Delete an upload ticket

DELETEhttps://<your-url>/api/v2/uploads/{upload}

MCP id uploads.destroyAlso on this path: GET Read an upload ticket

Revokes one of your own unregistered upload tickets: the staged bytes are deleted from storage, the ticket is marked revoked and answers 204.

Token scope: api:destroy:project_managementorapi:destroy:project_driveorapi:destroy:customer_driveorapi:destroy:organization_driveorapi:destroy:user_drive
Without it: 403 insufficient-token-scope.
Permission: None. The record's own rules still apply.
Rate cost: 1 unit, write bucket.
Also: Accepts If-Match. Never cached: private, no-store. Unknown query parameters are refused, never ignored.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: Abandon a staged upload

curl -X DELETE \
  'https://<your-url>/api/v2/uploads/1' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'

const response = await fetch('https://<your-url>/api/v2/uploads/1', {
  method: 'DELETE',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
  },
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->delete('https://<your-url>/api/v2/uploads/1');

import requests
response = requests.request(
    'DELETE',
    'https://<your-url>/api/v2/uploads/1',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json'},
)

Response

No body.

{
  "type": "https://developers.plnnrly.com/api/v2/problems/state-conflict",
  "title": "State conflict",
  "status": 409,
  "detail": "The target status is not reachable from this work item's current status.",
  "instance": "/api/v2/work-items/812/actions/transition",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "conflict": {
    "reason": "illegal_transition",
    "from_workflow_status_id": 3,
    "to_workflow_status_id": 9
  }
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/precondition-failed",
  "title": "Precondition failed",
  "status": 412,
  "detail": "The record changed since the version named in If-Match. Re-read it and retry.",
  "instance": "/api/v2/work-items/812",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "current_version": 12
}

This is the escape hatch for a ticket whose upload_url leaked, and it is why a 30-minute window is acceptable rather than merely short. A ticket that has already become a file is 409 upload_already_registered: the bytes are an attachment now, and this API does not delete files; remove one in plnnrly. Somebody else's ticket is 404, as is one whose permission family your token does not cover. No domain permission is required. There is no soft delete, no ?force and no restore verb.

Path parameters

uploadintegerRequired

The Upload's numeric id.

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-Matchstring

The ETag a write is conditional on. A stale validator is 412 precondition-failed.

Response 204

Returns no content.

Headers

RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning