Begin a direct multipart upload session
Validates the declared name, MIME type, size, and per-part checksums, checks the workspace storage quota, opens a multipart upload against the object store, and returns the session with one presigned URL per part and an expiry. Requires a workspace member with the `files:write` permission. Refused when the storage backend does not support direct uploads, when the declared metadata or part layout is invalid, or when the workspace is over its storage quota. Send an `Idempotency-Key` header to make retries safe; a replay within the window returns the original response.
apiKeyAuthorizationBearer <snoze_sk_…>Workspace API key created in Workspace settings → API keys. Scopes on the key bound what it can read and write.
workspaceId*stringapplication/json- body
name*stringmimeType*stringbyteSize*numberpartSize*numberparts*array<>origin?|nullSuccess
application/json- response
data*curl -X POST 'https://api.snoze.dev/v1/workspaces/string/assets/uploads' \ -H 'Content-Type: application/json' \ -d '{ "name": "string", "mimeType": "string", "byteSize": 0, "partSize": 0, "parts": [ { "partNumber": 0, "checksumSha256": "string" } ]}'{ "data": { "id": "string", "expiresAt": "string", "parts": [ { "partNumber": 0, "checksumSha256": "string", "url": "string" } ] }}Open a protected PDF, save its password privately, or unlock it for all readers
Open and Save require read permission. Save stores an encrypted password only for the authenticated person. Unlock requires file edit permission and replaces the stored PDF with decrypted bytes while preserving its file id and references.
Complete a direct multipart upload
Finalizes the multipart upload, verifies the stored object's size against what the session declared, and returns the resulting asset with its capability URL. Requires a workspace member with the `files:write` permission. A session that has expired, been aborted, or is completed with the wrong number of parts is rejected; completing a session that already finished returns the existing asset. Send an `Idempotency-Key` header to make retries safe; a replay within the window returns the original response.