Prepare image upload
Source-generated prepare_image_upload arguments, output schema, OAuth scope, and safety annotations for the reviewed MCP contract.
On this page
Tool
prepare_image_upload
Create a short-lived direct upload. PUT exactly byte_size bytes using the returned URL and headers, then call complete_image_upload.
Permissions and safety
OAuth scope: files:write
| Signal | Value |
|---|---|
destructiveHint |
false |
idempotentHint |
false |
openWorldHint |
true |
readOnlyHint |
false |
| spendsCredits | false |
| requiresUserConfirmation | false |
| sideEffects | temporary_upload_created |
Annotations describe safety properties; they do not replace consent, OAuth authorization, or server checks.
Input arguments
| Field | Type | Required | Default | Constraints | Meaning |
|---|---|---|---|---|---|
byte_size |
integer |
Yes | — | exclusiveMinimum: 0 |
Exact number of bytes the client will PUT. |
filename |
string |
Yes | — | minLength: 1; maxLength: 240 |
Client filename, not a local path the server can read. |
mime_type |
string |
Yes | — | pattern: ^image/(png|jpeg|webp)$ |
Actual image MIME type. |
Argument example
{
"byte_size": 1024,
"filename": "character.png",
"mime_type": "image/png"
}
Structured result
| Field | Type | Required | Default | Constraints | Meaning |
|---|---|---|---|---|---|
expires_at |
string |
Yes | — | format: date-time |
Upload URL expiry. |
headers |
object |
Yes | — | — | Exact transfer headers; do not add MCP tokens or API Bearer credentials. |
max_bytes |
integer |
Yes | — | — | Maximum accepted upload byte count. |
method |
string |
No | "PUT" |
const: "PUT" |
HTTP method the client must use for the byte transfer. |
upload_id |
string |
Yes | — | format: uuid |
Upload session ID for complete_image_upload, not the final file_id. |
upload_url |
string |
Yes | — | — | Sensitive short-lived upload URL. Transfer actual bytes; do not publish this URL. |
Errors and next steps
Tool errors contain an error object with code, message, retryable, request_id, and details. Do not parse message text or leak private inputs. Inspect partial outputs after a terminal failure; a signed URL is not a saved file.
Was this page helpful?
No search queries, code, or free text are collected. This switch controls documentation interactions only; general site analytics follow the privacy policy. Privacy policy