create_site_upload_ticket

Create a short-lived ticket to upload one locally built site ZIP over HTTPS.

Prefer this to upload_site_version for a ZIP on the local machine: no archive bytes pass through tool arguments, so the upload does not depend on generating base64. Compute the ZIP’s lowercase SHA-256 and exact byte count locally (for example sha256sum site.zip and wc -c < site.zip) and pass only those values. Then, before expiresAt (at most 10 minutes), set UPLOAD_TOKEN to uploadToken and UPLOAD_URL to uploadUrl from this result, without printing the token, and run:

curl --fail-with-body \
  -H "Authorization: Bearer $UPLOAD_TOKEN" \
  -F "file=@site.zip;type=application/zip" \
  "$UPLOAD_URL"

The ticket uploads only that archive to that application. The first upload returns 201 with an inactive version; an identical retry returns 200 with the same version. A 409 site_upload_in_progress means retry after Retry-After. The ticket cannot activate or enable: call activate_site_version and then enable_site separately.

Input schema

{
  "additionalProperties": false,
  "properties": {
    "application_id": {
      "format": "uuid",
      "type": "string"
    },
    "archive_sha256": {
      "description": "Lowercase hex SHA-256 of the ZIP, computed locally.",
      "pattern": "^[0-9a-f]{64}$",
      "type": "string"
    },
    "archive_size_bytes": {
      "description": "Exact ZIP byte count, excluding multipart framing.",
      "maximum": 104857600,
      "minimum": 1,
      "type": "integer"
    }
  },
  "required": [
    "application_id",
    "archive_sha256",
    "archive_size_bytes"
  ],
  "type": "object"
}

Output schema

{
  "additionalProperties": false,
  "properties": {
    "archiveSha256": {
      "pattern": "^[0-9a-f]{64}$",
      "type": "string"
    },
    "archiveSizeBytes": {
      "minimum": 1,
      "type": "integer"
    },
    "expiresAt": {
      "format": "date-time",
      "type": "string"
    },
    "maxArchiveBytes": {
      "const": 104857600,
      "type": "integer"
    },
    "method": {
      "const": "POST"
    },
    "multipartField": {
      "const": "file"
    },
    "ticketId": {
      "description": "Non-secret audit correlation identifier; it cannot authorize.",
      "format": "uuid",
      "type": "string"
    },
    "uploadToken": {
      "description": "Short-lived bearer for that one upload; returned only here.",
      "type": "string",
      "writeOnly": true
    },
    "uploadUrl": {
      "description": "Canonical HTTPS URL of the application's site-version route.",
      "format": "uri",
      "type": "string"
    }
  },
  "required": [
    "ticketId",
    "uploadUrl",
    "method",
    "multipartField",
    "uploadToken",
    "expiresAt",
    "archiveSha256",
    "archiveSizeBytes",
    "maxArchiveBytes"
  ],
  "type": "object"
}