Create a file

import { createSiteClient } from '@fetchski/attract-cms-sdk';

const site = createSiteClient();
const fileObject = await site.media().createFile();

{
  "_id": "clx1234567890abcdef",
  "title": "Company Brochure",
  "slug": "company-brochure",
  "type": "@apostrophecms/file",
  "archived": false,
  "visibility": "public",
  "attachment": {
    "_id": "ckj0akbxa003vp39kfbxgb8zg",
    "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
    "_urls": {
      "key": "Example value"
    },
    "name": "blue-box",
    "title": "blue box",
    "extension": "png",
    "type": "attachment",
    "group": "images",
    "length": 10497,
    "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
    "width": 600,
    "height": 106,
    "landscape": true,
    "portrait": true,
    "docIds": [
      "clx8m2k4p0000a1b2c3d4e5f6"
    ],
    "archivedDocIds": [
      "clx8m2k4p0000a1b2c3d4e5f6"
    ],
    "createdAt": "2026-10-24T09:30:00.000Z",
    "updatedAt": "2026-10-24T09:30:00.000Z",
    "_isCroppable": true,
    "crop": {},
    "used": true,
    "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
    "folderPath": "Example folder path"
  },
  "description": "Example description",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "copyOfId": "ckhdscx5900054z9k88uqs16w:en:published",
  "_folder": [
    {}
  ],
  "_tags": [
    {}
  ],
  "_url": "https://acme.example/example",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

import { createSiteClient } from '@fetchski/attract-cms-sdk';

const site = createSiteClient();
const fileObject = await site.media().createFile();

{
  "_id": "clx1234567890abcdef",
  "title": "Company Brochure",
  "slug": "company-brochure",
  "type": "@apostrophecms/file",
  "archived": false,
  "visibility": "public",
  "attachment": {
    "_id": "ckj0akbxa003vp39kfbxgb8zg",
    "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
    "_urls": {
      "key": "Example value"
    },
    "name": "blue-box",
    "title": "blue box",
    "extension": "png",
    "type": "attachment",
    "group": "images",
    "length": 10497,
    "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
    "width": 600,
    "height": 106,
    "landscape": true,
    "portrait": true,
    "docIds": [
      "clx8m2k4p0000a1b2c3d4e5f6"
    ],
    "archivedDocIds": [
      "clx8m2k4p0000a1b2c3d4e5f6"
    ],
    "createdAt": "2026-10-24T09:30:00.000Z",
    "updatedAt": "2026-10-24T09:30:00.000Z",
    "_isCroppable": true,
    "crop": {},
    "used": true,
    "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
    "folderPath": "Example folder path"
  },
  "description": "Example description",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "copyOfId": "ckhdscx5900054z9k88uqs16w:en:published",
  "_folder": [
    {}
  ],
  "_tags": [
    {}
  ],
  "_url": "https://acme.example/example",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

In your app

A function makes the call on the client it is given, so your code passes the real one and a test passes a fake.

Add the function

src/attract/create-file.ts

import type { SiteClient } from '@fetchski/attract-cms-sdk';

export async function createFile(site: SiteClient) {
  return site.media().createFile();
}

Call it

A script makes the client once and calls the function:

scripts/create-file.ts

import { createSiteClient } from '@fetchski/attract-cms-sdk';
import { createFile } from '../src/attract/create-file.ts';

const site = createSiteClient();
console.log(await createFile(site));

Terminal

node --env-file=.env scripts/create-file.ts

A route handler, a job or a queue worker calls it the same way.

Optional parameters

One object, e.g. createFile({ aposMode }); leave out the optional fields.

AposMode | null | undefined

Optional. Leave it out and the site uses "published". published (the default) or draft. Drafts need a credential that may see them: an API key with the type’s write scope (content:<type>:write), or a signed-in editor. The public and a key with only the read scope get 403. One of draft, published.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The locale to read or write, e.g. en (default: the site’s default locale).

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. File title/description.

string | null | undefined

Optional. Its URL name: lowercase words joined by hyphens. Left out, it’s made from the title.

boolean | null | undefined

Optional. Leave it out and the site uses false. In the archive: kept, but out of every list and off the site until it is restored. false (or null) for a live document.

Visibility | null | undefined

Optional. Leave it out and the site uses "public". Who may see it on the site: public (everyone) or loginRequired (signed-in people only). One of public, loginRequired.

Attachment | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. File attachment information from upload endpoint.

Show Attachment

string

required

Required. Unique attachment identifier.

string

required

Required. Slugified filename.

string

required

Required. Sortified filename.

string

required

Required. File extension.

string

required

Required. Always attachment.

string

required

Required. File group type.

number

required

Required. File size in bytes.

string

required

Required. MD5 checksum.

readonly string[]

required

Required. IDs of documents using this attachment.

readonly string[]

required

Required. IDs of archived documents using this attachment.

Date

required

Required. When it was uploaded (ISO 8601). Format: an ISO 8601 date and time.

string

The file’s URL: set for a file that is not an image. An image’s URLs are in _urls, by size (original is the file as uploaded).

Readonly<Record<string, string>>

An image’s URLs by size (original, max, full, two-thirds, one-half, one-third, one-sixth); unset for other files.

number

Image width in pixels (images only)

number

Image height in pixels (images only)

boolean

Whether image is landscape orientation (images only)

boolean

Whether image is portrait orientation (images only)

Date

When it last changed (ISO 8601). Format: an ISO 8601 date and time.

boolean

Whether the image can be cropped.

Readonly<Record<string, unknown>> | null

The crop applied, if any (top, left, width, height).

boolean

Whether any document uses the file.

string | null

The media folder holding the file, by its aposDocId.

string

That folder’s path, e.g. events/summer.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. File description.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The _id of the piece/page that was copied to create this document (only present if created via _copyingId)

readonly Readonly<Record<string, unknown>>[] | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The media folder holding it (one at most; empty at the library’s root).

readonly Readonly<Record<string, unknown>>[] | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. Its tags, as documents.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The file’s URL (the attachment’s _url). Format: an absolute URL.

Returns

A FileObject. Built-in file piece type for general file uploads (PDFs, documents, etc.) Read its properties (fileObject.id): each says whether the site always sends it. The example answer is the site’s wire JSON: some keys differ from the property names (_id → id, _folder → folder, _tags → tags …).

string

Always sent. Unique identifier.

string

Always sent. Its URL name: lowercase words joined by hyphens.

string

Always sent.

Visibility

Always sent. Who may see it on the site: public (everyone) or loginRequired (signed-in people only). One of public, loginRequired; a newer site may send others, so keep a fallback.

Date

Always sent. Format: an ISO 8601 date and time.

Date

Always sent. Format: an ISO 8601 date and time.

string | null

Sometimes sent: undefined when the site leaves it out, and it can be null. File title/description.

boolean | null

Sometimes sent: undefined when the site leaves it out, and it can be null. In the archive: kept, but out of every list and off the site until it is restored. false (or null) for a live document.

Attachment

Sometimes sent: undefined when the site leaves it out. An Attachment. File attachment information from upload endpoint.

Show Attachment

string

Always sent. Unique attachment identifier.

string

Always sent. Slugified filename.

string

Always sent. Sortified filename.

string

Always sent. File extension.

string

Always sent. Always attachment.

string

Always sent. File group type.

number

Always sent. File size in bytes.

string

Always sent. MD5 checksum.

readonly string[]

Always sent. IDs of documents using this attachment.

readonly string[]

Always sent. IDs of archived documents using this attachment.

Date

Always sent. When it was uploaded (ISO 8601). Format: an ISO 8601 date and time.

string

Sometimes sent: undefined when the site leaves it out. The file’s URL: set for a file that is not an image. An image’s URLs are in _urls, by size (original is the file as uploaded).

Readonly<Record<string, string>>

Sometimes sent: undefined when the site leaves it out. An image’s URLs by size (original, max, full, two-thirds, one-half, one-third, one-sixth); unset for other files.

number

Sometimes sent: undefined when the site leaves it out. Image width in pixels (images only)

number

Sometimes sent: undefined when the site leaves it out. Image height in pixels (images only)

boolean

Sometimes sent: undefined when the site leaves it out. Whether image is landscape orientation (images only)

boolean

Sometimes sent: undefined when the site leaves it out. Whether image is portrait orientation (images only)

Date

Sometimes sent: undefined when the site leaves it out. When it last changed (ISO 8601). Format: an ISO 8601 date and time.

boolean

Sometimes sent: undefined when the site leaves it out. Whether the image can be cropped.

Readonly<Record<string, unknown>> | null

Sometimes sent: undefined when the site leaves it out, and it can be null. The crop applied, if any (top, left, width, height).

boolean

Sometimes sent: undefined when the site leaves it out. Whether any document uses the file.

string | null

Sometimes sent: undefined when the site leaves it out, and it can be null. The media folder holding the file, by its aposDocId.

string

Sometimes sent: undefined when the site leaves it out. That folder’s path, e.g. events/summer.

string | null

Sometimes sent: undefined when the site leaves it out, and it can be null. File description.

string | null

Sometimes sent: undefined when the site leaves it out, and it can be null. The _id of the piece/page that was copied to create this document (only present if created via _copyingId)

readonly Readonly<Record<string, unknown>>[] | null

Sometimes sent: undefined when the site leaves it out, and it can be null. The media folder holding it (one at most; empty at the library’s root).

readonly Readonly<Record<string, unknown>>[] | null

Sometimes sent: undefined when the site leaves it out, and it can be null. Its tags, as documents.

string | null

Sometimes sent: undefined when the site leaves it out, and it can be null. The file’s URL (the attachment’s _url). Format: an absolute URL.

Sometimes sent: undefined when the site leaves it out, and it can be null. The draft’s preview share key, while its share link is on: the link is the draft’s _url with aposShareKey and aposShareId (the draft’s _id) in its query. Absent otherwise, and on published documents.

Errors

Nothing to catch: the SDK retries what is safe, and throws the rest as the classes below; catch only what you want to react to (see Errors and testing).

400

The site refused what was sent: errors lists each field’s problem, siteMessage the first.Retried first: No. Read: errors (field → messages), siteMessage.

401

The API key is missing or refused (malformed, revoked, expired), or a signature its signing mode needs is missing or stale.Retried first: No. Read: siteMessage, errorName, data.

403

The key may not do this: a scope it lacks, or an address outside its allowlist. siteMessage names it.Retried first: No. Read: siteMessage, errorName, data.

500

The site failed. Its logs say why.Retried first: No: a write may have landed. Read: siteMessage, errorName, data.

no answer

No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).Retried first: Only when nothing reached the site (neverConnected()); never after a timeout, when it may have landed. Read: reason, neverConnected.

not sent

The client refused to send it (e.g. a path segment of ..); the site never saw it.Retried first: No. Read: reason (what to change).

any other

Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).Retried first: No. Read: reason, status.

setup

sites.forSite('acme') named a slug your sites (createSiteClients()) don’t have.Retried first: No: nothing was sent. Read: message, slug.

setup

The client’s settings are wrong: no FETCHSKI_ATTRACT_URL (or baseUrl), or a malformed API key.Retried first: No: nothing was sent. Read: message (what to fix).

Behavior

Access: an API key with content:files:write (or a master above it: content:files:all, content:all, admin:all). A signed-in person may call it as far as their own permissions allow; anyone else gets 403.
Rate limit: the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with Retry-After. The client waits and retries for you; you see RateLimited only if that runs out.
Retries: a write is sent again only after a 429 (refused before it acted) or when it never reached the site. After a timeout or a 5xx it may have landed: check before you send it again.
Timeout: 15 s per attempt by default; raise timeout (milliseconds) on the client for longer.

Test it

It calls the function above with a fake client: the fake answers every call with a valid example, so nothing leaves your machine and no settings or key are needed. Run it with node --test.

tests/media-createFile.test.ts

import { test } from 'node:test';
import { fakeSite } from '@fetchski/attract-cms-sdk/testing';
import { createFile } from '../src/attract/create-file.ts';

test('media.createFile', async () => {
  const site = fakeSite();
  await createFile(site);
  site.assertCalled('media.createFile');
});

Answer with your own values: fake media.createFile with factories.FileObject({...}), the fields you give over a valid example.

tests/media-createFile-answer.test.ts

import assert from 'node:assert/strict';
import { test } from 'node:test';
import { factories, fakeSite } from '@fetchski/attract-cms-sdk/testing';

test('media.createFile answers your values', async () => {
  const site = fakeSite({
    'media.createFile': factories.FileObject({ id: 'Your value' })
  });
  const fileObject = await site.media().createFile();
  assert.equal(fileObject.id, 'Your value');
});

List images

site.media().listImages()

Create an image

site.media().createImage()

Archive images

site.media().archiveImages()

Crop images to a widget’s aspect ratio

site.media().autocropImages()

Copy images to another locale

site.media().localizeImages()

Publish images

site.media().publishImages()

POST /@apostrophecms/file

The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.

import { createSiteClient } from '@fetchski/attract-cms-sdk';

const site = createSiteClient();
const fileObject = await site.media().createFile();

{
  "_id": "clx1234567890abcdef",
  "title": "Company Brochure",
  "slug": "company-brochure",
  "type": "@apostrophecms/file",
  "archived": false,
  "visibility": "public",
  "attachment": {
    "_id": "ckj0akbxa003vp39kfbxgb8zg",
    "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
    "_urls": {
      "key": "Example value"
    },
    "name": "blue-box",
    "title": "blue box",
    "extension": "png",
    "type": "attachment",
    "group": "images",
    "length": 10497,
    "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
    "width": 600,
    "height": 106,
    "landscape": true,
    "portrait": true,
    "docIds": [
      "clx8m2k4p0000a1b2c3d4e5f6"
    ],
    "archivedDocIds": [
      "clx8m2k4p0000a1b2c3d4e5f6"
    ],
    "createdAt": "2026-10-24T09:30:00.000Z",
    "updatedAt": "2026-10-24T09:30:00.000Z",
    "_isCroppable": true,
    "crop": {},
    "used": true,
    "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
    "folderPath": "Example folder path"
  },
  "description": "Example description",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "copyOfId": "ckhdscx5900054z9k88uqs16w:en:published",
  "_folder": [
    {}
  ],
  "_tags": [
    {}
  ],
  "_url": "https://acme.example/example",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

Get started

Using the SDK

Going further

Pages & Site

Content

Media

Forms

Ads & Conversions

Analytics

In your app

Behavior

Test it

List images

Create an image

Archive images

Crop images to a widget’s aspect ratio

Copy images to another locale

Publish images

POST /@apostrophecms/file

In your app

Behavior

Test it

Related

List images

Create an image

Archive images

Crop images to a widget’s aspect ratio

Copy images to another locale

Publish images

POST /@apostrophecms/file