> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Upload app file
> This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.
Uploads a file to the app's storage and returns a link to it.
Send the file as `multipart/form-data`. Use the public link of an uploaded image as `logo_url` in [Set app logo](/api-reference/set-app-logo) or as `social_image_url` in [Set social image](/api-reference/set-social-image).
A public file gets a permanent link that anyone can open. A private file gets a signed link that expires after `expires_in` seconds, one hour at most, and this API has no way to get a new link for it. Upload a private file only when you use its link right away.
The size limit depends on the extension in the file name. For example, it's 40 MB for JPEG, PNG, GIF and WebP images, 5 MB for SVG, 100 MB for video and MP3 or WAV audio, and 10 MB for PDF and for any extension without its own limit. Executable and script files such as `.exe`, `.bat`, `.jar` and `.apk` are refused. Files are scanned for malware after the upload returns.
This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted.
## OpenAPI
````yaml /developers/references/app-management/app-management-openapi.json post /api/files/apps/{app_id}/upload
openapi: 3.1.0
info:
title: Base44 App Management API
version: 1.0.0
servers:
- url: https://app.base44.com
security:
- PersonalAccessTokenAuth: []
paths:
/api/files/apps/{app_id}/upload:
post:
summary: Upload app file
description: >-
This API is in beta. Endpoints, fields, and behavior may still
change, so avoid depending on it in production.
Uploads a file to the app's storage and returns a link to it.
Send the file as `multipart/form-data`. Use the public link of an
uploaded image as `logo_url` in [Set app
logo](/api-reference/set-app-logo) or as `social_image_url` in [Set
social image](/api-reference/set-social-image).
A public file gets a permanent link that anyone can open. A private file
gets a signed link that expires after `expires_in` seconds, one hour at
most, and this API has no way to get a new link for it. Upload a private
file only when you use its link right away.
The size limit depends on the extension in the file name. For example,
it's 40 MB for JPEG, PNG, GIF and WebP images, 5 MB for SVG, 100 MB for
video and MP3 or WAV audio, and 10 MB for PDF and for any extension
without its own limit. Executable and script files such as `.exe`,
`.bat`, `.jar` and `.apk` are refused. Files are scanned for malware
after the upload returns.
This endpoint accepts a personal API key belonging to a user with
editor access to the app. A read-only key is refused, and workspace API
keys are not accepted.
operationId: upload_app_file_endpoint_api_files_apps__app_id__upload_post
parameters:
- name: app_id
in: path
required: true
schema:
type: string
description: ID of the app to upload the file to.
title: App Id
description: ID of the app to upload the file to.
example: 6820f3a4e7b91d003c45a1f2
requestBody:
required: true
content:
multipart/form-data:
schema:
type: object
title: UploadAppFile
required:
- file
properties:
file:
type: string
format: binary
description: The file to upload.
visibility:
type: string
enum:
- public
- private
default: public
description: >-
`public` for a permanent link anyone can open, or `private`
for a signed link that expires.
expires_in:
type: integer
minimum: 60
maximum: 3600
default: 3600
description: >-
Seconds until a private file's link expires. Ignored for a
public file.
responses:
'200':
description: The stored file and its link.
content:
application/json:
schema:
$ref: '#/components/schemas/UploadedAppFile'
'400':
description: >-
The file is empty, too large for its extension, of a refused type,
or its size couldn't be determined.
'401':
description: Missing or invalid credentials.
'403':
description: >-
You don't have editor access to this app, or your API key is
read-only.
'404':
description: App not found.
'422':
description: >-
`file` is missing, `visibility` isn't `public` or `private`, or
`expires_in` is outside 60 to 3600.
components:
schemas:
UploadedAppFile:
properties:
file_uri:
type: string
title: File Uri
description: >-
Storage URI of the file. `mp/public/` or `mp/private/` shows its
visibility.
example: mp/public/6820f3a4e7b91d003c45a1f2/3f2504e0_logo.png
url:
type: string
title: Url
description: >-
Link to the file. For a public file it's permanent and anyone with
it can open the file. For a private file it's a signed link that
stops working after `expires_in` seconds.
example: >-
https://storage.base44.com/6820f3a4e7b91d003c45a1f2/3f2504e0_logo.png
type: object
required:
- file_uri
- url
title: UploadedAppFile
description: 'Doc-only: the handler returns a plain dict with exactly these keys.'
securitySchemes:
PersonalAccessTokenAuth:
type: http
scheme: bearer
description: 'Personal access token, sent as `Authorization: Bearer `.'
````