---
title: "Publish an uploaded file"
description: "Publishes a file uploaded with Get a single upload URL, after checking its real size and type."
canonical_url: https://docs.markdrop.in/api/files/publish-an-uploaded-file
last_updated: 2026-10-30
site: "Markdrop Docs"
index: https://docs.markdrop.in/llms.txt
---

# Publish an uploaded file

`POST https://api.markdrop.in/api/v1/artifacts`

Publishes a file uploaded with [Get a single upload URL](https://docs.markdrop.in/api/files/get-a-single-upload-url), after checking its real size and type.

- **Authentication:** API token required: `Authorization: Bearer mdk_…`.
- **Rate limit:** 20 per minute per IP address.

## Request body

`application/json`, required.

- `blob_key` (string, required): 1–300 characters.
- `title` (string): Shown on the page and in link previews. Up to 200 characters.
- `filename` (string): Up to 255 characters.
- `custom_slug` (string): Your own address: `markdrop.in/<custom_slug>`. Letters, digits, `-` and `_`. Taken or reserved addresses answer `409`. 3–50 characters. Matches `^[a-zA-Z0-9_-]+$`.
- `expires_in` ("never" | "1d" | "7d" | "30d" | "custom"): When the document is deleted. `custom` needs `custom_expires_at`. Default `"never"`.
- `custom_expires_at` (string (date-time)): The deletion time, when `expires_in` is `custom`. Must be in the future. ISO 8601, for example `2026-11-30T12:00:00Z`.
- `read_password` (string): Readers must enter this password before they see the content. 1–100 characters.
- `access_level` ("private" | "link" | "workspace"): Who can open it: `link` (anyone with the link), `private` (only you and the people you share it with) or `workspace` (members of its workspace). Default `"link"`.
- `workspace` (string): File it in this workspace: the workspace's id. 1–64 characters.
- `folder` (string): An existing folder of `workspace`: its id or its path, like `guides/setup`. 1–400 characters.

## Responses

- `201`: Created.
  - `slug` (string)
  - `url` (string)
  - `title` (string | null): Shown on the page and in link previews.
  - `kind` (string): Default `"artifact"`.
  - `mime` (string)
  - `renderer` (string)
  - `type_label` (string)
  - `size_bytes` (integer)
  - `original_filename` (string | null)
  - `artifact_url` (string)
  - `workspace_url` (string | null)
  - `download_url` (string)
  - `poster_url` (string | null)
  - `media` (object | null)
  - `created_at` (string (date-time)): ISO 8601, for example `2026-11-30T12:00:00Z`.
  - `updated_at` (string (date-time)): ISO 8601, for example `2026-11-30T12:00:00Z`.
  - `expires_at` (string (date-time) | null): ISO 8601, for example `2026-11-30T12:00:00Z`.
  - `views` (integer): Default `0`.
  - `is_password_protected` (boolean): Default `false`.
  - `is_owner` (boolean): Default `false`.
  - `edit_secret` (string)
  - `workspace_error` (string | null)
- `401`: No token, or the token is revoked or mistyped.
- `422`: The request didn't validate. `detail` lists each problem, with where it is (`loc`) and why (`msg`).
- `429`: Too many requests from your IP address. Wait the seconds in `Retry-After`.

## Examples

**curl**

```bash
curl -X POST https://api.markdrop.in/api/v1/artifacts \
  -H "Authorization: Bearer $MARKDROP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"blob_key":"BLOB_KEY","title":"Q3 deck"}'
```

**JavaScript**

```javascript
const res = await fetch("https://api.markdrop.in/api/v1/artifacts", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.MARKDROP_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "blob_key": "BLOB_KEY",
    "title": "Q3 deck"
  }),
});
const data = await res.json();
```

**Python**

```python
import os

import requests

r = requests.post(
    "https://api.markdrop.in/api/v1/artifacts",
    headers={"Authorization": f"Bearer {os.environ['MARKDROP_TOKEN']}"},
    json={"blob_key": "BLOB_KEY", "title": "Q3 deck"},
)
r.raise_for_status()
print(r.json())
```