> ## Documentation Index > Fetch the complete documentation index at: https://enterprise-docs.dify.ai/llms.txt > Use this file to discover all available pages before exploring further. # Upload File > **Available for**: Workflow, Chatflow Uploads a file for use in requests to this app in this environment. The returned `id` works only for requests that carry the same `user`, to the same app and environment. A single run can reference at most 100 files. **Standard API equivalent**: [Upload File](/en/3.13.x/develop/api/files/upload-file). Differences: - `user` is required. - The response's `source_url` is a signed download URL. - The combined size of all parts arriving before the `user` field is capped at 100 MiB. - Error codes differ. ## OpenAPI ````yaml /en/3.13.x/develop/api/openapi_service.json post /v2/files/upload openapi: 3.0.1 info: title: Dify Service API description: >- REST API for Dify applications and knowledge bases. Application endpoints authenticate with an app API key; knowledge endpoints authenticate with a dataset API key. version: 1.0.0 servers: - url: https://{api_base_url} description: >- Base URL of the Dify Service API. Replace it with your deployment's API endpoint. variables: api_base_url: default: api.example.com/v1 description: Host and path of the API base URL, without the `https://` prefix. security: - ApiKeyAuth: [] tags: - name: Chat Messages description: Operations related to chat messages and interactions. - name: Files description: File upload and preview operations. - name: End Users description: Operations related to end user information. - name: Feedback description: User feedback operations. - name: Conversations description: Operations related to managing conversations. - name: Audio description: Text-to-Speech and Speech-to-Text operations. - name: Applications description: Operations to retrieve application settings and information. - name: Annotations description: Operations related to managing annotations for direct replies. - name: Human Input description: Endpoints for resuming paused workflows that require human input. - name: Workflow Runs description: Operations for executing and managing workflows. - name: Completion Messages description: Operations related to text generation and completion. - name: Knowledge Bases description: >- Operations for managing knowledge bases, including creation, configuration, and retrieval. - name: Documents description: >- Operations for creating, updating, and managing documents within a knowledge base. - name: Chunks description: Operations for managing document chunks and child chunks. - name: Metadata description: >- Operations for managing knowledge base metadata fields and document metadata values. - name: Tags description: Operations for managing knowledge base tags and tag bindings. - name: Models description: Operations for retrieving available models. - name: Knowledge Pipeline description: >- Operations for managing and running knowledge pipelines, including datasource plugins and pipeline execution. - name: Deployed Environments description: >- Endpoints served by deployed environments over the `v2` base URL. Deployed environments serve only the endpoints in this group; calling any other path there returns `404 not_found`. Authentication and errors differ from the standard Service API; each page here is authoritative for deployed environments. paths: /v2/files/upload: post: tags: - Deployed Environments summary: Upload File description: >- **Available for**: Workflow, Chatflow Uploads a file for use in requests to this app in this environment. The returned `id` works only for requests that carry the same `user`, to the same app and environment. A single run can reference at most 100 files. **Standard API equivalent**: [Upload File](/en/3.13.x/develop/api/files/upload-file). Differences: - `user` is required. - The response's `source_url` is a signed download URL. - The combined size of all parts arriving before the `user` field is capped at 100 MiB. - Error codes differ. operationId: uploadDeployedFile requestBody: description: File upload request. Requires multipart/form-data. required: true content: multipart/form-data: schema: type: object required: - file - user properties: file: type: string format: binary description: >- The file to upload, as one `multipart/form-data` part. The filename must not contain `/` or `\`. Any extension is accepted unless it is on the deployment's security blacklist (`UPLOAD_FILE_EXTENSION_BLACKLIST`, empty by default). Default size limits per category: images 5 MB (10 MB on Docker Compose deployments), audio 50 MB, video 100 MB, other files 15 MB. Your platform administrator can change them with the `UPLOAD_*_FILE_SIZE_LIMIT` [environment variables](/en/3.13.x/deploy/advanced-configuration/environment-variables). user: type: string description: >- End-user identifier, defined by your app and unique within it. The file belongs to this `user` in this app and environment. Send this part before the `file` part when possible; the combined size of parts arriving before it is capped at 100 MiB. See [End User Identity](/en/3.13.x/develop/api/guides/end-user-identity). maxLength: 512 responses: '201': description: The stored file, with the `id` to reference in a run. content: application/json: schema: $ref: '#/components/schemas/FileUploadResponse' examples: uploadSuccess: summary: Response Example value: id: a1b2c3d4-5678-90ab-cdef-1234567890ab reference: null name: product-photo.png size: 204800 extension: png mime_type: image/png created_by: f1e2d3c4-b5a6-7890-abcd-ef1234567890 created_at: 1705407629 preview_url: null source_url: >- https://api.example.com/files/appdeploy/a1b2c3d4-5678-90ab-cdef-1234567890ab/content?token=eyJhbGciOiJIUzI1NiJ9.example original_url: null user_id: null tenant_id: 11223344-5566-7788-99aa-bbccddeeff00 conversation_id: null file_key: null '400': description: >- - `invalid_param`: the `user` form field is missing. Message `user form field is required`. - `invalid_param`: the multipart form cannot be read. Message `invalid multipart form`. - `invalid_param`: `user` is longer than 512 bytes. Message `invalid multipart form`. - `invalid_param`: `user` is empty or only whitespace. Message `user is invalid`. - `invalid_param`: the filename contains `/` or `\`. Message `Filename contains invalid characters`. - `file_extension_blocked`: the file's extension is on the deployment's blocklist. - `no_file_uploaded`: the `file` part is missing. - `too_many_files`: more than one `file` part was sent. - `filename_not_exists_error`: the `file` part has no filename. content: application/json: examples: invalid_param: summary: invalid_param value: code: invalid_param message: user form field is required status: 400 invalid_param_multipart: summary: invalid_param (multipart form) value: code: invalid_param message: invalid multipart form status: 400 invalid_param_user: summary: invalid_param (user) value: code: invalid_param message: user is invalid status: 400 invalid_param_filename: summary: invalid_param (filename) value: code: invalid_param message: Filename contains invalid characters status: 400 file_extension_blocked: summary: file_extension_blocked value: code: file_extension_blocked message: File extension '.exe' is not allowed for security reasons status: 400 no_file_uploaded: summary: no_file_uploaded value: status: 400 code: no_file_uploaded message: Please upload your file. too_many_files: summary: too_many_files value: status: 400 code: too_many_files message: Only one file is allowed. filename_not_exists_error: summary: filename_not_exists_error value: status: 400 code: filename_not_exists_error message: The specified filename does not exist. '401': description: |- - `token_invalid`: the API key is missing, malformed, or unknown. - `unauthorized`: the API key has been revoked. content: application/json: examples: token_invalid: summary: token_invalid value: code: token_invalid message: invalid api token status: 401 unauthorized: summary: unauthorized value: code: unauthorized message: Access token is invalid status: 401 '403': description: '`forbidden`: the app''s API access is turned off in **Access Point**.' content: application/json: examples: forbidden: summary: forbidden value: code: forbidden message: The app's API service has been disabled. status: 403 '404': description: >- `file_not_found`: the `user` could not be matched to an end user of this app; contact your administrator if it persists. content: application/json: examples: file_not_found: summary: file_not_found value: code: file_not_found message: File not found. status: 404 '413': description: >- - `file_too_large`: the parts that arrived before the `user` field exceed 100 MiB. - `file_too_large`: the file exceeds the size limit for its extension; the message names that limit in bytes. content: application/json: examples: file_too_large: summary: file_too_large value: status: 413 code: file_too_large message: File size exceeded. file_too_large_platform_limit: summary: file_too_large (platform limit) value: code: file_too_large message: File size exceeded. The limit is 15728640 bytes. status: 413 '503': description: >- - `file_grant_unavailable`: file uploads are temporarily unavailable; retry shortly. - `deployment_undeployed`, `deployment_not_ready`, `apprunner_not_deployed`, `enterprise_unavailable`: the environment cannot serve requests right now; see the codes on [Run Workflow](/en/3.13.x/develop/api/deployed-environments/run-workflow). content: application/json: examples: file_grant_unavailable: summary: file_grant_unavailable value: code: file_grant_unavailable message: file upload is temporarily unavailable status: 503 deployment_undeployed: summary: deployment_undeployed value: code: deployment_undeployed message: deployment is not deployed status: 503 deployment_not_ready: summary: deployment_not_ready value: code: deployment_not_ready message: deployment is in progress status: 503 apprunner_not_deployed: summary: apprunner_not_deployed value: code: apprunner_not_deployed message: apprunner not deployed for this environment status: 503 enterprise_unavailable: summary: enterprise_unavailable value: code: enterprise_unavailable message: enterprise routing service unavailable status: 503 servers: - url: https://{deployed_api_base_url} description: >- Base URL shared by every deployed environment: the standard Service API address, with `/v2` in place of `/v1`. variables: deployed_api_base_url: default: api.example.com description: >- On the app's **Access Point** tab, copy the full URL from any deployed environment's **Backend Service API** card, then remove the `https://` prefix and the trailing `/v2`. components: schemas: FileUploadResponse: type: object properties: id: type: string format: uuid description: Unique file ID. reference: type: string nullable: true description: >- Opaque file reference used internally when attaching files in agent and tool contexts. Always `null` for files uploaded through this endpoint. name: type: string description: File name. size: type: integer description: File size in bytes. extension: type: string nullable: true description: File extension. mime_type: type: string nullable: true description: MIME type of the file. created_by: type: string format: uuid nullable: true description: >- End-user ID of the uploader. Look up details with [Get End User Info](/en/3.13.x/develop/api/end-users/get-end-user-info). created_at: type: integer format: int64 description: Upload timestamp (Unix epoch seconds). preview_url: type: string nullable: true description: Preview URL for the file. source_url: type: string description: Signed URL for downloading the file. original_url: type: string nullable: true description: Original URL of the file. user_id: type: string format: uuid nullable: true description: Unused; always `null`. tenant_id: type: string format: uuid nullable: true description: ID of the associated tenant. conversation_id: type: string format: uuid nullable: true description: ID of the associated conversation. file_key: type: string nullable: true description: Unused; always `null`. securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API_KEY description: >- Every request authenticates with an API key: `Authorization: Bearer {API_KEY}`. App endpoints take an app API key; knowledge endpoints take a knowledge base API key ([Get Started](/en/3.13.x/develop/api/guides/get-started)). Keep keys server-side; never embed them in client code. Requests with a missing or invalid key fail with HTTP `401` (`unauthorized`). ````