finalizePackageUpload

POST /api/v1/review-packages/uploads/{uploadId}/finalize

Actor/workspace-bound private byte transfer. Completed upload bundles are not published packages. Chunk offsets use a fixed 4 MiB grid; exact retries preserve the original bytes. Current membership and credential scope are checked on every operation. No content or Blob credentials are served by these routes.

Access

Use a credential with commentary.review_packages.write.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. Set up developer access.

Parameters

Name	Location	Type	Required	Description
`uploadId`	path	string	Yes
`Idempotency-Key`	header	string	Yes

Request body

Optional. Supported content types: application/json.

Field	Type	Required	Description

Call the endpoint

Replace path placeholders and your credential. For body operations, create request.json using the required fields above; this command does not invent resource identifiers or consent.

curl --request POST \
  'https://commentary.dev/api/v1/review-packages/uploads/<uploadId>/finalize' \
  --header 'Authorization: Bearer <your-token>' \
  --header 'Content-Type: application/json' \
  --data-binary @request.json

Responses

Status	Meaning	Payload
`200`	Private upload status or immutable package revision result.	ProjectAgentfinalizePackageUploadOutput
`400`	Invalid manifest/chunk/checksum or missing retry key.	See response headers or body contract
`401`	Authentication required.	See response headers or body contract
`403`	Current actor/workspace/grant access denied.	See response headers or body contract
`409`	Expired/canceled upload, missing chunks, or conflicting retry.	See response headers or body contract
`413`	Actual request bytes exceed the bound.	See response headers or body contract
`429`	Rate limit exceeded.	See response headers or body contract

Successful response fields

Field	Type	Required	Description
`data`	ProjectAgentUploadBundle	Yes
`idempotencyReplayed`	boolean	No

Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

Operation ID: finalizePackageUpload. Download the OpenAPI contract for complete constraints and code generation. Browse endpoints.