Reonic

Reonic Upload API

Two-step uploads for endpoints that accept user-provided file content. Call `POST /uploads/create` to obtain an `uploadUrl` and an `uploadId`. `PUT` the raw file body to `uploadUrl` within 1 hour, with a `Content-Type` header matching the file — not `multipart/form-data`. Then reference the `uploadId` from a registration endpoint such as those in [**Files**](#tag/files) or [**Photogrammetry**](#tag/photogrammetry) to attach the file to a resource. Prefer this flow over a registration endpoint's `url` shortcut when the file isn't already hosted at a public URL, or when you'd rather not expose it on the internet.

GitHub OpenAPI

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/reonic/refs/heads/main/openapi/reonic-upload-api-openapi.yml

OpenAPI Specification

reonic-upload-api-openapi.yml Raw ↑ 
openapi: 3.1.0
info:
  title: Reonic REST Api v3 Activities Upload API
  description: 'The Reonic REST API v3 provides programmatic access to create and manage resources. The API follows REST principles and returns responses in JSON format. Authentication is required via an API key passed in the X-Authorization header.


    ## Errors


    All endpoints return errors with the same JSON shape:


    ```json

    { "message": "human-readable description" }

    ```


    `400` responses additionally include an `errors` field with per-field validation details.


    The HTTP status code identifies the cause:


    | Status  | Meaning | When |

    |--------|---------|------|

    | `400` | Bad Request | Path params, query string, or request body failed validation. Inspect `errors` for the field-level breakdown. |

    | `401` | Unauthorized | The `X-Authorization` header is missing, malformed, does not match an active API key, or belongs to a different API version. The response never indicates which check failed; check that the key matches the endpoint version. API v3 endpoints require a v3 key with the `rnc_v3_` prefix. |

    | `403` | Forbidden | The API key is read-only and the request targeted a write endpoint (`POST`). Issue a key with write access. |

    | `404` | Not Found | A resource referenced by a path id does not exist or is not visible to your workspace. |

    | `429` | Too Many Requests | The per-client rate limit was exceeded. See **Rate limiting** below. |

    | `500` | Internal Server Error | Unexpected failure. Safe to retry once; if it persists, contact support. |

    | `503` | Service Unavailable | A backing dependency is temporarily unavailable. Retry with exponential backoff. |


    ## Rate limiting


    Limits are shared across all API keys you hold and reset on a 1-minute window. Two buckets:


    | Bucket | Limit | Applies to |

    |--------|-------|------------|

    | `cached` | 500 / min | `GET` requests served from the response cache |

    | `uncached` | 30 / min | Cache misses, `GET` requests sent with `Reonic-Cache-Control: no-cache`, and all `POST` requests |


    Every response includes:


    - `X-RateLimit-Bucket` — `cached` or `uncached`

    - `X-RateLimit-Limit` — the bucket''s ceiling (`500` or `30`)

    - `X-RateLimit-Remaining` — calls left in the current window

    - `X-RateLimit-Reset` — Unix epoch seconds at which the window resets

    - `X-RateLimit-Policy` — `<limit>;w=60`


    `429` responses additionally set `Retry-After` (in seconds). Wait at least that long before retrying.


    ## Caching and Reonic-Cache-Control


    `GET` responses are cached for up to 1 hour. Identical requests (same path and query) on the same API key return the cached result. To force a fresh read, send `Reonic-Cache-Control: no-cache`; the response is then refreshed and re-cached. Forced refreshes count against the `uncached` rate-limit bucket.


    The standard `Cache-Control` header is not honored. Use `Reonic-Cache-Control` to control caching behavior.


    ## Authentication


    Every request must include your API key in the `X-Authorization` header:


    ```

    X-Authorization: <your-api-key>

    ```


    API keys are issued from the Reonic web app and look like `rnc_v3_…`. Send the full value, including the prefix.

    '
  version: 3.2.0
  contact:
    email: kontakt@reonic.de
    url: https://reonic.com
    name: Reonic GmbH
servers:
- url: '{apiBaseUrl}/rest/v3/'
security:
- X-Authorization: []
tags:
- name: Upload
  description: 'Two-step uploads for endpoints that accept user-provided file content.


    Call `POST /uploads/create` to obtain an `uploadUrl` and an `uploadId`. `PUT` the raw file body to `uploadUrl` within 1 hour, with a `Content-Type` header matching the file — not `multipart/form-data`. Then reference the `uploadId` from a registration endpoint such as those in [**Files**](#tag/files) or [**Photogrammetry**](#tag/photogrammetry) to attach the file to a resource.


    Prefer this flow over a registration endpoint''s `url` shortcut when the file isn''t already hosted at a public URL, or when you''d rather not expose it on the internet.'
paths:
  /uploads/create:
    post:
      summary: Create upload URL
      description: 'Returns an `uploadUrl` plus an `uploadId` you can later pass to a registration endpoint.


        Upload your file with a single `PUT` request to `uploadUrl`, sending the raw file bytes as the request body and a `Content-Type` header that matches the file. Do not use `multipart/form-data`. The URL stops accepting uploads after `expiresAt` (1 hour after creation).


        Once the upload completes, reference `uploadId` from a registration endpoint — for example `POST /files/create`.


        **Allowed API keys:** Read and Write'
      tags:
      - Upload
      responses:
        '201':
          description: Upload URL and identifier
          content:
            application/json:
              schema:
                type: object
                properties:
                  uploadId:
                    type: string
                    description: Opaque identifier for the staged upload. Pass it unchanged to a registration endpoint after `PUT`-ing the file to `uploadUrl`.
                    example: 123e4567-e89b-12d3-a456-426614174000/123e4567-e89b-12d3-a456-426614174002
                  uploadUrl:
                    type: string
                    description: '`PUT` the raw file bytes here with a `Content-Type` header matching the file. Valid until `expiresAt`.'
                    example: https://reonic.s3.eu-central-1.amazonaws.com/...
                  expiresAt:
                    type: string
                    format: date-time
                    description: ISO 8601 timestamp at which `uploadUrl` stops accepting uploads.
                    example: '2026-01-01T15:30:00.000Z'
                required:
                - uploadId
                - uploadUrl
                - expiresAt
components:
  securitySchemes:
    X-Authorization:
      type: apiKey
      in: header
      name: X-Authorization
x-tagGroups:
- name: People
  tags:
  - Contacts
  - Users
  - Teams
- name: Projects
  tags:
  - Residential Projects
  - Commercial Projects
- name: Working on a project
  tags:
  - Notes
  - Tasks
  - Files
  - File Folders
  - Activities
  - Time Tracking
  - Checklists
  - Checklist Templates
  - Signature Requests
- name: Calendar
  tags:
  - Calendars
  - Calendar Categories
  - Appointments
- name: Catalog
  tags:
  - Components
  - Planning Templates
  - Planning Packages
  - Offer Templates
- name: Workspace setup
  tags:
  - Kanban Boards
  - Kanban Columns
  - Tags
  - Lead Sources
- name: Wiki
  tags:
  - Wiki
- name: Services
  tags:
  - Photogrammetry
- name: API helpers
  tags:
  - Upload
  - Links
- name: Integrations
  tags:
  - Webhooks
- name: Guides
  tags:
  - Migrating from API v2 to v3
  - Changelog