> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timbal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Upload file (temporary)

> Upload a short-lived file for temporary staging.

<Note>
  **Utility endpoint** — not org-scoped. Upload requires authentication; the response includes a download URL (\~24h). Anyone with the URL can download until expiry — treat it as a secret. Not for sensitive or regulated data.
</Note>

Ephemeral staging only (\~24h lifecycle); there is no durable org file record behind this route.

For **durable storage, parsing, embedding, and reuse** across a knowledge base, use [Knowledge Bases → Files](/api-reference/knowledge-bases/files/list) (`POST /orgs/{org_id}/k2/{kb_id}/files`) instead.


## OpenAPI

````yaml POST /files
openapi: 3.1.0
info:
  title: Timbal Platform API
  description: Public API documentation for the Timbal platform
  license:
    name: ''
  version: 2.0.0
servers:
  - url: https://api.timbal.ai
    description: Production
  - url: https://api.dev.timbal.ai
    description: Development
security: []
tags:
  - name: ace
    description: Action Control Engine (ACE) operations
  - name: alarms
    description: Metric series and threshold alarms
  - name: analytics
    description: Org and project analytics
  - name: billing
    description: Subscriptions, usage, and payment-related operations
  - name: channels
    description: Delivery channels alarms notify through
  - name: content
    description: Re-sign stored content URLs
  - name: files
    description: File operations
  - name: iam
    description: IAM — actions, roles, users, and authorization introspection
  - name: k2
    description: Knowledge Bases v2 operations
  - name: orgs
    description: Organization operations
  - name: projects
    description: Project operations
  - name: runs
    description: Execution operations
  - name: templates
    description: Public project template catalog
  - name: users
    description: Authenticated user profile
paths:
  /files:
    post:
      tags:
        - files
      description: Upload a short-lived file for temporary staging.
      operationId: handler
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - file
              properties:
                file:
                  type: array
                  items:
                    type: integer
                    format: int32
                    minimum: 0
                  description: Binary contents of the file. Max 100 MB.
                  contentMediaType: application/octet-stream
        required: true
      responses:
        '200':
          description: File uploaded
          headers:
            RateLimit-Limit:
              schema:
                type: integer
              description: Max requests per window for this user.
            RateLimit-Remaining:
              schema:
                type: integer
              description: Requests left in the current window.
            RateLimit-Reset:
              schema:
                type: integer
              description: Seconds until the current window resets.
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Legacy alias of `RateLimit-Limit`.
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: Legacy alias of `RateLimit-Remaining`.
            X-RateLimit-Reset:
              schema:
                type: integer
              description: Legacy alias of `RateLimit-Reset`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TempFile'
        '413':
          description: File exceeds 100MB limit
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorMessage'
        '429':
          description: Per-user rate limit exceeded
          headers:
            RateLimit-Limit:
              schema:
                type: integer
              description: Max requests per window for this user.
            RateLimit-Remaining:
              schema:
                type: integer
              description: Requests left in the current window.
            RateLimit-Reset:
              schema:
                type: integer
              description: Seconds until the current window resets.
            Retry-After:
              schema:
                type: integer
              description: Seconds the client should wait before retrying.
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Legacy alias of `RateLimit-Limit`.
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: Legacy alias of `RateLimit-Remaining`.
            X-RateLimit-Reset:
              schema:
                type: integer
              description: Legacy alias of `RateLimit-Reset`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorMessage'
      security:
        - bearer_auth: []
components:
  schemas:
    TempFile:
      type: object
      description: Short-lived upload metadata returned by POST /files.
      required:
        - name
        - content_type
        - content_length
        - url
        - created_at
        - expires_at
      properties:
        content_length:
          type: integer
          format: int64
          description: Size of the uploaded payload in bytes.
        content_type:
          type: string
          description: MIME type as reported by the client.
        created_at:
          type: string
          format: date-time
          description: Time the file was uploaded.
        expires_at:
          type: string
          format: date-time
          description: >-
            When the download URL is expected to stop working (~24h after
            upload).
        name:
          type: string
          description: >-
            Original filename (sanitized — slashes / control characters
            replaced).
        url:
          type: string
          description: >-
            Download URL. Anyone with this URL can fetch the file until it
            expires.
    ErrorMessage:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          description: Machine-readable error code (e.g. `ALREADY_EXISTS`, `BAD_REQUEST`).
        message:
          type: string
          description: Human-readable description.
  securitySchemes:
    bearer_auth:
      type: http
      scheme: bearer
      description: >-
        Timbal API key. Obtain your API key from the Timbal platform settings.
        See [Authentication](/api-reference/authentication) for more
        information.

````