---
title: "Refresh a media-library upload instruction"
canonical: "https://bird.com/docs/api/reference/create-asset-upload-instruction"
---

# Refresh a media-library upload instruction

`POST /v1/asset-upload-sessions/{upload_id}/prepare`

Refreshes the temporary upload instruction for a pending session. File properties and the one-hour session deadline remain unchanged. No replacement file or metadata is accepted.

## Servers

- `https://{region}.platform.bird.com`: Regional API endpoint. Use the host for the region your organization is hosted in. Official Bird SDKs and the CLI select it automatically from your API key, so you rarely need to set it by hand.
  - `region`: `us1`, `eu1`. Default: `us1`. The region your organization's data is hosted in.
- `https://platform.bird.com`: Region-independent endpoint for authentication and account administration.
- `http://localhost:8080`: Local development.

## Authentication

Use one authentication option:

- `BearerAuth`: HTTP bearer authentication. Pass the API key as a bearer token in the `Authorization` header. Workspace
keys use `bk_{region}_*`; organization master keys use `bm_{region}_*`.
The prefix identifies the region and selects the
API endpoint. Official Bird SDKs and the CLI derive the region from the key.

## Code samples

**TypeScript**

```ts
const upload = await bird.assets.uploads.prepare("aus_01krdgeqcxet5s7t44vh8rt9mg");
console.log(upload.state);
```

Examples: [TypeScript](/docs/api/reference/create-asset-upload-instruction.ts.md) · [Python](/docs/api/reference/create-asset-upload-instruction.py.md) · [Go](/docs/api/reference/create-asset-upload-instruction.go.md) · [PHP](/docs/api/reference/create-asset-upload-instruction.php.md) · [CLI](/docs/api/reference/create-asset-upload-instruction.cli.md) · [MCP](/docs/api/reference/create-asset-upload-instruction.mcp.md) · [cURL](/docs/api/reference/create-asset-upload-instruction.curl.md)

## Example response `200`

```json
{
  "id": "aus_01krdgeqcxet5s7t44vh8rt9mg",
  "state": "pending",
  "folder_id": "asf_01krdgeqcxet5s7t44vh8rt9mg",
  "file": {
    "filename": "invoice.pdf",
    "content_type": "application/pdf",
    "size_bytes": 1024,
    "sha256": "4e2090a479f7ce6b17ad31f991988f12571bcafbd4a441cc4063644fc1400ae0"
  },
  "result": {
    "asset_id": "ast_01krdgeqcxet5s7t44vh8rt9mg"
  },
  "next": [
    {
      "kind": "operation"
    }
  ]
}
```

## Path parameters

- `upload_id` (string, required): ID of the media-library upload session.

## Header parameters

- `Idempotency-Key` (string, optional)

  Client-supplied key. On operations supporting request deduplication, a retained
  response is replayed for duplicate requests with the same key within the
  idempotency window (3 hours by default). This protection requires a workspace,
  organization, or staff-account scope. User-only and unscoped unauthenticated operations,
  streams, and operations with a separate replay contract do not use this
  response replay.

  On a supported operation, if idempotency protection is unavailable before execution, the API returns
  `503 IdempotencyUnavailable` (E01033) without executing this attempt. Retry with
  backoff using the same key and request. An operation that takes effect before
  its response is retained can still execute again on retry.

  Two distinct 409 errors signal misuse:

  - `request_in_progress` (E01004): The same key is currently being
    processed by a concurrent request. Wait briefly and retry. The lock expires within 30 seconds.
  - `idempotency_key_reuse` (E01005): The same key has already completed
    against a different request body or method. Generate a new key.

  Recommended key format is `<event-type>/<entity-id>` (for example `welcome-user/usr_abc123`).
- `X-Workspace-Id` (string, optional): Workspace context for the request. Required for dashboard authentication and master keys. Workspace keys and access tokens already identify their workspace; send that workspace or omit the header. A different one is rejected.
- `X-Organization-Id` (string, optional): Organization context for the request. Required for dashboard authentication. An API key or access token carries its own organization, so send either that organization or no header at all; a different one is rejected.

## Response body

- `id` (string, required)
- `state` (string, required)

  The session is awaiting transfer and completion.

  Value: `pending`
- `expires_at` (string, required): Absolute session expiry. Completion must finish before this deadline; starting it or refreshing an upload instruction does not extend it.
- `name` (string, required): Frozen display name for a newly published asset.
- `alt_text` (nullable string, required): Frozen alternative text, or null when omitted.
- `folder_id` (nullable string, required): Frozen destination folder, or null for the library root.
- `file` (object, required): Exact properties of the original file. Calculate size and SHA-256 from its bytes before creating a session. Images allow up to 5,242,880 bytes; other supported media allow up to 25,000,000 bytes.
- `file.filename` (string, required): Original filename, including its extension.
- `file.content_type` (string, required)

  Media type of the original file. Supported values are `image/png`, `image/jpeg`, `image/gif`, `video/mp4`, `video/webm`, `video/quicktime`, `audio/mpeg`, `audio/mp4`, `audio/ogg`, `audio/wav`, and `application/pdf`.

  Supply the exact value without parameters. Unsupported values return `E20001`. Completion checks this against the file's contents.
- `file.size_bytes` (integer, required): Exact size of the original file in bytes.
- `file.sha256` (string, required): SHA-256 of the original bytes, encoded as lowercase hexadecimal.
- `result` (nullable object, required): Saved publication receipt, or null until completed.
- `result.asset_id` (string, required)
- `result.reused_existing` (boolean, required): Whether the upload reused an existing active asset with identical source bytes. Reused assets keep their original metadata and folder.
- `result.completed_at` (string, required): When publication completed.
- `last_error` (nullable object, required): Last completion error, or null when no failure is recorded.
- `last_error.code` (string, required): Bird error code for the failed attempt.
- `next` (array of object, required): Available next steps for this session.
- `next.kind` (string, required)

  What you do about this step.

  - `operation`: call the operation named in `operation`, then
    read again.
  - `external`: act somewhere this API does not reach, then read
    again.
  - `wait`: nothing is asked of you, so read again later.
  - `terminal`: nothing you do resolves this, so stop retrying.

  Tolerate a value you do not recognize: show the `description` and
  offer no action.

  Possible values (may grow over time): `operation`, `external`, `wait`, `terminal`
- `next.description` (string, required): A short, human-readable label for the step, suitable for display.
- `next.operation` (string): The operationId to call. Present only when `kind` is `operation`. The operation's own schema says how to call it; this says only which one, and what to address it with.
- `next.params` (object): The parameters that address the operation, by name: `{"sender_id": "…"}` for an operation on `/v1/sms/senders/{sender_id}/requirements`. A parameter the operation takes in its query string is given the same way, so an operation addressed as `?subject_id=` carries `{"subject_id": "…"}`. Every parameter the call needs is here, whether its value came from the thing you were acting on or is fixed for this step, so you can make the call from this object alone. Present only when `kind` is `operation` and the operation names a subject. A request body, when the operation takes one, is described by the operation's own schema and never appears here.
- `next.url` (string): A URL to open. Present only when `kind` is `external`, and only when the step has one. An external step whose `description` says to go and do something with no URL to open is normal.
- `upload` (object, required): Send the original file bytes to this URL with the exact headers and content length. Send no Bird credentials or cookies. Keep the URL private and call complete after the PUT succeeds.
- `upload.method` (string, required)

  HTTP method for transferring the file.

  Value: `PUT`
- `upload.url` (string, required): Temporary HTTPS upload URL. It can be reused for the same fixed file until expiry.
- `upload.required_headers` (object, required): Headers the upload request must send exactly as provided.
- `upload.content_length` (integer, required): Required HTTP content length in bytes.
- `upload.expires_at` (string, required): Upload instruction expiry, bounded by the session and signing credentials.

## Related resources

- [Should I use a Bird SDK or call the API directly?](/explained/platform/should-i-use-an-sdk-or-call-the-api-directly) (answer)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first email](/docs/get-started/send-your-first-email) (docs)

[Get an implementation brief](/learn/workspace?topic=api-basics)