Attach a media file to a specified element (e.g., gym, post, user).
You must have update permission for the target attachable resource.
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| attachable_type | string | Yes | Type of the element to attach media to (see below) | "gym" |
| attachable_id | int | Yes | ID of the element | 42 |
| file | file | Yes |
| The media file to upload |
| (binary file) |
| purpose | string | No | Marks the upload as a sensitive document instead of ordinary gallery media (see below) | "gym_license" |
Available purpose values:
| Value | Attachable | Meaning |
|---|---|---|
trainer_license | user | The uploader's own trainer license. May only be attached to your own user record. |
gym_license | gym | The gym's business license. May only be attached to a gym you are allowed to update. |
Sensitive media. A media row with a
purposeis never publicly downloadable — GET /api/v1/media/{media}/{filename} applies per-purpose access control to it, and it is excluded from the owning record's publicmediaarray. Uploading a license also points the owning record's*_license_imageat the new file, deletes the superseded document, and resets*_license_approvedtonull(pending), because a new document has to be reviewed again — this applies to bothtrainer_license(on the user) andgym_license(on the gym). Omittingpurpose(or sendingnull) uploads ordinary, publicly readable gallery media.
Available attachable_type values:
championshipgymgym_equipmentpostusereducationgym_buffet_itemtraining_servicetracker_mealtracker_progress_photo
tracker_progress_photois share-gated, not public. Ordinary media without apurposeis readable by anyone who may read the record it hangs off, and for most types that is a wide audience. A progress photo's audience is exactly the athlete plus any viewer holding a tracker share withinclude_progress_photo = truewhose window covers the entry'stracked_at— the same rule that governs the entry itself, applied to the file. See the progress photo resource.
POST /api/v1/media
Authorization: Bearer {token}
Content-Type: multipart/form-data
attachable_type=gym
attachable_id=42
file=@photo.jpg
Returns the created media resource.
{
"data": { /* media resource */ }
}
For a full schema, see Media Resource.
| Status | Description | Reference |
|---|---|---|
| 422 | Validation error | Validation error |
| 401 | Unauthorized | Authentication error |
| 403 | Forbidden (no permission) | Permission error |