Files

File operations check application ownership and Management API key scopes. Avatar upload and retrieval require a dashboard session.

File name rulesCopy Anchor Link

Names contain 1–16 ASCII letters, numbers, underscores, or dashes. A single space or dot can separate groups of these characters; names cannot start or end with a space or dot. Surrounding whitespace and invisible characters are removed before validation.

Upload a fileCopy Anchor Link

POST /api/v1/panel/upload-file?applicationId=123456789&fileName=setup-bin

Required scope: files:upload

Send the file bytes directly as application/octet-stream. The server streams the file to private storage, computes its size and SHA-256, and saves metadata before returning success.

curl "https://api.blazeauth.net/api/v1/panel/upload-file?applicationId=123456789&fileName=setup-bin" \
  -X POST \
  -H "Authorization: Bearer $BLAZEAUTH_MANAGEMENT_API_KEY" \
  -H "Content-Type: application/octet-stream" \
  --data-binary @setup.bin

{
  "success": true,
  "message": "File uploaded.",
  "data": {
    "id": "4001",
    "byteSize": 1048576,
    "checksum": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  }
}

The maximum file size is 150 MiB. Each active file in an active application uses its size in MiB rounded down, with a minimum charge of 1 MiB. The server checks the remaining storage allowance and file count limit before and after streaming. An empty file returns invalid_file; a duplicate name returns file_name_taken; exceeding quota returns HTTP 413 with limit_exceeded. Content-Length is optional: the server enforces the size limit while reading the body.

One upload per account may run at a time. Uploads have a 180-second deadline and a limit of 10 attempts per minute. Interrupted uploads are aborted. The former get-presigned-upload-url and check-file-uploaded-status endpoints have been removed; migrate clients to this endpoint.

Files are private. The Management API provides upload and metadata operations; client applications download files through the authenticated SDK flow.

Upload an avatarCopy Anchor Link

POST /api/v1/panel/upload-avatar

Send image bytes as application/octet-stream with a dashboard session and the production CSRF header. Management API keys cannot upload avatars.

PNG, JPEG, and WebP images up to 3 MiB and 16 million pixels are accepted after content validation. Animated images are rejected. Images are resized to at most 256 x 256, converted to WebP, and stripped of metadata. Success returns an avatarUrl on the backend; GET /api/v1/panel/avatar requires the owner's session and sends Cache-Control: private, max-age=86400, immutable. Each uploaded avatar has a new URL. The dashboard shows the OAuth profile image until a custom avatar is uploaded; the avatar endpoint does not fetch external images.

Check file nameCopy Anchor Link

POST /api/v1/panel/check-file-name

Required scope: files:upload

curl "https://api.blazeauth.net/api/v1/panel/check-file-name?applicationId=123456789" \
  -X POST \
  -H "Authorization: Bearer $BLAZEAUTH_MANAGEMENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "fileName": "setup-bin" }'

{
  "success": true,
  "message": "File name available"
}

Get files metadataCopy Anchor Link

GET /api/v1/panel/get-files-metadata

Required scope: files:read

curl "https://api.blazeauth.net/api/v1/panel/get-files-metadata?applicationId=123456789" \
  -H "Authorization: Bearer $BLAZEAUTH_MANAGEMENT_API_KEY"

{
  "success": true,
  "message": "Successfully fetched metadata",
  "data": {
    "totalFiles": 12,
    "lastUploadedAt": "2026-05-12T09:00:00.000Z"
  }
}

Get files tableCopy Anchor Link

GET /api/v1/panel/get-files-table

Required scope: files:read

curl "https://api.blazeauth.net/api/v1/panel/get-files-table?applicationId=123456789&currentPage=1" \
  -H "Authorization: Bearer $BLAZEAUTH_MANAGEMENT_API_KEY"

Optional searchParams is a URL-encoded JSON string:

{
  "searchString": "setup",
  "categories": ["Name"]
}

{
  "success": true,
  "message": "Successfully fetched table",
  "data": [
    {
      "id": "4001",
      "displayName": "setup-bin",
      "byteSize": 1048576,
      "contentType": "application/octet-stream",
      "presignedUrlsCount": 3,
      "lastPresignedUrlCreatedAt": "2026-05-12T10:00:00.000Z",
      "createdAt": "2026-05-12T09:00:00.000Z",
      "user": {
        "username": "owner"
      }
    }
  ],
  "totalPages": 1
}

File actionCopy Anchor Link

POST /api/v1/panel/file-action

Required scope: files:delete

curl "https://api.blazeauth.net/api/v1/panel/file-action?applicationId=123456789" \
  -X POST \
  -H "Authorization: Bearer $BLAZEAUTH_MANAGEMENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "change_file_name",
    "fileId": "4001",
    "fileName": "setup-new"
  }'

{
  "success": true,
  "message": "Action completed successfully."
}