> ## Documentation Index > Fetch the complete documentation index at: https://docs.heliyos.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create an upload URL > Returns a short-lived signed URL to upload one file's bytes to, the first of three steps. Nothing is stored and no file exists until you create it with **Create a file**. The URL is valid for one hour and accepts exactly one body: the `Content-Type` and `Content-Length` you send with the `PUT` must equal `mimeType` and `fileSize` here, or storage refuses the upload. **Accepted content types.** Images (`image/png`, `image/jpeg`, `image/jpg`, `image/gif`, `image/webp`, `image/heic`, `image/heif`, `image/bmp`, `image/tiff`), PDF (`application/pdf`), Office and OpenDocument files (`application/msword`, `application/vnd.openxmlformats-officedocument.wordprocessingml.document`, `application/vnd.ms-excel`, `application/vnd.openxmlformats-officedocument.spreadsheetml.sheet`, `application/vnd.ms-powerpoint`, `application/vnd.openxmlformats-officedocument.presentationml.presentation`, `application/vnd.oasis.opendocument.text`, `application/vnd.oasis.opendocument.spreadsheet`, `application/vnd.oasis.opendocument.presentation`), `application/rtf`, text and data (`text/plain`, `text/csv`, `text/tab-separated-values`, `text/markdown`, `application/json`, `text/calendar`, `message/rfc822`), audio (`audio/mpeg`, `audio/mp4`, `audio/x-m4a`, `audio/wav`, `audio/x-wav`, `audio/webm`, `audio/ogg`), video (`video/mp4`, `video/quicktime`, `video/webm`), ZIP (`application/zip`, `application/x-zip-compressed`) and `application/octet-stream` for anything else. HTML, SVG, XML, scripts and executables are refused. Text types and `application/json` may carry a `; charset=` parameter. **1. Get an upload URL** Call this endpoint with the file's name, content type and exact size in bytes. Keep `presignedUrl`, `fileKey` and `bucketName` from the response. **2. Upload the bytes** Send the file to `presignedUrl` within one hour, without your API key: ```bash curl -X PUT "$PRESIGNED_URL" \ -H "Content-Type: application/pdf" \ -H "Content-Length: 482113" \ --data-binary @pricing-2026.pdf ``` `Content-Type` and `Content-Length` must match `mimeType` and `fileSize` exactly. **3. Create the file** Call **Create a file** with `storageKey` set to `fileKey` and `url` set to `https://{bucketName}.s3.amazonaws.com/{fileKey}`. Until then the file is not listed anywhere and workers cannot read it. > [!NOTE] > > In the Heliyos MCP server: [`heliyos_files_upload`](https://docs.heliyos.ai/mcp/tools/knowledge-base-and-files#heliyos-files-upload). ## OpenAPI ````yaml /api-reference/openapi.json post /v1/platform/attachments/presigned-urls openapi: 3.0.3 info: title: Heliyos API version: 1.0.0 description: >- The REST API for Heliyos, the AI operating system for revenue. Every request is scoped to the workspace that owns the API key. Responses are JSON in a `{ meta, data }` envelope; errors use `{ message, error: { code, message, details } }`. contact: name: Heliyos support email: soham@heliyos.ai url: https://www.heliyos.ai servers: - url: https://api-prod.heliyos.ai description: Production security: - bearerAuth: [] tags: - name: Workspace description: >- The workspace your API key belongs to, and the log of credits it has used. Every other call in this API is scoped to this workspace. - name: Schemas description: >- Objects are your record types: companies, people, deal pipelines and any custom objects you add. Each object has fields, and a field's type decides what its records can hold. - name: Records description: >- Records are the rows of an object (base schema): companies, people, deals and custom objects. A record holds field values keyed by the object's field keys and links to other records. - name: Timeline description: >- The AI-written timeline of a company, person or deal: summary entries Heliyos writes on a schedule. For the exact change history see Activities, and for emails and meetings see Interactions. - name: Activities description: >- The change history of records and tasks: who created, changed or deleted what, and when. People, workers and the system each appear as the actor on the changes they make. - name: Interactions description: >- Email threads and meetings synced from connected mailboxes and calendars, linked to the people and companies they involve. - name: Notes description: >- Free-text notes, optionally linked to records, tasks and interactions. Notes show up on the timeline of every record they are linked to, and workers read them as customer memory. - name: Tasks description: >- Work items for people and workers, optionally linked to records. A task can be assigned to people, to workers, or both, and workers can be started on it directly. - name: Workers and runs description: >- Workers are the AI teammates of your workspace (the API calls them agents). Define what each one does and what starts it, ask Heliyos to do work, and follow every run, its steps and the reviews it waits on. - name: Reviews description: >- Reviews keep the team in control of consequential work. When a worker wants to send an email, change a deal, book a meeting, act in a connected app or needs a person's answer, the action waits as a review until someone approves or rejects it. - name: Scouts description: >- Scouts watch companies and the web for events such as funding rounds, product launches, leadership changes or press coverage, and record each finding as a signal. A workspace Scout defines what to look for; company Scouts are its copies running on individual companies. - name: Signals description: >- Signals are what Scouts find: one event, such as a funding round or a new executive, with a summary, its sources and the company it is about. New signals are unread until you mark them read. - name: Watchlist description: >- The watchlist is the set of companies your workers monitor. Each watched company uses one Watcher from your plan: the workers keep it enriched, pull in its emails and meetings, and run Scouts on it. - name: Knowledge base description: >- What your workers know about the business: the business context, four fixed texts (products, pain points, value proposition, qualification criteria) and any custom entries your team adds. Workers read it on their next run. Files your workers read live under Files, with kind `knowledge_base`. - name: Files description: >- Knowledge base files that workers read, and files attached to records, tasks and other resources. The API calls them attachments. Uploading takes three calls: get an upload URL, send the bytes to it, then create the file. - name: Labels description: >- Label groups that sort your email threads, for example Intent or Pricing questions. Heliyos files each classified thread under a group, and each group holds the more specific labels it brings together. The API calls them classification labels. - name: Team description: >- The people in your workspace and their roles: joined members and pending invitations. Inviting someone sends them an email. - name: Notification settings description: >- Which workspace events send notification emails, how often, and to whom. There is one settings document per workspace, shared by everyone in it. paths: /v1/platform/attachments/presigned-urls: post: tags: - Files summary: Create an upload URL description: >- Returns a short-lived signed URL to upload one file's bytes to, the first of three steps. Nothing is stored and no file exists until you create it with **Create a file**. The URL is valid for one hour and accepts exactly one body: the `Content-Type` and `Content-Length` you send with the `PUT` must equal `mimeType` and `fileSize` here, or storage refuses the upload. **Accepted content types.** Images (`image/png`, `image/jpeg`, `image/jpg`, `image/gif`, `image/webp`, `image/heic`, `image/heif`, `image/bmp`, `image/tiff`), PDF (`application/pdf`), Office and OpenDocument files (`application/msword`, `application/vnd.openxmlformats-officedocument.wordprocessingml.document`, `application/vnd.ms-excel`, `application/vnd.openxmlformats-officedocument.spreadsheetml.sheet`, `application/vnd.ms-powerpoint`, `application/vnd.openxmlformats-officedocument.presentationml.presentation`, `application/vnd.oasis.opendocument.text`, `application/vnd.oasis.opendocument.spreadsheet`, `application/vnd.oasis.opendocument.presentation`), `application/rtf`, text and data (`text/plain`, `text/csv`, `text/tab-separated-values`, `text/markdown`, `application/json`, `text/calendar`, `message/rfc822`), audio (`audio/mpeg`, `audio/mp4`, `audio/x-m4a`, `audio/wav`, `audio/x-wav`, `audio/webm`, `audio/ogg`), video (`video/mp4`, `video/quicktime`, `video/webm`), ZIP (`application/zip`, `application/x-zip-compressed`) and `application/octet-stream` for anything else. HTML, SVG, XML, scripts and executables are refused. Text types and `application/json` may carry a `; charset=` parameter. operationId: createPresignedUrl parameters: [] requestBody: required: true content: application/json: schema: type: object properties: fileName: type: string maxLength: 1000 description: >- The file's name, up to 1,000 characters. It becomes part of the storage key, with separators and control characters replaced. example: pricing-2026.pdf mimeType: type: string maxLength: 200 description: >- The file's content type, one of the accepted types listed above (case-insensitive). Send exactly this value as `Content-Type` with the upload. example: application/pdf objectType: type: string nullable: true description: >- Optional. The type of record the file will be attached to: `company`, `people`, `deal` (or `deals`). Files for these types are stored in a separate folder per type. Any other value, an empty string or null stores the file in the workspace's main folder. example: company fileSize: type: integer minimum: 1 maximum: 26214400 description: >- The file's exact size in bytes, from 1 to 26,214,400 (25 MB). Send exactly this value as `Content-Length` with the upload. example: 482113 required: - fileName - mimeType - fileSize additionalProperties: false example: fileName: pricing-2026.pdf mimeType: application/pdf objectType: company fileSize: 482113 responses: '200': description: The upload URL and the key to create the file with. content: application/json: schema: type: object required: - meta - data properties: meta: type: object required: - message properties: message: type: string description: A human-readable summary of the result. data: $ref: '#/components/schemas/FileUploadUrl' example: meta: message: Presigned URL generated successfully data: presignedUrl: >- https://example-bucket.s3.amazonaws.com/66a0f1e2d3c4b5a697887766/objects/company/1762248600000-pricing-2026.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=3600&X-Amz-SignedHeaders=content-length%3Bcontent-type%3Bhost&X-Amz-Signature=3f9a0c fileKey: >- 66a0f1e2d3c4b5a697887766/objects/company/1762248600000-pricing-2026.pdf bucketName: example-bucket '400': description: >- VALIDATION_FAILED: a field is missing or invalid, `fileSize` is 0 or above 25 MB (26,214,400 bytes), or `mimeType` is not an accepted content type. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '401': description: Unauthenticated content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '429': description: Rate limited content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' components: schemas: FileUploadUrl: type: object properties: presignedUrl: type: string description: >- The signed upload URL. Send the file's bytes to it with `PUT`, within one hour. Do not send your API key to it. fileKey: type: string description: >- The storage key the file will be stored under. Send it back as `storageKey` when you create the file. Its extension comes from `mimeType`, not from `fileName`. bucketName: type: string description: >- The storage bucket the URL uploads to. You need it to build `url` when you create the file. ErrorEnvelope: type: object required: - message - error properties: message: type: string description: Same as error.message. error: type: object required: - code - message properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHENTICATED - FORBIDDEN_ACTION - NOT_FOUND - RATE_LIMITED - CONFLICT - INTERNAL message: type: string details: {} securitySchemes: bearerAuth: type: http scheme: bearer description: >- A workspace API key, sent as `Authorization: Bearer heliyos_...`. Create one in Heliyos under Settings → API keys. A key acts as a workspace admin in the one workspace it was created in. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.