> ## Documentation Index > Fetch the complete documentation index at: https://docs.shoply.gg/llms.txt > Use this file to discover all available pages before exploring further. # Start a file upload > The first of three steps to give a variant a file to deliver. This one says what the file is and answers a signed address to send it to. Then send the file itself to that address with a `PUT`. Then call "Finish a file upload". A variant holds up to 3 files of up to 100 MB each, and a store up to 100 files and 5 GB. Accepted: ZIP, RAR, 7z, PDF, MP4, MP3, WAV, EPUB, EXE, DMG, MSI and APK. Needs the `stock.write` permission (Change Stock). ## OpenAPI ````yaml /api-reference/openapi.json post /stores/{storeId}/variants/{variantId}/files openapi: 3.1.0 info: title: Shoply API version: '1' description: >- Everything a store's own server can do with a secret API key: its catalogue, orders, customers, marketing, finance and the rest of what the dashboard does. And the Customer API, which a buyer's own device asks with a token of theirs. servers: - url: https://api.shoply.gg/v1 security: - apiKey: [] tags: - name: API key - name: Store - name: Domain - name: Payment methods - name: Analytics - name: Storefronts - name: Storefront code - name: Payment Routing - name: Custom payment methods - name: Products - name: Product pictures - name: Stock - name: Categories - name: Upsells - name: Subscriptions - name: Orders - name: Invoices - name: Reviews - name: Coupons - name: Coupon categories - name: Coupon pop-up - name: Sales - name: Blog - name: Search settings - name: Redirects - name: Sitemap - name: Cart Recovery - name: Email Marketing - name: Email Templates - name: Customers - name: Affiliates - name: Support Tickets - name: Blacklist - name: Fraud protection - name: Disputes - name: Finance - name: Tax - name: Expenses - name: Expense setup - name: API requests - name: Webhook endpoints - name: Webhook deliveries - name: Customer API paths: /stores/{storeId}/variants/{variantId}/files: post: tags: - Stock summary: Start a file upload description: >- The first of three steps to give a variant a file to deliver. This one says what the file is and answers a signed address to send it to. Then send the file itself to that address with a `PUT`. Then call "Finish a file upload". A variant holds up to 3 files of up to 100 MB each, and a store up to 100 files and 5 GB. Accepted: ZIP, RAR, 7z, PDF, MP4, MP3, WAV, EPUB, EXE, DMG, MSI and APK. Needs the `stock.write` permission (Change Stock). operationId: stock.addFile parameters: - name: storeId in: path required: true description: >- The store's ID. A key reaches the store it was made in: `GET /key` answers which. schema: type: string - name: variantId in: path required: true description: The variant. schema: type: string - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object properties: name: type: string description: >- The file's name, with its ending. Buyers download it under this name. example: setup.zip size: type: integer description: Its size in bytes. example: 10485760 required: - name - size responses: '200': description: It worked. content: application/json: schema: $ref: '#/components/schemas/Envelope' '401': $ref: '#/components/responses/NoKey' '403': $ref: '#/components/responses/NotAllowed' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/Refused' '429': $ref: '#/components/responses/TooMany' x-codeSamples: - lang: javascript label: Node.js source: | import Shoply from "@shoplygg/node"; const shoply = new Shoply({ apiKey: process.env.SHOPLY_API_KEY }); const result = await shoply.stock.addFile("VARIANT_ID", { name: "setup.zip", size: 10485760, }); - lang: php label: PHP source: | getenv('SHOPLY_API_KEY')]); $result = $shoply->stock->addFile('VARIANT_ID', [ 'name' => 'setup.zip', 'size' => 10485760, ]); - lang: python label: Python source: > import shoply client = shoply.Client() # reads SHOPLY_API_KEY result = client.stock.addFile("VARIANT_ID", name="setup.zip", size=10485760) components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: >- A word of your own for this one change, up to 180 letters, digits, dots, dashes, underscores and colons. Sent again with the same key, the request is not carried out twice: the first answer comes back, with `Idempotent-Replay: true`. schema: type: string schemas: Envelope: type: object properties: success: type: boolean description: Whether the request did what was asked. message: type: - string - 'null' description: Words for a person. Empty when it worked. code: type: - string - 'null' description: >- Why it was refused, as a word that does not change. Empty when it worked. data: description: 'The thing asked for: an object, or for a list its rows.' pages: type: integer description: 'For a paged list: how many pages there are.' total: type: integer description: 'For a paged list: how many rows there are in all.' meta: type: object description: Anything else the route answers beside the thing itself. required: - success - message - code - data Refusal: type: object properties: success: type: boolean example: false message: type: string description: What is wrong, in words for a person. code: type: string description: What is wrong, as a word that does not change. data: nullable: true errors: type: object description: >- For `validation_failed`: what is wrong with each field, by the field's name. additionalProperties: type: string required: - success - message - code responses: NoKey: description: >- No API key was sent, or the one sent is not a live key: `api_key_required`, `invalid_api_key`. content: application/json: schema: $ref: '#/components/schemas/Refusal' NotAllowed: description: >- The key is real and may not do this: `missing_scope` (with `requiredScope`), `ip_not_allowed`, `account_unavailable`, or `dashboard_only` for something only a person in the dashboard may do. content: application/json: schema: $ref: '#/components/schemas/Refusal' NotFound: description: >- There is no such thing in this store: `not_found`. A store that is not the key's own is answered the same way. content: application/json: schema: $ref: '#/components/schemas/Refusal' Refused: description: >- The request was understood and not carried out. `validation_failed` says what is wrong with each field under `errors`; other codes are the route's own. content: application/json: schema: $ref: '#/components/schemas/Refusal' TooMany: description: >- The key has used up its budget for now: `rate_limited`. `Retry-After` says how many seconds to wait. content: application/json: schema: $ref: '#/components/schemas/Refusal' securitySchemes: apiKey: type: http scheme: bearer description: >- A secret API key, made under Developers in the dashboard: `Authorization: Bearer shoply_sk_...` ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.