> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.morphiaone.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.morphiaone.ai/_mcp/server.

# Start an upload session

POST https://api.morphiaone.ai/v1/uploads

Starts a single-use link that a person sends one photo through, with no API
key: for an agent that never holds the photo. Send the `upload_url` to the
person; they open it to choose the photo, or send it with
`curl -T photo.jpg <upload_url>`. Treat the link as opaque, like a presigned
URL: it takes a `PUT` of the image bytes with their `Content-Type` and no API
key, and answers `201` with the stored session. The first stored photo wins
and a later send answers `409 UPLOAD_ALREADY_USED`; a refused body (`413`,
`415`, `422`) leaves the link usable; an unknown, expired or revoked link
answers `404 UPLOAD_NOT_FOUND`. The link works once and expires at
`expires_at` (15 minutes); the photo is held to `max_bytes` and
`content_types`, the limits of `POST /v1/assets`. Read the session until it is
`stored`, then retain its `asset_id` as evidence.
`upload_url` carries the link's secret, which is stored only as a digest: it is
in this answer only. Send an `Idempotency-Key`: it is required, and a retry
with the same key answers the same session with `upload_url` null and
`Idempotency-Replayed: true`; start a new session for a new link.
Requires the `digitisation.write` scope; served only where digitisation and
upload sessions are enabled for your environment.

Reference: https://docs.morphiaone.ai/api-reference/endpoints/uploads/create

## Authentication

- `X-API-Key` header (required) — API key for one environment of your account. Keep server-side; never expose in browser clients.

## Request

### Headers

- `Idempotency-Key` (string, optional, nullable)

## Response

### 201

The session and its single-use upload_url; a replay under the same Idempotency-Key answers it with Idempotency-Replayed: true and no url

- `asset_id` (string, required, nullable)
- `content_types` (list of enum, required)
  - Allowed values: `image/jpeg`, `image/png`, `image/webp`
- `expires_at` (datetime, required)
- `id` (string, required)
- `max_bytes` (integer, required)
- `status` (enum, required)
  - Allowed values: `pending`, `stored`, `expired`
- `upload_url` (string, required, nullable)

## Errors

### 400 Bad Request Error

Invalid Idempotency-Key

- `error` (ErrorDetail, required)

### 401 Unauthorized Error

Missing or invalid API key

- `error` (ErrorDetail, required)

### 403 Forbidden Error

API key lacks the digitisation.write scope

- `error` (ErrorDetail, required)

### 503 Service Unavailable Error

Digitisation unavailable

- `error` (ErrorDetail, required)

## Types

### ErrorDetail

- `code` (string, required)
- `message` (string, required)
- `request_id` (string, required)
- `details` (ErrorDetailDetails, optional)
- `doc_url` (string, optional, nullable)
- `retryable` (boolean, optional, nullable)

### ErrorDetailDetails

- map from string to any
- list of map from string to any

## Examples

**Response**

```json
{
  "asset_id": null,
  "content_types": [
    "image/jpeg",
    "image/png",
    "image/webp"
  ],
  "expires_at": "2026-11-08T12:15:00Z",
  "id": "upload_7k3m9q2w5x8z1c4f6h0j2n4p6r",
  "max_bytes": 10485760,
  "status": "pending",
  "upload_url": "https://example.com/v1/uploads/upload_7k3m9q2w5x8z1c4f6h0j2n4p6r/Xq3vR8sT1uW6yZ0bC4dF7gH9jK2mN5pQ8rS1tV4wX7y"
}
```

**SDK Code**

```python Uploads_create_example
import requests

url = "https://api.morphiaone.ai/v1/uploads"

headers = {"X-API-Key": "<apiKey>"}

response = requests.post(url, headers=headers)

print(response.json())
```

```javascript Uploads_create_example
const url = 'https://api.morphiaone.ai/v1/uploads';
const options = {method: 'POST', headers: {'X-API-Key': '<apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Uploads_create_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.morphiaone.ai/v1/uploads"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("X-API-Key", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Uploads_create_example
require 'uri'
require 'net/http'

url = URI("https://api.morphiaone.ai/v1/uploads")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java Uploads_create_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.morphiaone.ai/v1/uploads")
  .header("X-API-Key", "<apiKey>")
  .asString();
```

```php Uploads_create_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.morphiaone.ai/v1/uploads', [
  'headers' => [
    'X-API-Key' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp Uploads_create_example
using RestSharp;

var client = new RestClient("https://api.morphiaone.ai/v1/uploads");
var request = new RestRequest(Method.POST);
request.AddHeader("X-API-Key", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift Uploads_create_example
import Foundation

let headers = ["X-API-Key": "<apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.morphiaone.ai/v1/uploads")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```