> ## Documentation Index
> Fetch the complete documentation index at: https://www.dropfans.io/developers/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /api/external/vault — Upload an image, small video or voice message

> Uploads one file into the creator's vault as `multipart/form-data`.

- Source: https://www.dropfans.io/developers/reference/upload-vault-item
- Section: API reference
- OpenAPI: https://www.dropfans.io/developers/openapi.json

Uploads one file into the creator's vault as `multipart/form-data`.

Three kinds, three shapes: **images** need two parts — a pre-compressed `displayFile` and a `thumbnailFile` (both JPEG); **audio** (voice messages) sends one `file` part (≤20MB, ≤60 min); **video** sends one `file` part — but the whole request must stay under ~4MB (a platform body cap rejects bigger requests before the app runs), so for real videos use the three-step TUS flow starting at [POST /api/external/vault/video-upload](https://www.dropfans.io/developers/reference/start-video-upload.md) instead.

Every upload enters the same moderation pipeline as a dashboard upload: images are scored immediately, videos asynchronously, audio goes to human review (or auto-approves for trusted creators). The item only shows up in the default vault list once APPROVED.

## Authentication

`Authorization: Bearer dpfn_...` — an API key generated in the creator's dashboard (Vault → API Connect). One key = one creator. Missing or invalid keys return 401 `{"error":"Unauthorized","code":"unauthorized"}`.

## Request body (multipart/form-data)

| Field | Type | Required | Description |
|---|---|---|---|
| `fileType` | `image` \\| `video` \\| `audio` | yes | What you are uploading. |
| `originalName` | string | yes | The file’s name, stored as fileName. |
| `folderId` | string |  | Optional folder to file the item into. |
| `durationSeconds` | integer |  | Audio only — the voice message length in seconds (capped at 3600). |
| `displayFile` | file |  | Images only (required): the pre-compressed JPEG display copy. |
| `thumbnailFile` | file |  | Images only (required): the JPEG thumbnail. |
| `file` | file |  | Video/audio only (required): the media file. Audio ≤20MB; video effectively ≤~4MB here — use the TUS flow for anything bigger. |

Example — Image upload (display + thumbnail parts):

```json
{
  "fileType": "image",
  "originalName": "beach-set-01.jpg",
  "displayFile": "@photo.jpg",
  "thumbnailFile": "@photo-thumb.jpg"
}
```

Example — Voice message:

```json
{
  "fileType": "audio",
  "originalName": "voice-note.ogg",
  "durationSeconds": 42,
  "file": "@voice-note.ogg"
}
```

## Responses

### 200

Uploaded. The item starts PENDING moderation (not included in this shape — poll the list with includePending=true, or wait for it to appear in the default list).

| Field | Type | Required | Description |
|---|---|---|---|
| `success` | boolean | yes | Always true. |
| `item` | VaultItemUploaded | yes | The new vault item. |

```json
{
  "success": true,
  "item": {
    "id": "clxv1a2b30001item",
    "fileName": "beach-set-01.jpg",
    "filePath": "https://cdn.dropfans.io/valeria/vault/1721990000-ab12cd.jpg",
    "thumbnailPath": "https://cdn.dropfans.io/valeria/thumbnails/1721990000-ab12cd.jpg",
    "fileType": "image",
    "fileSize": 482113,
    "durationSeconds": null,
    "bunnyStreamId": null,
    "createdAt": "2026-08-01T10:15:00.000Z"
  }
}
```

## Errors

| Status | Body | When |
|---|---|---|
| 400 | `{"error":"Missing required fields: fileType and originalName"}` | Either required form field is absent. |
| 400 | `{"error":"Only images, videos and audio are allowed"}` | `fileType` is anything other than image, video or audio. |
| 400 | `{"error":"Missing displayFile or thumbnailFile for image upload"}` | Image upload without both file parts. |
| 400 | `{"error":"Missing video file"}` | fileType=video without a `file` part. |
| 400 | `{"error":"Missing audio file"}` | fileType=audio without a `file` part. |
| 401 | `{"error":"Unauthorized","code":"unauthorized"}` | Missing or invalid API key. |
| 413 | `{"error":"Audio too large"}` | Audio file over 20MB. |
| 500 | `{"error":"Failed to upload file"}` | Storage or moderation kickoff failed — retry later. |

## Notes

The success shape here differs from the video-complete endpoint's item (that one adds `moderationStatus`, `moderationTags` and `aiEnhanced` and omits `durationSeconds`). OPTIONS on this path is an unauthenticated CORS preflight for browser uploads.

## Rate limiting

Per-key fixed windows by tier (Personal 60/min · 5,000/day; approved apps 300/min · 50,000/day; Dropfans-operated integrations exempt). Read the live values from X-RateLimit-Tier, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and their -Day variants; a 429 carries Retry-After and `{"error":"Rate limit exceeded","code":"rate_limited"}`. See [Rate limits](https://www.dropfans.io/developers/concepts/rate-limits.md).

## Code samples

### curl

```bash
curl -X POST "https://www.dropfans.io/api/external/vault" \
  -H "Authorization: Bearer $DROPFANS_API_KEY" \
  -F "fileType=image" \
  -F "originalName=beach-set-01.jpg" \
  -F "displayFile=@photo.jpg" \
  -F "thumbnailFile=@photo-thumb.jpg"
```

### Node

```javascript
import { readFile } from 'node:fs/promises';

const form = new FormData();
form.append('fileType', "image");
form.append('originalName', "beach-set-01.jpg");
form.append('displayFile', new Blob([await readFile('photo.jpg')]), 'photo.jpg');
form.append('thumbnailFile', new Blob([await readFile('photo-thumb.jpg')]), 'photo-thumb.jpg');

const res = await fetch(`https://www.dropfans.io/api/external/vault`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
  },
  body: form,
});
console.log(await res.json());
```

### Python

```python
import os
import requests

res = requests.post(
    "https://www.dropfans.io/api/external/vault",
    headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
    files={
        "displayFile": open("photo.jpg", "rb"),
        "thumbnailFile": open("photo-thumb.jpg", "rb"),
    },
    data={
        "fileType": "image",
        "originalName": "beach-set-01.jpg",
    },
)
print(res.json())
```

## OpenAPI

```json
{
  "method": "POST",
  "path": "/api/external/vault",
  "operationId": "uploadVaultItem",
  "tags": [
    "vault"
  ],
  "summary": "Upload an image, small video or voice message",
  "description": "Uploads one file into the creator's vault as `multipart/form-data`.\n\nThree kinds, three shapes: **images** need two parts — a pre-compressed `displayFile` and a `thumbnailFile` (both JPEG); **audio** (voice messages) sends one `file` part (≤20MB, ≤60 min); **video** sends one `file` part — but the whole request must stay under ~4MB (a platform body cap rejects bigger requests before the app runs), so for real videos use the three-step TUS flow starting at [POST /api/external/vault/video-upload](https://www.dropfans.io/developers/reference/start-video-upload.md) instead.\n\nEvery upload enters the same moderation pipeline as a dashboard upload: images are scored immediately, videos asynchronously, audio goes to human review (or auto-approves for trusted creators). The item only shows up in the default vault list once APPROVED.",
  "requestBody": {
    "required": true,
    "content": {
      "multipart/form-data": {
        "schema": {
          "type": "object",
          "properties": {
            "fileType": {
              "type": "string",
              "description": "What you are uploading.",
              "enum": [
                "image",
                "video",
                "audio"
              ]
            },
            "originalName": {
              "type": "string",
              "description": "The file’s name, stored as fileName.",
              "example": "beach-set-01.jpg"
            },
            "folderId": {
              "type": "string",
              "description": "Optional folder to file the item into."
            },
            "durationSeconds": {
              "type": "integer",
              "description": "Audio only — the voice message length in seconds (capped at 3600).",
              "maximum": 3600
            },
            "displayFile": {
              "type": "string",
              "contentMediaType": "application/octet-stream",
              "description": "Images only (required): the pre-compressed JPEG display copy."
            },
            "thumbnailFile": {
              "type": "string",
              "contentMediaType": "application/octet-stream",
              "description": "Images only (required): the JPEG thumbnail."
            },
            "file": {
              "type": "string",
              "contentMediaType": "application/octet-stream",
              "description": "Video/audio only (required): the media file. Audio ≤20MB; video effectively ≤~4MB here — use the TUS flow for anything bigger."
            }
          },
          "required": [
            "fileType",
            "originalName"
          ]
        },
        "examples": {
          "image": {
            "summary": "Image upload (display + thumbnail parts)",
            "value": {
              "fileType": "image",
              "originalName": "beach-set-01.jpg",
              "displayFile": "@photo.jpg",
              "thumbnailFile": "@photo-thumb.jpg"
            }
          },
          "audio": {
            "summary": "Voice message",
            "value": {
              "fileType": "audio",
              "originalName": "voice-note.ogg",
              "durationSeconds": 42,
              "file": "@voice-note.ogg"
            }
          }
        }
      }
    }
  },
  "responses": {
    "200": {
      "description": "Uploaded. The item starts PENDING moderation (not included in this shape — poll the list with includePending=true, or wait for it to appear in the default list).",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "success": {
                "type": "boolean",
                "description": "Always true.",
                "example": true
              },
              "item": {
                "type": "object",
                "properties": {
                  "id": {
                    "type": "string",
                    "description": "The new vault item id.",
                    "example": "clxv1a2b30001item"
                  },
                  "fileName": {
                    "type": "string",
                    "description": "The `originalName` you sent.",
                    "example": "beach-set-01.jpg"
                  },
                  "filePath": {
                    "type": "string",
                    "description": "CDN URL of the stored display asset (images/audio) or the Stream playback URL (videos)."
                  },
                  "thumbnailPath": {
                    "type": [
                      "string",
                      "null"
                    ],
                    "description": "Thumbnail URL. Null for audio."
                  },
                  "fileType": {
                    "type": "string",
                    "description": "Media kind, echoing the request.",
                    "enum": [
                      "image",
                      "video",
                      "audio"
                    ]
                  },
                  "fileSize": {
                    "type": [
                      "integer",
                      "null"
                    ],
                    "description": "Stored size in bytes.",
                    "example": 482113
                  },
                  "durationSeconds": {
                    "type": [
                      "integer",
                      "null"
                    ],
                    "description": "Voice-message length in seconds (audio only, when you sent it). Null otherwise."
                  },
                  "bunnyStreamId": {
                    "type": [
                      "string",
                      "null"
                    ],
                    "description": "Bunny Stream GUID (video uploads only)."
                  },
                  "createdAt": {
                    "type": "string",
                    "description": "Creation time.",
                    "format": "date-time"
                  }
                },
                "required": [
                  "id",
                  "fileName",
                  "filePath",
                  "fileType",
                  "createdAt"
                ]
              }
            },
            "required": [
              "success",
              "item"
            ]
          },
          "example": {
            "success": true,
            "item": {
              "id": "clxv1a2b30001item",
              "fileName": "beach-set-01.jpg",
              "filePath": "https://cdn.dropfans.io/valeria/vault/1721990000-ab12cd.jpg",
              "thumbnailPath": "https://cdn.dropfans.io/valeria/thumbnails/1721990000-ab12cd.jpg",
              "fileType": "image",
              "fileSize": 482113,
              "durationSeconds": null,
              "bunnyStreamId": null,
              "createdAt": "2026-08-01T10:15:00.000Z"
            }
          }
        }
      }
    },
    "400": {
      "description": "Either required form field is absent. Also: `fileType` is anything other than image, video or audio. Also: Image upload without both file parts. Also: fileType=video without a `file` part. Also: fileType=audio without a `file` part.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message describing what went wrong.",
                "example": "Vault item not found"
              }
            },
            "required": [
              "error"
            ]
          },
          "example": {
            "error": "Missing required fields: fileType and originalName"
          }
        }
      }
    },
    "401": {
      "description": "Missing or invalid API key.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Unauthorized",
            "code": "unauthorized"
          }
        }
      }
    },
    "403": {
      "description": "The app this key belongs to has been suspended by Dropfans. Every request fails with this until the app is reinstated — surface it to the creator and contact Dropfans.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "This integration has been suspended by Dropfans. Contact the app developer.",
            "code": "app_suspended"
          }
        }
      }
    },
    "413": {
      "description": "Audio file over 20MB.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message describing what went wrong.",
                "example": "Vault item not found"
              }
            },
            "required": [
              "error"
            ]
          },
          "example": {
            "error": "Audio too large"
          }
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded for the current minute or day window. Wait Retry-After seconds and retry.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "Retry-After": {
          "description": "Seconds to wait before retrying (sent with 429s).",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Rate limit exceeded",
            "code": "rate_limited"
          }
        }
      }
    },
    "500": {
      "description": "Storage or moderation kickoff failed — retry later.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message describing what went wrong.",
                "example": "Vault item not found"
              }
            },
            "required": [
              "error"
            ]
          },
          "example": {
            "error": "Failed to upload file"
          }
        }
      }
    }
  },
  "x-codeSamples": [
    {
      "lang": "cURL",
      "label": "curl",
      "source": "curl -X POST \"https://www.dropfans.io/api/external/vault\" \\\n  -H \"Authorization: Bearer $DROPFANS_API_KEY\" \\\n  -F \"fileType=image\" \\\n  -F \"originalName=beach-set-01.jpg\" \\\n  -F \"displayFile=@photo.jpg\" \\\n  -F \"thumbnailFile=@photo-thumb.jpg\""
    },
    {
      "lang": "JavaScript",
      "label": "Node",
      "source": "import { readFile } from 'node:fs/promises';\n\nconst form = new FormData();\nform.append('fileType', \"image\");\nform.append('originalName', \"beach-set-01.jpg\");\nform.append('displayFile', new Blob([await readFile('photo.jpg')]), 'photo.jpg');\nform.append('thumbnailFile', new Blob([await readFile('photo-thumb.jpg')]), 'photo-thumb.jpg');\n\nconst res = await fetch(`https://www.dropfans.io/api/external/vault`, {\n  method: 'POST',\n  headers: {\n    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,\n  },\n  body: form,\n});\nconsole.log(await res.json());"
    },
    {
      "lang": "Python",
      "source": "import os\nimport requests\n\nres = requests.post(\n    \"https://www.dropfans.io/api/external/vault\",\n    headers={\"Authorization\": f\"Bearer {os.environ['DROPFANS_API_KEY']}\"},\n    files={\n        \"displayFile\": open(\"photo.jpg\", \"rb\"),\n        \"thumbnailFile\": open(\"photo-thumb.jpg\", \"rb\"),\n    },\n    data={\n        \"fileType\": \"image\",\n        \"originalName\": \"beach-set-01.jpg\",\n    },\n)\nprint(res.json())"
    }
  ],
  "x-dropfans-docs": "https://www.dropfans.io/developers/reference/upload-vault-item"
}
```

---

Previous: [List your vault items — the source of media for posts](https://www.dropfans.io/developers/reference/list-vault.md) · Next: [Delete (hide) a vault item](https://www.dropfans.io/developers/reference/delete-vault-item.md) · All pages: [llms.txt](https://www.dropfans.io/developers/llms.txt)