Upload media in a session

A game's media doesn't have to travel inside the ZIP. Declare it in an upload session, PUT each file to storage, then import or release with the session. This is how a game gets past the 10 MiB ZIP limit.

POST /api/developer/uploads/
Content-Type: application/json

{
    "project_id": "6f1d2c8e-...",
    "files": [
        { "path": "assets/hero.png", "size": 48213, "md5": "0b4e7a0e5fe84ad35fb5f95b9ceeac79" },
        { "path": "assets/boom.wav", "size": 5, "md5": "5d41402abc4b2a76b9719d911017c592" }
    ]
}

Anonymous sessions are rate limited: over the limit the answer is HTTP 429 with Retry-After.

ResponseCopy Anchor Link

HTTP 201:

{
    "upload_id": "9a4b2f0e-...",
    "upload_token": "<upload_token>",
    "expires_at": "2026-10-28T18:30:00Z",
    "linked": ["assets/hero.png"],
    "uploads": [
        {
            "path": "assets/boom.wav",
            "url": "<signed upload URL>",
            "method": "PUT",
            "headers": {
                "Content-Type": "audio/wav",
                "Content-MD5": "XUFAKrxLKna5cZ2REBfFkg==",
                "x-goog-content-length-range": "5,5"
            }
        }
    ]
}

• linked lists declared paths Rosebud already holds, with the same MD5 and size. They aren't uploaded again. An update session links the owner's files and the files the game already serves at the same path; a login session links the account's files; an anonymous session links nothing this way.
• A linked path skips the media type and folder rules but must still be a safe, canonical name. Editor-only media such as an MP4 can only be kept this way, unchanged at the same path.
• uploads has one entry per path that isn't linked. PUT the file's bytes to url with exactly the returned headers, all of them. Storage rejects bytes whose MD5 or length differs from the declaration.
• upload_token is shown once. Keep it private.
• Each signed URL works for one hour, and the session for 24 hours (expires_at).

While Rosebud is still checking files the game already serves, it can answer 409 upload_retry with a remaining count and Retry-After: 1. Repeat the identical request: remaining falls until the session is created. Stop if it stops falling.

Use the sessionCopy Anchor Link

Send upload_id and upload_token as two more multipart fields, both or neither, with an import or a release.

• A release is a full snapshot: the game becomes the ZIP's files plus every path the session declared, linked or uploaded. Anything else is removed, so declare all of the game's media, not only the changes.
• A path in both the ZIP and the session is duplicate_path. The ZIP and the session count together toward the file-count and total-size limits.
• New (not linked) media in one release is at most 128 MiB (413 release_upload_limit, with the exact limit). Publish part of it, then release the rest; later sessions declare the earlier media again and link it.
• An update session releases only its game. A new-game session can't update a game, and is spent by the import that succeeds with it. A login session works only for that login's account.
• Retries use the release's operation_id. After the session expires, create a new one that declares the same paths and MD5s and retry with the same operation_id; its files needn't be uploaded.

ErrorsCopy Anchor Link

The endpoint also answers the connection, login, limit and path errors on Errors. A failed release changes nothing.