Skip to main content
Some files belong to a person, not to your company’s library: a member’s profile picture, a photo on a contact, an image attached to a support message. Uploading them to the DAM would put them in Files, where every admin can browse and reuse them. Private uploads store the file and return its URL, and that’s all. No DAM asset or media item is created, so the file never appears in Files, the DAM picker, or the media list. You save the URL (or, for members, the upload id) wherever the file belongs. There are two routes on upload.fluid.app, one for each kind of token:
Neither route takes a company, member, or folder in the request. The owner always comes from the token, so a file can only land in the token’s own company or member storage.

​
Before you start

  • Use this host, not api.fluid.app. The upload service runs on upload.fluid.app.
  • Keep company and partner tokens on your server. Never send either to a browser. A member route call can come from the member’s own app or browser session, since it carries only that member’s token.
  • “Private” means out of the DAM, not access-controlled. Each file gets a random, unguessable name, but anyone who has the URL can open it. Don’t use private uploads for documents that need signed or expiring links.

​
Send the file

Both routes take the same body. Send the file as multipart/form-data: Or, if you already have the bytes in memory, send application/json with the file base64-encoded: The stored name is always a random prefix plus a cleaned-up version of fileName, so two uploads of headshot.jpg never collide.

​
Set a member’s profile picture

A member uploads their photo with their own token:
The response carries the stored file and an upload_id:
Uploading only stores the file. To make it the member’s picture, send upload_id as avatar_upload_id to update the signed-in member:
Fluid checks that the stored file is really there and is an image before it sets the picture. Each upload_id works once, and must be used within an hour of expires_at. The member route accepts images, videos, PDFs, and presentations. Images can be up to 10 MB, videos 100 MB, and documents 25 MB.

​
Add a photo to a contact

Your server uploads the photo with a company token:
Save url on the record it belongs to. Nothing else refers to the file, so if you don’t store the URL, the file is orphaned. The company route refuses SVG, HTML, XML, JavaScript, and executable files. Images can be up to 10 MB, videos 100 MB, audio 50 MB, and documents and other files 25 MB.

​
Errors

Errors return { "error": "..." }. When Fluid or the storage service refused the request, the body also carries their response under details. Any other 4xx from Fluid is passed back with its own status.