Upload the bytes for a registered intent
PUT the raw file body, not multipart and not base64, to the `uploadUrl` returned by the intent step. The declared size must match within 1KB, and the object is not visible to the form until `confirm`.
A server-side secret key. Never send one from a browser — a request carrying an Origin header is refused for this reason.
In: header
Path Parameters
Request Body
application/octet-stream
TypeScript Definitions
Use the request body type in TypeScript.
binaryResponse Body
application/json
application/json
application/json
application/json
curl -X PUT "https://example.com/v1/sessions/string/uploads/string" \ -H "Content-Type: application/octet-stream" \ -d 'string'{ "ok": true}Create, update or rotate the spreadsheet feed
Idempotent by nature, because there is one feed per form, which is why this is a PUT. The returned `feedUrl` is a live CSV a spreadsheet can re-read on a schedule; it is unauthenticated, so the URL is the whole credential. Send `rotate: true` to invalidate the previous one.
Follow a signed download link
You never build this URL yourself — `GET /v1/exports/{id}` and `GET /v1/files/{id}` return it complete. It carries no API key, expires within minutes, and answers 404 for anything it cannot serve, including a link that has expired.