---
title: "Files and uploads · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/files-and-uploads
updated: 2026-10-20
licence: "All rights reserved"
---

# Files and uploads

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Send uploads straight to storage, resume big ones, check and scan every file, clean images, and serve private files through short-lived links.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/files-and-uploads`.

## Required

- [Confirm every upload on the server](https://agentwranglers.se/playbook/api-design/files-and-uploads/confirm-uploads): Keep a new file `pending` until the server has checked its size, type and checksum from the stored bytes. Never trust what the client reports.
- [Scan files for malware before anyone opens them](https://agentwranglers.se/playbook/api-design/files-and-uploads/scan-uploads): Scan every file that other people or systems will open, and serve it only after the scan says clean.
- [Rebuild every uploaded image](https://agentwranglers.se/playbook/api-design/files-and-uploads/process-images): Decode each uploaded image, turn it upright, shrink it to a size limit and save it again as a new file without metadata. Never serve the original.
- [Serve private files through short-lived links](https://agentwranglers.se/playbook/api-design/files-and-uploads/signed-downloads): Keep the bucket private. Check access on every download request, then redirect to a signed address that expires within 5 minutes and sets safe download headers.
- [Delete files when their owner is deleted](https://agentwranglers.se/playbook/api-design/files-and-uploads/delete-files-with-owner): Record every stored object in a files table with its owner, and delete the objects in the same job that deletes the owner.
- [Neutralise formulas in spreadsheet exports](https://agentwranglers.se/playbook/api-design/files-and-uploads/spreadsheet-exports): In every CSV or spreadsheet export, prefix a single quote to cell text starting with `=`, `+`, `-`, `@`, a tab or a carriage return.

## Recommended

- [Upload straight to storage with a signed address](https://agentwranglers.se/playbook/api-design/files-and-uploads/presigned-uploads): Let clients send file bytes straight to object storage through a pre-signed address that your API issues, limited in size, type and time.
- [Make large uploads resumable](https://agentwranglers.se/playbook/api-design/files-and-uploads/resumable-uploads): Let any upload over 100 MB, or any upload from a phone, continue from the last received byte after a dropped connection.
- [Lay out storage by owner and let rules clean it](https://agentwranglers.se/playbook/api-design/files-and-uploads/storage-lifecycle): Name every stored object by stage, owner and a random ID, with the stage as the first prefix. Let storage lifecycle rules delete what nobody needs.

## Optional

- [Store the same file once per owner](https://agentwranglers.se/playbook/api-design/files-and-uploads/dedupe-by-hash): When users upload the same file often, store it once per owner under its SHA-256 hash and count the references.

- Previous: [Webhooks and events](https://agentwranglers.se/playbook/api-design/webhooks-and-events)
- [All chapters](https://agentwranglers.se/playbook/api-design)