Skip to main content
PUT
Upload the declared source bytes

Authorizations

Authorization
string
header
required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id
string
header
required

Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.

Path Parameters

stagingId
string<uuid>
required

Body

application/json
bytes_base64
string
required

The exact octets, base64-encoded. Base64 is a TRANSPORT encoding only: the digest is taken over the decoded octets, and what is stored is those octets, so what comes back out is byte-identical to what you sent.

Response

Default Response

id
string<uuid>
required
tenant_id
string<uuid>
required
state
required

PENDING (created, no bytes), STAGED (bytes received and checked against the frozen declaration), FINALISED (an object exists at its content address and was read back and re-hashed), ABANDONED (terminal; abandon_reason says why). FINALISED IS NOT SEALED: a finalised object that no review submission references is an orphan and bounded reconciliation will collect it.

Available options:
PENDING
digest_profile
enum<string>
required
Available options:
sha256/raw
declared_byte_digest
string
required

SHA-256 as 64 lowercase hexadecimal characters.

Pattern: ^[0-9a-f]{64}$
declared_byte_length
integer
required
Required range: x >= 0
media_type
string
required
staged_byte_digest
string | null
required

Digest of what actually arrived. Null before any bytes are received.

Pattern: ^[0-9a-f]{64}$
staged_byte_length
integer | null
required
Required range: x >= 0
source_object_id
string<uuid> | null
required

The object now holding the bytes. Set only in FINALISED.

abandon_reason
required

Why the upload will not proceed. DECLARED_* means the bytes you sent are not what you said you would send; READ_BACK_* means the store did not return what it was given, which is a storage-integrity fault and not a caller error. They are separate values because an operator looks in different places for each.

Available options:
DECLARED_LENGTH_MISMATCH
created_at
string<date-time>
required
updated_at
string<date-time>
required
created_by
string
required