Upload one part
Streams one part of a resumable upload started with the initiateUpload mutation. The body is the raw bytes; Content-MD5 is required and checked. Sending a part again replaces it.
Try the REST routes against the public demo at https://demostash.aldyernesto.my.id. Get a read-only token (valid for 60 minutes), then paste it as the Bearer token in the console of any route.
Streams one part of a resumable upload started with the initiateUpload mutation. The body is the raw bytes; Content-MD5 is required and checked. Sending a part again replaces it.
SessionTokenAuthorizationBearer <token>Session token from POST /api/v1/auth/login or the login mutation, sent as Authorization: Bearer <token>.
sessionId*stringUpload session id (UUID) from the initiateUpload mutation.
partNumber*stringPart number, from 1 to the session's partCount.
Content-MD5*stringBase64 MD5 of the part body (RFC 1864); the server checks it.
body*stringapplication/octet-streamRaw bytes, streamed.
Part stored
application/json- response
partNumber*numberThe part that was stored.
size*numberBytes stored for this part.
confirmedParts*numberHow many parts of the session are stored so far (a count, not a list).
partCount*numberParts the session needs in total.
curl -X PUT "https://example.com/api/v1/uploads/string/parts/string" \ -H "Content-MD5: string" \ -H "Content-Type: application/octet-stream" \ -d 'string'{ "partNumber": 0, "size": 0, "confirmedParts": 0, "partCount": 0}Upload a cover or avatar POST
Multipart form with kind (project or user) and file. Project covers need section.create; an avatar needs an active writable account. The image is re-encoded to JPEG; the answer names its cookie-authorised URL under /media/c.
Set the media cookie POST
Bearer in and media cookie out: sets shotstash_session (HttpOnly; SameSite=Lax; Path=/media) for the session of the Bearer token. Browsers call it after sign-in and on boot. No body.