# File Upload

Workflows that take source code or files as input—such as whitebox assessment—require uploading the target files to Takumi API beforehand.
To check whether a specific workflow requires file input, refer to the request schema for its dispatch endpoint (`/o/{org_id}/workflows/{workflow_id}/dispatch`) in the [OpenAPI documentation](https://api.cloud.shisho.dev/v1/docs/openapi.json).

This page explains how file upload works and related constraints.

## Upload Flow

Uploading a file is a three-step process:

1. **Get an upload URL**: Call `/o/{org_id}/input-files/get-upload-url` with the file size to obtain a `file_id` and a temporary `upload_url`
2. **Upload the file**: Upload the file to the `upload_url` via HTTP PUT (no `Authorization` header required)
3. **Confirm the upload**: Call `/o/{org_id}/input-files/confirm-upload` to finalize the upload. The file cannot be referenced as workflow input until this step is complete

```bash
# 1. Get an upload URL
curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
  https://api.cloud.shisho.dev/v1/o/$org_id/input-files/get-upload-url \
  --json '{"content_length": 123456}'

# 2. Upload the file
curl -s -X PUT "<upload_url>" --upload-file ./your-project.zip

# 3. Confirm the upload
curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
  https://api.cloud.shisho.dev/v1/o/$org_id/input-files/confirm-upload \
  --json '{"file_id": "TIF..."}'
```

:::tip
If you decide not to complete the upload, call `/o/{org_id}/input-files/cancel-upload` to cancel it. This ensures the cancellation is correctly reflected in your storage usage.
:::

## File Retention Period

Uploaded files are **automatically deleted after a 30-day retention period**. If you need the file beyond this period, upload it again.

## Storage Capacity Limit

There is a storage capacity limit for uploaded files. You can free up space by deleting files you no longer need using the `/o/{org_id}/input-files/delete` endpoint.