Uploads a report snapshot. Requires the reports:write scope. Reports are immutable — a new upload to an existing name produces a new code and version rather than altering an existing one.
Two share URLs come back for named uploads: url pins this exact version forever (immutable snapshot), while nameUrl is a live link that always shows the group's latest version and pushes updates to open viewers in real time over WebSocket (re-upload/repoint swaps the view, delete/make-private shows 404 — no refresh needed). Note GET nameUrl returns a platform shell page that frames the report; for the raw report HTML fetch url (the pinned /{code}/) instead.
For private reports both URLs point to the application host instead of the content host, and opening url/nameUrl requires the owner's session there. The owner can still fetch a private report's raw HTML directly from the content host with an Authorization: Bearer PAT — see the url field below.
For org reports both URLs are on the content host, same shape as public — but opening them only resolves for members of the owning organization, via the application host's authorization redirect (see the top-level description). org requires the upload's owner to be an organization, and the caller must already be a member of it.
Limits: up to 100 files per request, 10 MB per decoded file, 20 MB total request body. Assets reference each other with relative paths; absolute src="/…" references and <base> are unsupported and reported in warnings.
Body Parameters
filesarray of objectsrequired
Non-empty. One entry must have path equal to index.html.
Show child attributes
pathstringrequired
Bare filename (no subdirectories). Exactly one entry must be index.html.
contentstringrequired
File contents. UTF-8 text, or base64 when encoding is base64.
encodingstring
Content encoding. Default "utf-8". One of utf-8, base64.
namestring
Group name. Re-uploading an existing name adds a version; a name owned by another account returns 409.
titlestring
Defaults to the document's <title> when omitted.
folderstring
Portal-only label, e.g. RD/2026/Q2. Never appears in URLs.
visibilitystring
Defaults to private. A public report is served from the content host. org is visible to members of the owning organization — served from the content host via a short-lived signed URL minted by the application host's /authorize endpoint (the share URL redirects there automatically); requires owner to be an organization and the caller to already be a member of it. Default "private". One of public, private, org.