File upload REST API - not authorized - have auth token and can send message via API


Trying to test a Room REST API.
One for uploading a file with a message.
Using postman to test.
This one specifically

I used the login api to get an Authtoken
Also tried creating a personal access token through the client

I am able to send a message to a channel via API, and update a channel announcement, but when I try and send a file it throws an error about not being authorized.

I’ve looked at the permissions section in the docs, and can only see one permission related to file upload but that is for mobile.

Any advice would be welcome.

Kind regards,


Server Setup Information

  • Version of Rocket.Chat Server: 3.4.0
  • Operating System: Windows/linux


First, your server version is a little bit old. You should consider upgrading it to a newer version, due to some security patches that was rolled out.

Were you able to upload a file using the example call on the documentation you linked? Also, on newer versions, the user uploading the file must have appropriate permission and also be at the channel you want to send.

So if you have a private channel and the user that owns the PAT (personal access token) issuing the payload isn’t on that private channel, you will not have permission to upload the file.

Unfortunately I don’t have control of the version.
I was not able to upload a file using the example curl, to a public channel that I created and am the only member of.

$ curl "https://****/api/v1/rooms.upload/jason-channel-test" \
>     -F file=@$HOME/Documents/rocket-test/rocket_test.txt \
>     -F "msg=This is a message with a file" \
>     -F "description=Simple text file" \
>     -H "X-Auth-Token: ****" \
>     -H "X-User-Id: ****"

Which permission do you mean precisely? As I mentioned I only see one permission related to file update, and that specifies it’s for mobile.



Can you try this example call against our open server?