Prepare image uploads

Get temporary PUT URLs for original image uploads.

POST/v1/properties/{property_id}/images/uploads

On this page

Example request
Authorization
Path parameters
Request body
Response
Errors

Send file metadata to reserve an upload session. Upload each accepted file's bytes directly to upload_url with HTTP PUT and the declared Content-Type. Do not send your Vestta API key to the storage URL.

Files must be JPEG, PNG or WebP, at most 10 MiB each. A property can contain at most 15 images. file_id is your correlation ID and must be unique within the session.

The original goes into private storage. An upload URL is temporary, permits upload only and is not a public photo URL. Inspect rejected before continuing; complete only accepted uploads.

Example request

curl -X POST "https://api.vestta.app/v1/properties/1/images/uploads" \
  -H "X-Api-Key: $VESTTA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "files": [
    {
      "file_id": "photo-1",
      "filename": "living-room.jpg",
      "content_type": "image/jpeg",
      "size": 125000
    }
  ]
}'

Authorization

X-Api-Keystringheaderrequired
Your API key, AC_LIVE_<key_id>.<secret>. Authorization: ApiKey <key> is also accepted.

Path parameters

property_idintegerrequired≥ 1

Request body

application/json · required

filesarray of objectsrequired
- file_idstringrequired1–100 chars
- filenamestringrequired1–255 chars
- content_typestringrequired
  One ofimage/jpegimage/pngimage/webp
- sizeintegerrequired> 0≤ 10485760

Response

201 Successful response.

Example response

{
  "session_id": "upl_21_example",
  "accepted": [
    {
      "file_id": "photo-1",
      "upload_id": "1234567890ABCDEF",
      "upload_url": "https://private-storage.example/upload?signed=temporary"
    }
  ],
  "rejected": []
}

Response fields

session_idstringrequired
acceptedarray of objectsrequired
- file_idstringrequired
- upload_idstringrequired
- upload_urlstringrequired
rejectedarray of objectsrequired
- file_idstringrequired
- filenamestringrequired
- reasonstringrequired

Errors

Status	When
401 Unauthorized	The API key is missing, malformed, unknown, revoked or expired.
403 Forbidden	The API key lacks the required scope.
404 Not Found	The resource does not exist in this business.
409 Conflict	Duplicate contact or idempotency key reused with a different payload.
422 Unprocessable Content	A path parameter, query parameter or body field is invalid.
500 Internal Server Error	Unexpected server error while processing the request.

Error bodies and how to handle each case: Errors.