Intake Upload Links

Generate, list, and revoke shareable upload links for non-technical customers.

Intake upload links let operators create shareable URLs that grant drag-and-drop file upload access to non-technical customers. The link token is the authentication - no API key is exposed to the customer.

Upload links are one of three ways files enter the intake catalog, alongside direct uploads and automatic discovery from connected intake sources.

Endpoints

Method

Path

Description

POST

/v1/{workspace_id}/intake/links

Create an upload link

GET

/v1/{workspace_id}/intake/links

List upload links

DELETE

/v1/{workspace_id}/intake/links/{link_id}

Revoke an upload link

GET

/v1/{workspace_id}/intake/links/{link_id}/uploads

List uploads for a link

Create Upload Link

Generates a new shareable upload link for a customer.

Generate upload link

post

Create a shareable upload link for a customer.

Authorizations

AuthorizationstringRequired

API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.

Path parameters

workspace_idstring · uuidRequired

Body

customer_slugstring · min: 2 · max: 63RequiredPattern: ^[a-z0-9][a-z0-9-]*[a-z0-9]$

display_namestring · max: 2000 · nullableOptional

expires_in_hoursinteger · min: 1 · max: 720OptionalDefault: 168

max_uploadsinteger · min: 1 · max: 10000OptionalDefault: 100

Responses

201

Successful Response

application/json

idstring · uuidRequired

workspace_idstring · uuidRequired

customer_slugstring · min: 2 · max: 63RequiredPattern: ^[a-z0-9][a-z0-9-]*[a-z0-9]$

display_namestring · min: 1 · max: 256 · nullableRequired

upload_urlstring · max: 512Required

link_tokenstring · min: 32 · max: 128Required

statusstring · enumRequiredPossible values:

created_atstring · date-timeRequired

expires_atstring · date-timeRequired

revoked_atstring · date-time · nullableRequired

max_uploadsintegerRequired

upload_countintegerRequired

last_upload_atstring · date-time · nullableRequired

422

Validation Error

application/json

post/v1/{workspace_id}/intake/links

POST /v1/{workspace_id}/intake/links HTTP/1.1
Host: api.platform.amigo.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 87

{
  "customer_slug": "text",
  "display_name": "text",
  "expires_in_hours": 168,
  "max_uploads": 100
}

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "workspace_id": "123e4567-e89b-12d3-a456-426614174000",
  "customer_slug": "text",
  "display_name": "text",
  "upload_url": "text",
  "link_token": "text",
  "status": "active",
  "created_at": "2026-07-10T23:33:08.242Z",
  "expires_at": "2026-07-10T23:33:08.242Z",
  "revoked_at": "2026-07-10T23:33:08.242Z",
  "max_uploads": 1,
  "upload_count": 1,
  "last_upload_at": "2026-07-10T23:33:08.242Z"
}

Example

curl -X POST https://api.platform.amigo.ai/v1/{workspace_id}/intake/links \
  -H "Authorization: Bearer {api_key}" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_slug": "acme-health",
    "display_name": "Acme Health Systems",
    "expires_in_hours": 72,
    "max_uploads": 50
  }'

List Upload Links

Returns upload links for the workspace. By default, only active links are returned. Set include_expired to also include expired, revoked, and exhausted links.

List upload links

get

Authorizations

AuthorizationstringRequired

API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.

Path parameters

workspace_idstring · uuidRequired

Query parameters

include_expiredbooleanOptionalDefault: false

limitinteger · min: 1 · max: 500OptionalDefault: 100

offsetintegerOptionalDefault: 0

Responses

200

Successful Response

application/json

idstring · uuidRequired

workspace_idstring · uuidRequired

customer_slugstring · min: 2 · max: 63RequiredPattern: ^[a-z0-9][a-z0-9-]*[a-z0-9]$

display_namestring · min: 1 · max: 256 · nullableRequired

upload_urlstring · max: 512Required

link_tokenstring · min: 32 · max: 128Required

statusstring · enumRequiredPossible values:

created_atstring · date-timeRequired

expires_atstring · date-timeRequired

revoked_atstring · date-time · nullableRequired

max_uploadsintegerRequired

upload_countintegerRequired

last_upload_atstring · date-time · nullableRequired

422

Validation Error

application/json

get/v1/{workspace_id}/intake/links

GET /v1/{workspace_id}/intake/links HTTP/1.1
Host: api.platform.amigo.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "workspace_id": "123e4567-e89b-12d3-a456-426614174000",
    "customer_slug": "text",
    "display_name": "text",
    "upload_url": "text",
    "link_token": "text",
    "status": "active",
    "created_at": "2026-07-10T23:33:08.242Z",
    "expires_at": "2026-07-10T23:33:08.242Z",
    "revoked_at": "2026-07-10T23:33:08.242Z",
    "max_uploads": 1,
    "upload_count": 1,
    "last_upload_at": "2026-07-10T23:33:08.242Z"
  }
]

Revoke Upload Link

Revokes an active upload link. Customers who try to use a revoked link will see an error page. Returns 404 if the link does not exist or is already revoked.

Revoke upload link

delete

Authorizations

AuthorizationstringRequired

API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.

Path parameters

workspace_idstring · uuidRequired

link_idstring · uuidRequired

Responses

204

Successful Response

No content

422

Validation Error

application/json

delete/v1/{workspace_id}/intake/links/{link_id}

DELETE /v1/{workspace_id}/intake/links/{link_id} HTTP/1.1
Host: api.platform.amigo.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

List Uploads for a Link

Returns files uploaded through a specific link.

List uploads for a link

get

Authorizations

AuthorizationstringRequired

API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.

Path parameters

workspace_idstring · uuidRequired

link_idstring · uuidRequired

Query parameters

limitinteger · min: 1 · max: 500OptionalDefault: 200

offsetintegerOptionalDefault: 0

Responses

200

Successful Response

application/json

idstring · uuidRequired

customer_slugstring · min: 2 · max: 63RequiredPattern: ^[a-z0-9][a-z0-9-]*[a-z0-9]$

filenamestring · min: 1 · max: 256Required

content_typestring · max: 256Required

sha256string · min: 64 · max: 64Required

size_bytesintegerRequired

received_atstring · date-timeRequired

scan_statusstring · enumRequiredPossible values:

422

Validation Error

application/json

get/v1/{workspace_id}/intake/links/{link_id}/uploads

GET /v1/{workspace_id}/intake/links/{link_id}/uploads HTTP/1.1
Host: api.platform.amigo.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "customer_slug": "text",
    "filename": "text",
    "content_type": "text",
    "sha256": "text",
    "size_bytes": 1,
    "received_at": "2026-07-10T23:33:08.242Z",
    "scan_status": "skipped"
  }
]

Download an Upload

Returns the raw file bytes with a Content-Disposition: attachment header. The download is scoped through the intake link - only uploads visible on the corresponding upload listing can be downloaded. If the upload or the underlying file no longer exists, the endpoint returns 404.

Downloads are logged as PHI access events in the audit trail. The response includes Cache-Control: private, no-store and X-Content-Type-Options: nosniff headers.

Download an uploaded file

get

Proxy the raw file bytes from the UC Volume back to the caller.

Authorizations

AuthorizationstringRequired

API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.

Path parameters

workspace_idstring · uuidRequired

link_idstring · uuidRequired

upload_idstring · uuidRequired

Responses

200

File bytes with Content-Disposition: attachment

application/octet-stream

string · binaryOptional

404

Link, upload, or file not found

422

Validation Error

application/json

502

UC Volume storage backend unavailable

get/v1/{workspace_id}/intake/links/{link_id}/uploads/{upload_id}/download

GET /v1/{workspace_id}/intake/links/{link_id}/uploads/{upload_id}/download HTTP/1.1
Host: api.platform.amigo.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

binary

Public Upload Page

The upload page is served at the upload_url returned when creating a link. This page is publicly accessible (no authentication required) and provides:

Drag-and-drop file upload
Click-to-browse file selection
Upload progress indicators
Client-side file type and size validation

Upload Endpoint

This endpoint is called by the upload page. It accepts the file as the raw request body with metadata in headers (the original filename in x-amigo-intake-filename and the MIME type in x-amigo-intake-content-type).

Receive Upload

post

Authorizations

AuthorizationstringRequired

API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.

Path parameters

link_tokenstring · max: 64Required

Header parameters

x-amigo-intake-filenamestring · max: 256Required

x-amigo-intake-content-typestring · max: 128Required

Responses

201

File uploaded successfully

application/json

Receipt for a successful upload via an intake link.

idstring · max: 64Required

UUID of the newly created upload row.

filenamestring · max: 256Required

Stored filename.

sha256string · max: 128Required

SHA-256 of the uploaded bytes (lowercase hex).

size_bytesintegerRequired

Stored size in bytes.

scan_statusstring · max: 32Required

Virus-scan status (e.g. clean, skipped).

404

Link not found

410

Link expired

413

File too large

422

Invalid filename or content type

429

Rate limited or upload limit reached

post/upload/{link_token}/files

POST /upload/{link_token}/files HTTP/1.1
Host: api.platform.amigo.ai
Authorization: Bearer YOUR_SECRET_TOKEN
x-amigo-intake-filename: text
x-amigo-intake-content-type: text
Accept: */*

{
  "id": "text",
  "filename": "text",
  "sha256": "text",
  "size_bytes": 1,
  "scan_status": "text",
  "duplicate_of": {
    "id": "text",
    "received_at": "text"
  }
}

Supported File Types

application/pdf
text/csv
text/markdown
image/jpeg
image/png
application/msword
application/vnd.openxmlformats-officedocument.wordprocessingml.document
application/vnd.ms-powerpoint
application/vnd.openxmlformats-officedocument.presentationml.presentation

Maximum file size: 100 MB. Files are validated against their declared content type using magic byte detection - if the file content does not match the declared type, the upload is rejected with a 422.

Response (201 Created)

{
  "id": "uuid",
  "filename": "report.pdf",
  "sha256": "abcdef...",
  "size_bytes": 1048576,
  "scan_status": "skipped",
  "duplicate_of": null
}

When an uploaded file has the same content hash as a previously uploaded file in the same workspace, duplicate_of contains an object with the original upload's id and received_at. The duplicate file is still accepted and stored - this is informational only.

Link Status Values

Status

Description

active

Link is valid and accepting uploads

expired

The expiration time has passed

revoked

An operator revoked the link

exhausted

The maximum upload count has been reached

PreviousIntake Sources NextConnector Runner

Last updated 19 hours ago

Was this helpful?