> ## Documentation Index > Fetch the complete documentation index at: https://docs.ndi.nace.ai/llms.txt > Use this file to discover all available pages before exploring further. # create_upload_grant > Mint a short-lived grant an end client redeems to upload directly. Cost class: **fast**. The customer's backend holds the API key; the end user's browser must never see it. This mints an HMAC-signed token that authorizes exactly one thing — ``upload_file`` into this workspace, optionally pinned to one destination path and a byte cap — until ``expires_at``. The holder sends it in the ``X-Upload-Token`` header of a multipart ``POST`` to ``upload_url``, so the bytes travel end-client → NDI once instead of end-client → customer → NDI twice. The grant is stateless (no DB row); its short TTL stands in for revocation, except that revoking the minting API key kills its outstanding grants immediately. Where the deployment runs Redis the grant is additionally single-use. ## OpenAPI ````yaml /openapi.json post /v1/workspaces/{workspace_id}/upload-grants openapi: 3.1.0 info: description: >- Document intelligence: parse, split, classify, extract, and ground files, or build a searchable workspace. Authenticate with ``X-API-Key``. title: NDI Platform API version: 0.1.0 servers: - url: https://ndi-api.nace.ai security: [] tags: [] paths: /v1/workspaces/{workspace_id}/upload-grants: post: tags: - files summary: create_upload_grant description: >- Mint a short-lived grant an end client redeems to upload directly. Cost class: **fast**. The customer's backend holds the API key; the end user's browser must never see it. This mints an HMAC-signed token that authorizes exactly one thing — ``upload_file`` into this workspace, optionally pinned to one destination path and a byte cap — until ``expires_at``. The holder sends it in the ``X-Upload-Token`` header of a multipart ``POST`` to ``upload_url``, so the bytes travel end-client → NDI once instead of end-client → customer → NDI twice. The grant is stateless (no DB row); its short TTL stands in for revocation, except that revoking the minting API key kills its outstanding grants immediately. Where the deployment runs Redis the grant is additionally single-use. operationId: create_upload_grant_v1_workspaces__workspace_id__upload_grants_post parameters: - description: Workspace identifier. in: path name: workspace_id required: true schema: description: Workspace identifier. format: uuid title: Workspace Id type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateUploadGrantRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/UploadGrantResponse' description: Successful Response '504': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Gateway Timeout default: content: application/json: example: error: code: invalid_request detail: null message: >- Request body has extra fields that this operation does not accept. request_id: req-01j9k2n3p4q5r6s7t8v9 retryable: false schema: $ref: '#/components/schemas/ErrorEnvelope' description: >- Typed error envelope used by every 4xx and 5xx. ``error.code`` distinguishes the failure; HTTP status is a consequence of the code. security: - APIKeyHeader: [] components: schemas: CreateUploadGrantRequest: additionalProperties: false description: >- Body for ``POST /workspaces/{workspace_id}/upload-grants``. Every field narrows what the grant's holder may do; an empty body mints a grant for one upload anywhere in the workspace with the default TTL. properties: max_bytes: anyOf: - minimum: 1 type: integer - type: 'null' description: >- Per-grant byte cap, tighter than the service-wide NDI_MAX_UPLOAD_BYTES. Omit for the service cap. title: Max Bytes path: anyOf: - description: >- Pin the upload to exactly this destination path. Omit to let the holder choose. maxLength: 1024 minLength: 1 pattern: ^[^/] type: string - type: 'null' title: Path total_size_bytes: anyOf: - minimum: 0 type: integer - type: 'null' description: >- Exact expected upload size frozen into the grant. Distinct from max_bytes: a short body is rejected even when it fits under the cap. title: Total Size Bytes ttl_seconds: default: 3600 description: How long the grant verifies, in seconds. maximum: 3600 minimum: 1 title: Ttl Seconds type: integer title: CreateUploadGrantRequest type: object UploadGrantResponse: additionalProperties: false description: >- A minted upload grant, ready to hand to an end client. The holder sends ``token`` in the ``X-Upload-Token`` header of a multipart ``POST`` to ``upload_url`` (the workspace's ``upload_file`` route). The grant authorizes that one method only, and is single-use where the deployment runs Redis. properties: expires_at: description: When the grant stops verifying. format: date-time title: Expires At type: string token: description: Send in the X-Upload-Token header of the upload request. title: Token type: string upload_url: description: The upload_file route the token is valid against. title: Upload Url type: string required: - token - upload_url - expires_at title: UploadGrantResponse type: object ErrorEnvelope: description: Every non-2xx body on ``/v1``. example: error: code: invalid_request detail: null message: Request body has extra fields that this operation does not accept. request_id: req-01j9k2n3p4q5r6s7t8v9 retryable: false properties: error: $ref: '#/components/schemas/Error' required: - error title: ErrorEnvelope type: object Error: description: The error object, per spec 12 §1.8. properties: code: $ref: '#/components/schemas/ErrorCode' detail: anyOf: - additionalProperties: true type: object - type: 'null' description: Structured payload, when the code carries one. title: Detail message: description: Human- and model-readable; says what to do differently. title: Message type: string request_id: description: Per-request correlation id; matches the ``X-Request-Id`` header. title: Request Id type: string retryable: description: Whether retrying the identical request could succeed. title: Retryable type: boolean required: - code - message - retryable - request_id title: Error type: object ErrorCode: description: |- Every error the ``/v1`` surface can return. Clients must treat this as an **open** enum: a new member is an additive change (spec 12 §9), and a client that crashes on an unknown code makes every future error a breaking change. enum: - invalid_request - unsupported_file_type - file_too_large - invalid_schema - invalid_sql - invalid_path_prefix - command_not_permitted - batch_too_large - domain_validation_failed - default_label_required - wait_required_for_zero_retention - workspace_not_found - file_not_found - job_not_found - upload_not_found - node_not_found - schema_not_found - domain_not_found - session_not_found - access_label_not_found - path_conflict - schema_version_conflict - access_label_name_taken - workspace_name_taken - access_label_in_use - upload_expired - file_not_ingested - workspace_deleting - workspace_not_deletable - ingestion_in_progress - job_not_cancellable - confirmation_required - domain_not_published - domain_in_use - reserved_domain_slug - kg_not_built - kg_build_in_progress - session_busy - range_not_satisfiable - result_expired - access_denied - access_backstop_violation - access_mode_not_implemented - rate_limited - concurrency_limit_reached - quota_exceeded - corrupt_file - zero_byte_file - encrypted_file - parse_failed - ocr_failed - conversion_failed - sheetless_workbook - unplayable_media - unclassified_pages - job_cancelled - job_timeout - upstream_unavailable - internal_error - unauthorized - not_implemented title: ErrorCode type: string securitySchemes: APIKeyHeader: in: header name: X-API-Key type: apiKey ````