# Upload

Three file upload paths into storage: a direct form for small files, a presigned PUT for browser uploads, and multipart upload for large files.

**Scope:** `vibe:storage` | **Base URL:** `https://vibecode.bitrix24.com/v1` | **Authorization:** API key (`X-Api-Key`)

## Operations

- [Direct upload](./upload/direct.md) — `POST /v1/storage/objects/upload`
- [Presigned URL](./upload/presigned.md) — `POST /v1/storage/objects`
- [Complete upload](./upload/complete.md) — `POST /v1/storage/objects/complete`
- [Create multipart upload](./upload/multipart-create.md) — `POST /v1/storage/objects/multipart/create`
- [Complete multipart upload](./upload/multipart-complete.md) — `POST /v1/storage/objects/multipart/complete`
- [Abort multipart upload](./upload/multipart-abort.md) — `POST /v1/storage/objects/multipart/abort`

## Upload paths

| Path | File size | Steps |
|---|---|---|
| **A** | up to 10 MB | 1 |
| **B** | up to 5 GB | 3: create URL → PUT → complete |
| **C** | up to 5 TB | 3 + N: create → N × PUT → complete |

## Scenarios

**Choosing a path.** For files up to 10 MB use path A — a single request with a `file` field in a `multipart/form-data` form. For files from 10 MB to 5 GB from the browser use path B: `POST /v1/storage/objects` returns a presigned URL, the browser sends the file directly via PUT, then the server calls `/complete`. For files larger than 100 MB path C is recommended, with parallel parts of at least 5 MB each.

**Aborting a multipart upload.** If an upload is interrupted, call `POST /v1/storage/objects/multipart/abort` — incomplete parts occupy space until an explicit abort or automatic deletion after 24 hours.

**Visibility at upload time.** The `visibility` attribute is set once at upload: `PRIVATE` (default) or `PUBLIC`. For `PUBLIC` objects the types `text/html`, `application/javascript`, `application/x-javascript`, `image/svg+xml` are blocked — such a file returns `415 STORAGE_FORBIDDEN_CONTENT_TYPE`.

## See also

- [Storage](/docs/storage)
- [Objects](/docs/storage/objects)
- [Keys and authorization](/docs/keys-auth)