> ## Documentation Index > Fetch the complete documentation index at: https://docs.everabyte.com/llms.txt > Use this file to discover all available pages before exploring further. # Upload files into a folder > Uploads one or more files into an existing folder inside a bucket. The folder must belong to the target bucket. Same limits and multi-file semantics as the bucket-root upload: HTTP `200` on success, and only the first processed file is described in the response. Requires the scopes `buckets:write` + `files:write`. ## OpenAPI ````yaml /api-reference/openapi.json post /files/upload/{bucketId}/{folderId} openapi: 3.1.0 info: title: Everabyte Storage API version: '2026.10' summary: Company-scoped storage API authenticated with API keys. description: >- The Everabyte storage API for company workspaces. Every operation here is reachable with an API key and has been verified against route registration and controller behavior. Authentication uses two headers: `X-Public-Key` and `X-Secret-Key`. API-key headers are not CORS-allowed, so this API is for server-side use only. Response shapes vary by layer. Success responses use `{status, message, data}`. Middleware errors use `{status, message, data, code}`. Controller errors use `{status, message, error}`. See the Conventions page for details. All examples are illustrative. Identifiers, sizes, and timestamps are placeholders, not production data. contact: name: Everabyte Support email: support@everabyte.com url: https://everabyte.com license: name: Proprietary servers: - url: https://api.everabyte.io/api description: Production security: - PublicKey: [] SecretKey: [] tags: - name: Files description: >- List, upload, download, update, move, copy, delete, restore, and version files. - name: Folders description: Browse and manage the folder tree inside a bucket. - name: Buckets description: Discover the buckets a key can reach and read their stored size. paths: /files/upload/{bucketId}/{folderId}: post: tags: - Files summary: Upload files into a folder description: >- Uploads one or more files into an existing folder inside a bucket. The folder must belong to the target bucket. Same limits and multi-file semantics as the bucket-root upload: HTTP `200` on success, and only the first processed file is described in the response. Requires the scopes `buckets:write` + `files:write`. operationId: uploadFileToFolder parameters: - $ref: '#/components/parameters/BucketId' - $ref: '#/components/parameters/FolderId' requestBody: required: true content: multipart/form-data: schema: type: object properties: file: type: string format: binary description: >- File content. Additional file parts may be sent, up to 10 parts. responses: '200': description: First processed file result. content: application/json: schema: $ref: '#/components/schemas/UploadResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '402': $ref: '#/components/responses/PaymentRequired' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '413': $ref: '#/components/responses/PayloadTooLarge' '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/ServerError' components: parameters: BucketId: name: bucketId in: path required: true description: >- Bucket identifier. Read it from the bucket list, or copy it from the Everabyte dashboard. schema: type: string format: uuid FolderId: name: folderId in: path required: true description: Folder identifier. schema: type: string format: uuid schemas: UploadResponse: type: object required: - status - message - data properties: status: type: integer example: 200 message: type: string example: File uploaded data: type: object required: - file - fileId - effectiveFolderId - fileSize - sizeBytes - versionId - scheme - encryption - isUpdate properties: file: type: object required: - id - name - extFile properties: id: type: string format: uuid name: type: string description: Display name without the extension. extFile: type: string description: Lowercased extension without a leading dot. fileId: type: string format: uuid effectiveFolderId: type: - string - 'null' format: uuid fileSize: type: integer sizeBytes: type: integer versionId: type: string scheme: type: string example: hybrid-v1 encryption: type: string enum: - SSE isUpdate: type: boolean description: True when the upload created a new version of an existing file. warning: type: object description: Present when storage is below the low-capacity threshold. properties: is_low: type: boolean threshold_bytes: type: integer remaining_bytes: type: integer message: type: string ErrorEnvelope: type: object description: >- Error shape varies by layer. Middleware errors include `code`; controller errors include `error`; framework errors may use `statusCode`. properties: status: type: integer statusCode: type: integer message: type: string error: type: - string - object - 'null' code: type: string data: type: - object - array - 'null' additionalProperties: true responses: BadRequest: description: Validation or request error. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' Unauthorized: description: Missing, malformed, revoked, or expired credentials. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' PaymentRequired: description: >- Billing state or storage capacity prevents the operation. May include `SUBSCRIPTION_REQUIRED`. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' Forbidden: description: >- Authorization failure. Stable codes include `API_COMPANY_ONLY`, `API_KEY_SURFACE_DENIED`, `API_BUCKET_SCOPE_DENIED`, `TRIAL_API_LIMIT_REACHED`, and `DEVICE_BLOCKED`. A missing scope usually returns no code. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' NotFound: description: Resource not found or not visible to this key. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' PayloadTooLarge: description: Payload exceeds the plan or trial limit. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' RateLimited: description: >- Request rate exceeded. Stable code `API_KEY_RATE_LIMITED`. No `Retry-After` header is documented; use exponential backoff with jitter. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' ServerError: description: Unexpected server error. Messages are sanitized in production. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' securitySchemes: PublicKey: type: apiKey in: header name: X-Public-Key description: >- Public half of the company API key. Format: `pk_` followed by 64 hexadecimal characters. SecretKey: type: apiKey in: header name: X-Secret-Key description: >- Secret half of the company API key. Format: `sk_` followed by 64 hexadecimal characters. Stored as a hash server-side and shown only at creation or rotation. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.