> ## Documentation Index > Fetch the complete documentation index at: https://docs.arlohealth.ai/llms.txt > Use this file to discover all available pages before exploring further. # Send media, or get a presigned URL to upload it > Attaches a photo or video to a consultation. Provide the bytes as base64 in `data`, or a publicly reachable HTTPS `url` Arlo downloads server-side, and the media is uploaded and sent for you. Provide neither and the response is a short-lived (~60s) presigned URL to PUT the file to yourself. ## OpenAPI ````yaml /api-reference/openapi.yaml post /api/consultations/{id}/media openapi: 3.1.0 info: title: Arlo Health MCP Server version: 1.0.0 description: | Healthcare infrastructure for AI agents. Everything an agent needs to act in healthcare for its user. ## Overview This server exposes two interfaces: - **MCP** (Model Context Protocol) over streamable HTTP at `/` for AI agents - **REST API** at `/api/*` for bots, skills, and direct HTTP clients Both interfaces use the same tool handlers and authentication. ## Authentication OAuth 2.1 with PKCE. All `/api/*` endpoints require a Bearer token. Discovery endpoints (no auth required): - `/.well-known/oauth-protected-resource` - `/.well-known/oauth-authorization-server` - `/.well-known/mcp.json` (MCP Server Card) ## Service Regions Care is licensed by where the patient is physically located when they request it, so every conversation carries an ISO 3166-2 `region` code. Arlo currently serves California, United States (`US-CA`); an unsupported region is refused with `REGION_NOT_SUPPORTED`, whose payload names the regions Arlo serves at that moment. contact: name: Arlo Health url: https://arlohealth.ai license: name: Proprietary url: https://arlohealth.ai/tos servers: - url: https://mcp.arlohealth.ai description: Production MCP Server security: - oauth2: - openid - profile - email - offline_access tags: - name: Discovery description: MCP and OAuth discovery endpoints (no auth required) - name: Profile description: User profile and patient information - name: Consultations description: Healthcare consultation management - name: Messaging description: Conversation messaging and media - name: Prescriptions description: Prescription and pharmacy management - name: Payment description: Billing and pay-per-use payment management - name: Webhooks description: Webhook registration and status paths: /api/consultations/{id}/media: post: tags: - Messaging summary: Send media, or get a presigned URL to upload it description: > Attaches a photo or video to a consultation. Provide the bytes as base64 in `data`, or a publicly reachable HTTPS `url` Arlo downloads server-side, and the media is uploaded and sent for you. Provide neither and the response is a short-lived (~60s) presigned URL to PUT the file to yourself. operationId: getMediaUploadUrl parameters: - name: id in: path required: true schema: type: string description: Consultation/conversation ID requestBody: required: true content: application/json: schema: type: object required: - type - contentType properties: type: type: string enum: - photo - video description: Media type contentType: type: string description: MIME type (e.g. image/jpeg, video/mp4) data: type: string description: >- Base64-encoded file bytes (no data: URI prefix). Max 8 MB decoded. url: type: string format: uri description: > Alternative to `data`: a public HTTPS URL Arlo downloads the file from. Must need no credentials, must not resolve to a private or reserved address, and must be under 8 MB. Ignored when `data` is set. responses: '200': description: >- Media sent, or a presigned upload URL when neither data nor url was provided content: application/json: schema: type: object properties: sent: type: boolean description: >- True when data or url was provided and the media was delivered mediaSent: type: string enum: - photo - video messageId: type: string description: >- The media message id (pre-assigned on the presign fallback) uploadUrl: type: string format: uri description: >- Presign fallback only. Presigned S3 PUT URL, expires in about 60 seconds uploadRef: type: string nullable: true description: >- Presign fallback only. Short-lived opaque ref for the consultation widget's upload relay mediaType: type: string enum: - photo - video contentType: type: string expiresIn: type: integer description: Presign fallback only. Seconds until uploadUrl expires instructions: type: string '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' components: responses: BadRequest: description: Invalid request content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing or invalid authentication content: application/json: schema: type: object properties: error: type: string needsAuth: type: boolean schemas: Error: type: object description: Error response properties: error: type: string description: Error code reason: type: string description: Human-readable explanation code: type: string description: Detailed error code securitySchemes: oauth2: type: oauth2 description: OAuth 2.1 with PKCE flows: authorizationCode: authorizationUrl: /oauth/authorize tokenUrl: /oauth/token scopes: openid: OpenID Connect profile: User profile email: Email address offline_access: Refresh tokens ````