# Rapidfile Upload API

> Hosted file uploads for developers' apps (user uploads, user media) by Enzonic LLC. The developer's server creates an upload with a
> secret key; the end user's browser uploads directly to a signed URL; the file is served from https://cdn.rapidfile.cc. Free tier and fixed monthly plans.

Base URL: https://api.rapidfile.cc/v1 · Docs: https://api.rapidfile.cc/docs · Browser SDK: https://api.rapidfile.cc/sdk.js (ES module, MIT, no deps) · Dashboard (keys, webhooks): https://api.rapidfile.cc/dashboard

## Auth
- Header `Authorization: Bearer rk_live_…` (secret key per app, created in the dashboard, shown once). Server-side only, never in client code.
- Signed upload URLs (returned by POST /v1/uploads) need no key, are valid 1 hour and are safe to give to browsers.
- Errors: HTTP status + JSON `{"error":"code","message":"text"}`. 401 `unauthorized` = bad/missing key. Retry 429/5xx with backoff. CORS is `*`.

## Endpoints
- POST /v1/uploads `{ name, size, type, acl?: "public"|"private", customId?, metadata?: object ≤ 2 KB }`
  - size ≤ 95 MB → `{ file: ApiFile, upload: { method: "PUT", url, expiresAt } }` → PUT raw bytes to url (Content-Length = size) → `{ file }` (status "ready")
  - size > 95 MB → `{ file, upload: { method: "MULTIPART", partSize, partCount, partUrl: ".../{n}", completeUrl, expiresAt } }`
    → PUT part n (1..partCount, each exactly partSize bytes, last = remainder) to partUrl with {n} replaced → `{ etag }`
    → POST completeUrl `{ parts: [{ partNumber, etag }] }` → `{ file }`
- PUT /v1/files?name=&acl= raw body ≤ 95 MB, Content-Type = file type (server-side upload with the key) → `{ file }`
- GET /v1/files?limit=&cursor= → `{ data: ApiFile[], nextCursor }`
- GET /v1/files/:id → `{ file }`
- DELETE /v1/files/:id → `{ deleted: true }`
- POST /v1/files/:id/signed-url `{ expiresIn: seconds ≤ 604800 }` → `{ url, expiresAt }` (for private files)
- GET /v1/usage → `{ plan, storageBytes, storageLimit, requestsToday, requestsLimit, maxFileBytes, apps, appLimit }`

ApiFile: `{ id, appId, name, size, type, status: "uploading"|"ready", acl, url: "https://cdn.rapidfile.cc/<id>/<name>" | null (private), customId, metadata, createdAt (unix ms) }`

## Webhooks
POST JSON `{ type: "file.uploaded"|"file.deleted", data: ApiFile, createdAt }` to the app's webhook URL with header
`Rapidfile-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(webhookSecret, "<t>.<raw body>")>`. Verify over the raw body with a constant-time compare; reject old t.
Webhook secret (`whsec_…`) is shown once when created/rotated in the dashboard.

## Browser SDK
```js
import { uploadFile, uploadFiles } from 'https://api.rapidfile.cc/sdk.js'; // or save a copy for bundlers
const file = await uploadFile(input.files[0], {
  getUpload: '/api/upload', // your server endpoint: receives {name,size,type}, calls POST /v1/uploads, returns its JSON
  onProgress: ({ loaded, total, percent }) => {}, signal, concurrency: 4, retries: 3,
});
// file.url → CDN link. uploadFiles(files, { ...same, parallelFiles: 2, onFileComplete }) → ApiFile[]
```
getUpload may also be a function `(file) => Promise<json of POST /v1/uploads>`. Errors: UploadError { status, code, message }; abort → AbortError.

## Minimal server endpoint (Node / Next.js route handler)
```js
const r = await fetch('https://api.rapidfile.cc/v1/uploads', { method: 'POST',
  headers: { Authorization: `Bearer ${process.env.RAPIDFILE_SECRET_KEY}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ name, size, type, metadata: { userId } }) });
return Response.json(await r.json(), { status: r.status });
```
Validate the user, type and size in this endpoint before calling the API.

## MCP server for AI agents
- Endpoint: https://api.rapidfile.cc/mcp (MCP Streamable HTTP, JSON-RPC 2.0, protocol 2025-06-18). Header `Authorization: Bearer rk_live_…` (an app's secret key; the agent acts on that app's files).
- Claude Code: `claude mcp add --transport http rapidfile-api https://api.rapidfile.cc/mcp --header "Authorization: Bearer rk_live_…"`
- JSON config: `{ "mcpServers": { "rapidfile": { "type": "http", "url": "https://api.rapidfile.cc/mcp", "headers": { "Authorization": "Bearer rk_live_…" } } } }`
- Tools:
  - upload_file { name, content?, contentBase64?, url?, type?, acl?, customId?, metadata? }
  - create_upload_url { name, size, type?, acl?, customId?, metadata? }
  - list_files { limit?, cursor? }
  - get_file { id }
  - delete_file { id }
  - get_signed_url { id, expiresIn? }
  - get_usage {}
  - upload_file: one of content (UTF-8 text), contentBase64 or url (https, ≤ 95 MB, fetched by Rapidfile); returns the ApiFile with its CDN url.
  - create_upload_url: returns signed upload instructions (same upload object as POST /v1/uploads) for a browser or end user.
- Transfers MCP (send a file to a person, no key): https://rapidfile.cc/mcp; optional `Authorization: Bearer rf_cli_…` (from `rapidfile login`) for 2 GB+ transfers.
  - send_file { name, content? | contentBase64? | url?, expires?, downloads?, password? }
  - get_transfer { code or link }
  - read_transfer { code or link, maxBytes? }
  - delete_transfer { id, ownerToken }
  - whoami {}
  - send_file returns a link and a 6-digit code; expires is "1h" | "1d" | "3d" | "7d". read_transfer returns the text of small text files.
- Docs: https://api.rapidfile.cc/docs#mcp

## Plans (USD, yearly = 10 × monthly)
- Free: free; 2 GB storage; 100,000 CDN requests/day; files up to 512 MB; 3 apps
- Starter: $5/month; 100 GB storage; 500,000 CDN requests/day; files up to 4 GB; 10 apps
- Growth: $15/month; 500 GB storage; 2,000,000 CDN requests/day; files up to 16 GB; 50 apps
- Scale: $49/month; 2 TB storage; 10,000,000 CDN requests/day; files up to 50 GB; 200 apps
No bandwidth fees. Pricing: https://api.rapidfile.cc/pricing

## Pages
- https://api.rapidfile.cc/
- https://api.rapidfile.cc/docs
- https://api.rapidfile.cc/pricing
- https://api.rapidfile.cc/file-upload-api
- https://api.rapidfile.cc/image-upload-api
- https://api.rapidfile.cc/nextjs-file-upload
- https://api.rapidfile.cc/s3-alternative-for-user-uploads
- https://api.rapidfile.cc/uploadthing-alternative
- https://api.rapidfile.cc/dmca
- https://api.rapidfile.cc/report

Contact: admin@enzonic.com · Abuse/DMCA: https://api.rapidfile.cc/report · Operator: Enzonic LLC (USA)