Secret key only. Scope: vps.

Also accepts a user token.

Admits the upload of the scan's recording and answers a signed URL for it. PUT the zip to upload.url as the body, with upload.headers and a Content-Length of recording_bytes, then call POST /vps/scans/{scan_id}/upload/complete. The URL needs no credentials and is good for two hours (expires_at). If the storage answers that the object already exists, an earlier PUT landed: go on to complete.

The upload is admitted against the team's spend limit, its queue of waiting scans and, for a kept recording, its storage quota. An app user's scan takes one of the app user's daily scans at its first admission, and an app user may have at most 3 scans admitted and not yet finished (awaiting_upload after admission, queued or processing).

Calling it again is safe while the scan is awaiting_upload. upload is null when the recording is already stored at exactly recording_bytes: skip the PUT and call complete.

Recordings are limited to 512 MiB (536,870,912 bytes). Needs a paid plan. Not counted against the monthly API request quota.