Start a bundle upload
Starts publishing one of the member’s sites as a built static bundle. Rails assigns the bundle id, checks the files against the limits and the content-type allowlist (each route against the files), the access declaration, schema and meta, records the bundle as uploading for 60 minutes, and asks the sites gateway for signed PUT URLs for the blobs the site does not store yet. Upload each blob to its URL, then publish the bundle. Nothing is served until it is published, and the site’s current version keeps serving. A site may have 5 uploads in progress at once, each lasting 60 minutes, so an older upload on another device keeps working; a start finds failed and expired uploads deleted, and a sixth is refused with 409 until one finishes or expires. Published bundles are kept and do not count.
Bearer only: a request on the cookie mount is refused with 403, so a site’s own code cannot publish. It answers 404 until the sites gateway is released to the member’s company, and for a site the member may not change. A gateway that cannot prepare the uploads is a 502; the bundle is then failed, and starting again makes a new one. A 409 also answers a site already at its 5 uploads in progress.
curl --request POST \
--url https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"files": {
"/index.html": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"size": 1832,
"contentType": "text/html; charset=utf-8"
},
"/assets/app-3f2a9c.js": {
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"size": 48211,
"contentType": "text/javascript; charset=utf-8",
"immutable": true
}
}
}
'import requests
url = "https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles"
payload = { "files": {
"/index.html": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"size": 1832,
"contentType": "text/html; charset=utf-8"
},
"/assets/app-3f2a9c.js": {
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"size": 48211,
"contentType": "text/javascript; charset=utf-8",
"immutable": True
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
files: {
'/index.html': {
sha256: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
size: 1832,
contentType: 'text/html; charset=utf-8'
},
'/assets/app-3f2a9c.js': {
sha256: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
size: 48211,
contentType: 'text/javascript; charset=utf-8',
immutable: true
}
}
})
};
fetch('https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'files' => [
'/index.html' => [
'sha256' => 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
'size' => 1832,
'contentType' => 'text/html; charset=utf-8'
],
'/assets/app-3f2a9c.js' => [
'sha256' => 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
'size' => 48211,
'contentType' => 'text/javascript; charset=utf-8',
'immutable' => true
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles"
payload := strings.NewReader("{\n \"files\": {\n \"/index.html\": {\n \"sha256\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"size\": 1832,\n \"contentType\": \"text/html; charset=utf-8\"\n },\n \"/assets/app-3f2a9c.js\": {\n \"sha256\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"size\": 48211,\n \"contentType\": \"text/javascript; charset=utf-8\",\n \"immutable\": true\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"files\": {\n \"/index.html\": {\n \"sha256\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"size\": 1832,\n \"contentType\": \"text/html; charset=utf-8\"\n },\n \"/assets/app-3f2a9c.js\": {\n \"sha256\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"size\": 48211,\n \"contentType\": \"text/javascript; charset=utf-8\",\n \"immutable\": true\n }\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"files\": {\n \"/index.html\": {\n \"sha256\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"size\": 1832,\n \"contentType\": \"text/html; charset=utf-8\"\n },\n \"/assets/app-3f2a9c.js\": {\n \"sha256\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"size\": 48211,\n \"contentType\": \"text/javascript; charset=utf-8\",\n \"immutable\": true\n }\n }\n}"
response = http.request(request)
puts response.read_body{
"status": 201,
"data": {
"bundle": "0199537f-0000-7000-8000-000000000004",
"uploads": [
{
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"crc32c": "n03x6A==",
"url": "https://storage.googleapis.com/fluid-production-member-sites/sites/0199537f-0000-7000-8000-000000000001/blobs/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Expires=3600&X-Goog-Signature=5f1e",
"headers": {
"content-type": "application/octet-stream",
"x-goog-hash": "crc32c=n03x6A=="
}
}
],
"expiresAt": "2026-11-05T11:00:00.000Z"
},
"meta": {
"request_uuid": "0192f4c8-5b6c-7d74-a3e8-0f1a2b3c4d5e",
"timestamp": "2026-11-05T10:00:00Z"
}
}Authorizations
A member credential in the Authorization: Bearer header: a member
session JWT, a portal JWT whose login is linked to a membership in
that company, an opaque member token, or a verified One Auth identity
access token. The credential alone identifies the member and company.
Member session JWTs, and portal JWTs the server minted read-only, are
refused with 403 on every write.
Path Parameters
Public id of one of the member's sites.
Body
The build output's files and metadata. db/schema.json and every config/*.json are bundle metadata, never served as files, so they are sent as schema, routes, access and meta and never in files.
Every servable file, by absolute bundle path with / separators, no . or .. segment and none under /_fluid/. At most 2,000 files, 25 MiB each and 250 MiB in all.
Show child attributes
Show child attributes
From config/routes.json. Omitted, every path is answered by /index.html, as a single-page app is, so a bundle with no /index.html must send routes of its own ([] for none). Each route's file must be a file of the request.
One route of the site's config/routes.json. Its file is a file of the request.
- Option 1
- Option 2
Show child attributes
Show child attributes
The site's db/schema.json, checked when the bundle starts against the contract's JSON Schema: a table and column limit, names, types, defaults and rules. Rules that need more than a schema, such as a real calendar day or a column an index names, are checked when the bundle is published.
Show child attributes
Show child attributes
The site's config/access.json, the Fluid data the site uses, in the format MemberSites::AccessDeclaration validates. It is checked when the bundle starts.
Show child attributes
Show child attributes
The site's config/meta.json, the title and preview of each page. Checked when the bundle starts: a title of at most 200 characters, a description of at most 500, an https image, and no page under /_fluid/.
Show child attributes
Show child attributes
After V1. Each server function's built module and its config/functions.json entry. Functions are not available yet, so a request that lists any is refused with functions_not_available, and {} is none.
Response
The bundle, and the uploads it still needs.
curl --request POST \
--url https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"files": {
"/index.html": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"size": 1832,
"contentType": "text/html; charset=utf-8"
},
"/assets/app-3f2a9c.js": {
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"size": 48211,
"contentType": "text/javascript; charset=utf-8",
"immutable": true
}
}
}
'import requests
url = "https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles"
payload = { "files": {
"/index.html": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"size": 1832,
"contentType": "text/html; charset=utf-8"
},
"/assets/app-3f2a9c.js": {
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"size": 48211,
"contentType": "text/javascript; charset=utf-8",
"immutable": True
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
files: {
'/index.html': {
sha256: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
size: 1832,
contentType: 'text/html; charset=utf-8'
},
'/assets/app-3f2a9c.js': {
sha256: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
size: 48211,
contentType: 'text/javascript; charset=utf-8',
immutable: true
}
}
})
};
fetch('https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'files' => [
'/index.html' => [
'sha256' => 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
'size' => 1832,
'contentType' => 'text/html; charset=utf-8'
],
'/assets/app-3f2a9c.js' => [
'sha256' => 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
'size' => 48211,
'contentType' => 'text/javascript; charset=utf-8',
'immutable' => true
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles"
payload := strings.NewReader("{\n \"files\": {\n \"/index.html\": {\n \"sha256\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"size\": 1832,\n \"contentType\": \"text/html; charset=utf-8\"\n },\n \"/assets/app-3f2a9c.js\": {\n \"sha256\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"size\": 48211,\n \"contentType\": \"text/javascript; charset=utf-8\",\n \"immutable\": true\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"files\": {\n \"/index.html\": {\n \"sha256\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"size\": 1832,\n \"contentType\": \"text/html; charset=utf-8\"\n },\n \"/assets/app-3f2a9c.js\": {\n \"sha256\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"size\": 48211,\n \"contentType\": \"text/javascript; charset=utf-8\",\n \"immutable\": true\n }\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fluid.app/api/member/v2026-10/sites/{site_id}/bundles")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"files\": {\n \"/index.html\": {\n \"sha256\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"size\": 1832,\n \"contentType\": \"text/html; charset=utf-8\"\n },\n \"/assets/app-3f2a9c.js\": {\n \"sha256\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"size\": 48211,\n \"contentType\": \"text/javascript; charset=utf-8\",\n \"immutable\": true\n }\n }\n}"
response = http.request(request)
puts response.read_body{
"status": 201,
"data": {
"bundle": "0199537f-0000-7000-8000-000000000004",
"uploads": [
{
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"crc32c": "n03x6A==",
"url": "https://storage.googleapis.com/fluid-production-member-sites/sites/0199537f-0000-7000-8000-000000000001/blobs/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Expires=3600&X-Goog-Signature=5f1e",
"headers": {
"content-type": "application/octet-stream",
"x-goog-hash": "crc32c=n03x6A=="
}
}
],
"expiresAt": "2026-11-05T11:00:00.000Z"
},
"meta": {
"request_uuid": "0192f4c8-5b6c-7d74-a3e8-0f1a2b3c4d5e",
"timestamp": "2026-11-05T10:00:00Z"
}
}