---
title: "Media library and template catalog API reference"
description: "Upload, import, list, and delete project images, and read the public template catalog, through the dashboard API routes."
canonical: "https://rightmessage.com/help/media-and-template-api"
last-updated: 2026-10-27
---

# Media library and template catalog API reference

Upload, import, list, and delete project images, and read the public template catalog, through the dashboard API routes.

These endpoints manage your project's image library and read the catalog of flow templates. They're dashboard API routes under `/api`, not public REST v1 resources, and none of them changes your project's draft or needs a publish.

## Authentication, paths, and rate limits

Media routes use `https://api.rightmessage.com/api/{teamPid}`. They require an authenticated session or API token, project membership or administrator access, and account and project suspension checks. Browser-session writes require CSRF protection. Bearer tokens are accepted, but these routes don't enforce v1 `read`, `write`, or `publish` abilities.

Template catalog routes use `https://api.rightmessage.com/api/template-catalog` and don't require authentication. Neither group declares a per-route throttle, so v1's 120-per-minute declaration doesn't apply to them. Global infrastructure limits can still apply.

Send `Accept: application/json`, and JSON bodies with `Content-Type: application/json`. The illustrative requests below use bearer placeholders for clarity and were not executed.

## Project media operations

These routes change storage immediately, without a publish.

| Method and path        | Request                                                                               | Success                                            |
| ---------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------- |
| GET `/files`           | No parameters                                                                         | 200, bare array of filenames                       |
| POST `/files`          | Multipart `file`, required file, maximum 2,048 KiB; jpeg, jpg, png, gif, webp, or svg | 200, filename string, not a JSON resource envelope |
| DELETE `/files/{hash}` | Filename from storage, no body                                                        | 200, `{"message":"File deleted successfully"}`     |
| POST `/files/from-url` | JSON `url`, required valid URL, maximum 2,048 characters                              | 200, `{"hashName":"..."}`                          |

URL import downloads the image with a 30-second timeout. Allowed response media types are image/jpeg, image/png, image/gif, image/svg+xml, and image/webp. Content must not exceed 2,097,152 bytes. WebP is accepted by both URL import and multipart upload.

Uploaded files get a random 40-character name plus an extension that matches the file's type, so uploading the same file twice stores two copies. Imported filenames use the content MD5 plus a normalized extension. Existing identical content at that project path returns `existing: true` with `hashName`. New imports omit `existing`. Import stores the file; it doesn't attach it to anything.

Deduplication is by content hash plus extension, not content alone. Identical bytes imported with different accepted extensions can create separate files. Deleting media doesn't inspect or rewrite the places that use it, and a missing filename still receives the same success message. Remove an image from your offers, widgets, and pages before deleting it.

Illustrative calls, not executed:

```bash
curl 'https://api.rightmessage.com/api/123456/files' -H 'Authorization: Bearer YOUR_API_TOKEN' -H 'Accept: application/json'
curl 'https://api.rightmessage.com/api/123456/files' -H 'Authorization: Bearer YOUR_API_TOKEN' -H 'Accept: application/json' -F 'file=@workforge-logo.png'
curl -X POST 'https://api.rightmessage.com/api/123456/files/from-url' -H 'Authorization: Bearer YOUR_API_TOKEN' -H 'Accept: application/json' -H 'Content-Type: application/json' --data '{"url":"https://example.com/logo.png"}'
curl -X DELETE 'https://api.rightmessage.com/api/123456/files/0123456789abcdef0123456789abcdef.png' -H 'Authorization: Bearer YOUR_API_TOKEN' -H 'Accept: application/json'
```

Corresponding illustrative bodies, in request order:

```text
["0123456789abcdef0123456789abcdef.png"]
Q7mXc2LpR9vTn4KsW8yZ1bHd6FgJ3aEu5oNi0rVe.png
{"hashName":"0123456789abcdef0123456789abcdef.png","existing":true}
{"message":"File deleted successfully"}
```

URL import returns 422 with `error` for `Invalid image type. Allowed: jpeg, png, gif, svg, webp`, `Image too large (max 2MB)`, or `Failed to download image from URL`. Request validation instead returns the normal `message` and `errors` envelope. Other storage or network failures can return 500.

## Public template catalog

The catalog describes the [flow templates](https://rightmessage.com/help/flow-templates) you can install, without installing them or changing a project.

GET `/api/template-catalog` returns 200 with `data`, an array of entries, and `meta: {last_page:1}`. It returns the entire catalog, ordered by configured order then title. There are no supported query filters or pagination inputs.

GET `/api/template-catalog/{idOrSlug}` accepts an exact template UUID or filename-derived slug. It returns 200 with `data`, one entry, or 404 when absent.

Each entry contains `id`, `slug`, `title`, nullable `description`, nullable `preview_image` with a `url`, `template_type: {value:string}`, boolean `hide_preview`, nullable `impact_statement`, nullable `best_for`, array `template_categories`, nullable `structural_archetype`, boolean `is_skeleton`, and `payload_json: {value:string}`. The payload value is serialized JSON text, not an already-decoded object. Template type defaults to flow; boolean flags default to false.

Illustrative requests and response excerpts, not executed. The slug and entry are fictional:

```http
GET /api/template-catalog HTTP/1.1
Host: api.rightmessage.com
Accept: application/json

GET /api/template-catalog/workforge-welcome HTTP/1.1
Host: api.rightmessage.com
Accept: application/json
```

```json
{"data":[{"id":"11111111-1111-4111-8111-111111111111","slug":"workforge-welcome","title":"WorkForge welcome","template_type":{"value":"flow"},"payload_json":{"value":"{}"}}],"meta":{"last_page":1}}
```

The item response uses `{"data":ENTRY}` with the same full entry schema. The abbreviated example payload is not an installable template.

## Common failures

Authenticated routes return 401 for missing authentication and 403 for denied access or suspension. Invalid media inputs return 422. Browser-session writes can fail CSRF protection. Maintenance returns 503 for these API routes, including the otherwise-public catalog.