Media library and template catalog API reference
Upload, import, list, and delete project images, and read the public template catalog, through the dashboard API routes.
Updated
View as MarkdownThese endpoints manage your project's image library and read the catalog of flow templates. They're dashboard API routes under /api, not public REST v1 resources, and none of them changes your project's draft or needs a publish.
Authentication, paths, and rate limits
Media routes use https://api.rightmessage.com/api/{teamPid}. They require an authenticated session or API token, project membership or administrator access, and account and project suspension checks. Browser-session writes require CSRF protection. Bearer tokens are accepted, but these routes don't enforce v1 read, write, or publish abilities.
Template catalog routes use https://api.rightmessage.com/api/template-catalog and don't require authentication. Neither group declares a per-route throttle, so v1's 120-per-minute declaration doesn't apply to them. Global infrastructure limits can still apply.
Send Accept: application/json, and JSON bodies with Content-Type: application/json. The illustrative requests below use bearer placeholders for clarity and were not executed.
Project media operations
These routes change storage immediately, without a publish.
| Method and path | Request | Success |
|---|---|---|
GET /files | No parameters | 200, bare array of filenames |
POST /files | Multipart file, required file, maximum 2,048 KiB; jpeg, jpg, png, gif, webp, or svg | 200, filename string, not a JSON resource envelope |
DELETE /files/{hash} | Filename from storage, no body | 200, {"message":"File deleted successfully"} |
POST /files/from-url | JSON url, required valid URL, maximum 2,048 characters | 200, {"hashName":"..."} |
URL import downloads the image with a 30-second timeout. Allowed response media types are image/jpeg, image/png, image/gif, image/svg+xml, and image/webp. Content must not exceed 2,097,152 bytes. WebP is accepted by both URL import and multipart upload.
Uploaded files get a random 40-character name plus an extension that matches the file's type, so uploading the same file twice stores two copies. Imported filenames use the content MD5 plus a normalized extension. Existing identical content at that project path returns existing: true with hashName. New imports omit existing. Import stores the file; it doesn't attach it to anything.
Deduplication is by content hash plus extension, not content alone. Identical bytes imported with different accepted extensions can create separate files. Deleting media doesn't inspect or rewrite the places that use it, and a missing filename still receives the same success message. Remove an image from your offers, widgets, and pages before deleting it.
Illustrative calls, not executed:
Corresponding illustrative bodies, in request order:
URL import returns 422 with error for Invalid image type. Allowed: jpeg, png, gif, svg, webp, Image too large (max 2MB), or Failed to download image from URL. Request validation instead returns the normal message and errors envelope. Other storage or network failures can return 500.
Public template catalog
The catalog describes the flow templates you can install, without installing them or changing a project.
GET /api/template-catalog returns 200 with data, an array of entries, and meta: {last_page:1}. It returns the entire catalog, ordered by configured order then title. There are no supported query filters or pagination inputs.
GET /api/template-catalog/{idOrSlug} accepts an exact template UUID or filename-derived slug. It returns 200 with data, one entry, or 404 when absent.
Each entry contains id, slug, title, nullable description, nullable preview_image with a url, template_type: {value:string}, boolean hide_preview, nullable impact_statement, nullable best_for, array template_categories, nullable structural_archetype, boolean is_skeleton, and payload_json: {value:string}. The payload value is serialized JSON text, not an already-decoded object. Template type defaults to flow; boolean flags default to false.
Illustrative requests and response excerpts, not executed. The slug and entry are fictional:
The item response uses {"data":ENTRY} with the same full entry schema. The abbreviated example payload is not an installable template.
Common failures
Authenticated routes return 401 for missing authentication and 403 for denied access or suspension. Invalid media inputs return 422. Browser-session writes can fail CSRF protection. Maintenance returns 503 for these API routes, including the otherwise-public catalog.