create_asset_upload

Upload a local file without base64. Compute SHA-256 and size locally; PUT raw bytes to the returned URL with exactly its headers. No OAuth extraction or finalize call. Keep Authorization private. Recover with get_asset_upload. Over 16 MiB the ticket has parts: PUT each 16 MiB slice to url?part=N, part 1 first. Limits: ZIP/APK/AAB/IPA 1 GiB, video 256 MiB, audio/PDF 64 MiB, other files 16 MiB, raster 8 MiB, text 1 MiB. Details: /docs/mcp/create_asset_upload.

PREFERRED upload route #2 for local/generated files without an accessible HTTPS URL. Compute SHA-256 and byte count locally; example {boardId:'board',sha256:'<64 lowercase hex>',bytes:188054} (quote JSON strings). Returns a five-minute URL, PUT method, required Authorization/Content-Type headers, expiry and limits. Send raw file bytes via HTTP using exactly those headers; no browser cookies, OAuth token extraction, hosting, base64 or finalize call needed. PUT returns the standard immutable asset response. After a lost response call get_asset_upload(boardId,assetId), or repeat identical PUT bytes while valid. An expired authorization can be replaced using the same hash/size; existing content is deduplicated. Authorization is limited to the board and exact hash/size; current board/grant access is rechecked. Limits by type: zip-based packages (APK, AAB, IPA, zip) and MP4/WebM video <=256 MiB, audio and PDF <=64 MiB, other media <=16 MiB, raster <=8 MiB, UTF-8 text <=1 MiB. Files over 16 MiB: the ticket has parts {partBytes,count} and lasts 30 minutes; PUT each slice to url?part=N with the same headers, part 1 first (it is type-checked before anything is stored), e.g. for n in $(seq 1 COUNT); do dd if=FILE bs=16777216 skip=$((n-1)) count=1 2>/dev/null | curl -sS -X PUT -H 'Authorization: …' -H 'Content-Type: application/octet-stream' --data-binary @- 'URL?part='$n; done. Each part answers {status:'pending',received,count}; the last returns the asset after its sha256 is checked. Re-sending a part is safe; a mismatched file is discarded. Keep returned Authorization private. Preferred order: existing URL via upload_asset_from_url, local binary via this tool, base64 upload_asset last. For several local files at once use create_asset_uploads, which authorizes up to 100 in one call.