb_id}/files) instead.

Authorizations

Authorization
string
header
required

Timbal API key. Obtain your API key from the Timbal platform settings. See Authentication for more information.

Body

multipart/form-data
file
integer<int32>[]
required

Binary contents of the file. Max 100 MB.

Required range: x >= 0

Response

File uploaded

Short-lived upload metadata returned by POST /files.

content_length
integer<int64>
required

Size of the uploaded payload in bytes.

content_type
string
required

MIME type as reported by the client.

created_at
string<date-time>
required

Time the file was uploaded.

expires_at
string<date-time>
required

When the download URL is expected to stop working (~24h after upload).

name
string
required

Original filename (sanitized — slashes / control characters replaced).

url
string
required

Download URL. Anyone with this URL can fetch the file until it expires.