# Upload a file to a vendor

```http
POST https://secure.yoprint.com/v1/api/store/{team_slug}/vendor/{hash_id}/media
```

- API version: v1
- Operation ID: `v1_public_vendor_media_store`
- Section: Purchasing › [Vendor files](https://developer.yoprint.com/reference/vendor-files.md)
- Web page: https://developer.yoprint.com/reference/vendor-files/v1-vendor-media-store/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Uploads one file to the vendor and returns it. Send `multipart/form-data`, not JSON: the file goes in the `media` part.

## Permission

Any member of the team.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The vendor's id (`id` from List vendors). A hash id from an earlier answer; unique keys and document numbers (such as `PO0042`) don't work here. Example `EDhVUaC6jbLbed`.

## Request body

Content type `multipart/form-data`, required.

Fields:

- `media` (string (binary), required): The file.
- `collection` (string, optional): Where the file goes. `mockup` takes images a preview can be made of (PNG, JPG, GIF, TIFF, BMP, WebP, SVG, HEIC, AVIF; at most 120 megapixels). One of: `"default"`, `"mockup"`, `"production_file"`. Default `"default"`.

### Example request

```bash
curl -X POST 'https://secure.yoprint.com/v1/api/store/your-team/vendor/EDhVUaC6jbLbed/media' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "media": "string"
  }'
```

This example is built from the field types: replace each value with a real one.

## Response

`200` Successful response.

Fields:

- `data` (object, required)
  - `collection` (string, required): Customer files: `tax_exemption`, `internal_file` or `external_file`. Vendor files: `default`, `mockup` or `production_file`.
  - `created_at` (string (date-time), required)
  - `file_name` (string, required)
  - `id` (string, required)
  - `mime_type` (string | null, required)
  - `name` (string | null, required): The display name.
  - `size` (integer, required): Bytes.
  - `custom_properties` (object | array, optional)
  - `customer_id` (string, optional): Customer files only.
  - `dimensions` (object | null, optional): Pixel size of an image, read from its header; null for other files and for images uploaded before the size was recorded.
    - `height` (integer, optional)
    - `width` (integer, optional)
  - `is_image` (boolean, optional)
  - `position` (integer | null, optional): Where the file sorts.
  - `preview` (object | null, optional): Preview image links `small`, `medium` and `large` (250, 800 and 1200 px), or null when there is no preview.
  - `preview_state` (string, optional): `ready`: the preview links work. `processing`: an image over 10 MB whose stored preview a worker is still making (seconds); read the file again, or in the web app wait for `media.preview_state_changed` on the team channel. `too_large`: an image over 120 megapixels; it never gets a preview. `failed`: the worker gave up. `none`: not an image. One of: `"ready"`, `"processing"`, `"too_large"`, `"failed"`, `"none"`.
  - `show_in_pdf` (boolean | null, optional)
  - `source_media_id` (string | null, optional)
  - `url` (string | null, optional): Where to download the file.
  - `view_url` (string | null, optional): A signed link to view the file. It expires: read it fresh, and don't store it.
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": {
    "collection": "default",
    "created_at": "2026-11-01T09:00:00+00:00",
    "custom_properties": [],
    "file_name": "price-list.pdf",
    "id": "YMlcxHYran1mzL",
    "is_image": false,
    "mime_type": "application/pdf",
    "name": "Price list 2026",
    "position": 0,
    "preview": null,
    "show_in_pdf": null,
    "size": 48211,
    "source_media_id": null,
    "url": "https://example.com/media/YMlcxHYran1mzL/download",
    "view_url": "https://example.com/media/YMlcxHYran1mzL/view"
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
  - When: No live vendor with this id. `error.code` is null and `error.message` names the record type. Fix: Check the id.
- `422` Validation failed, or the image was refused by the media rules: a mockup that is not an image a preview can be made of (`mockup_type_not_allowed`), or an image over a size limit (`image_not_allowed`), or a file that is a web page, a script or a program (`validation_failed` on `media`, or `upload_not_allowed`: "This type of file cannot be uploaded."); `error.message` is one sentence naming the limit.
  - When: `media` is missing or not a file, or `collection` is not allowed. `error.code` is `validation_failed`. Fix: Send the file as multipart form data.
  - When: The file is a web page, a script or a program, judged by its extension and by its detected type (for example .html, .js, .php, .py, .sh, .exe, .bat, .jar, .apk, .app, .dmg). `error.fields.media` says "This type of file cannot be uploaded." (`validation_failed`). Fix: Put the file in a .zip, or send a different file type.
  - When: A `mockup` is not an image a preview can be made of (`error.code` `mockup_type_not_allowed`), or an image is over 120 megapixels (`error.code` `image_not_allowed`). Fix: Send it as a production file, or a smaller image.

## Related

- [List a vendor's files](https://developer.yoprint.com/reference/vendor-files/v1-vendor-media-index.md): `GET /v1/api/store/{team_slug}/vendor/{hash_id}/media`
- [Rename, reorder or delete vendor files](https://developer.yoprint.com/reference/vendor-files/v1-vendor-media-sync.md): `POST /v1/api/store/{team_slug}/vendor/{hash_id}/media/{media_reference}`