> ## Documentation Index > Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt > Use this file to discover all available pages before exploring further. # Upload skill > Upload a skill archive (.skill/.zip/.tar.gz/.tgz) to create or replace a skill. ## Restrictions | Aspect | Value | | ----------- | --------------------------------------------------------- | | Rate limits | **30 requests/minute**; **3 requests/second** per account | | Permissions | **Skill Manage** (`ai-sre`) | ## Usage * Send as `multipart/form-data` with a `file` part. Max archive size is 100MB. * Set `replace=true` to overwrite an existing same-name skill. * Every call is recorded in the account audit log. ## OpenAPI ````yaml /api-reference/safari.openapi.en.json post /safari/skill/upload openapi: 3.1.0 info: title: Flashduty Open API description: >- Public HTTP API for the Flashduty AI SRE platform — skills, MCP servers (connectors), A2A agents, and sessions. Every operation is authenticated with an `app_key` query parameter issued from the Flashduty console. version: 1.0.0 servers: - url: https://api.flashcat.cloud description: Flashduty Open API security: - AppKeyAuth: [] tags: - name: AI SRE/Skills - name: AI SRE/MCP servers - name: AI SRE/A2A agents - name: AI SRE/Sessions - name: AI SRE/Automations paths: /safari/skill/upload: post: tags: - AI SRE/Skills summary: Upload skill description: >- Upload a skill archive (.skill/.zip/.tar.gz/.tgz) to create or replace a skill. operationId: skill-write-upload requestBody: required: true content: multipart/form-data: schema: $ref: '#/components/schemas/SkillUploadRequest' example: team_id: 0 replace: false responses: '200': description: Success content: application/json: schema: allOf: - $ref: '#/components/schemas/ResponseEnvelope' - type: object properties: data: $ref: '#/components/schemas/SkillItem' example: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: skill_id: skill_8s7Hn2kLpQ3xYbVc4Wd2m account_id: 10023 team_id: 0 skill_name: k8s-triage description: >- Diagnose unhealthy Kubernetes workloads from cluster events and pod logs. version: 1.2.0 tags: - kubernetes - triage author: sre-team tools: - bash - mcp:prometheus/query status: enabled created_by: 80011 created_at: 1716960000000 updated_at: 1717046400000 can_edit: true update_available: false is_modified: false created: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/ServerError' security: - AppKeyAuth: [] components: schemas: SkillUploadRequest: type: object description: Multipart form for uploading a skill archive. properties: file: type: string format: binary description: Skill archive (.skill / .zip / .tar.gz / .tgz). Max 100MB. team_id: type: integer description: 'Team scope for the new skill: 0 = account-wide.' format: int64 replace: type: boolean description: When true, overwrite an existing same-name skill. skill_id: type: string description: When replacing a specific skill, its skill ID. required: - file ResponseEnvelope: type: object description: >- Standard response envelope used by every Flashduty public API. On success `data` contains the endpoint-specific payload and `error` is absent. On failure `error` is present and `data` is absent. `request_id` is always present and is also mirrored in the `Flashcat-Request-Id` response header. properties: request_id: type: string description: >- Unique ID for this request. Mirrored in the Flashcat-Request-Id header. Include it when reporting issues. example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: $ref: '#/components/schemas/DutyError' data: description: Endpoint-specific payload. See each operation's 200 response schema. required: - request_id SkillItem: type: object description: An AI SRE skill — a packaged SKILL.md bundle the agent can load. properties: skill_id: type: string description: Unique skill ID (prefix `skill_`). account_id: type: integer description: Owning account ID. format: int64 team_id: type: integer description: 'Team scope: 0 = account-wide; >0 = the owning team.' format: int64 skill_name: type: string description: Skill name, unique within the account. description: type: string description: Human-readable description from the SKILL.md frontmatter. content: type: string description: Full SKILL.md content. Omitted in list responses. version: type: string description: Skill version from the frontmatter. tags: type: array items: type: string description: Tags parsed from the frontmatter. author: type: string description: Skill author. license: type: string description: Skill license. tools: type: array items: type: string description: Required tools (builtin or `mcp:server/tool`). s3_key: type: string description: Object-storage key of the skill zip. checksum: type: string description: SHA-256 checksum of the skill zip. status: type: string description: Skill status. enum: - enabled - disabled created_by: type: integer description: Member ID that created the skill. format: int64 created_at: type: integer format: int64 description: Creation time. Unix timestamp in milliseconds. updated_at: type: integer format: int64 description: Last update time. Unix timestamp in milliseconds. can_edit: type: boolean description: Whether the caller may edit this skill. source_template_name: type: string description: >- Marketplace template this skill was installed from; empty for user-authored. source_template_version: type: string description: Template version at install time. update_available: type: boolean description: True when the marketplace has a newer template version. is_modified: type: boolean description: >- True when a marketplace-sourced skill was edited locally (auto-update skips it). created: type: boolean description: >- Set only on install-from-session responses: true = fresh install, false = in-place update. required: - skill_id - account_id - team_id - skill_name - description - status - created_by - created_at - updated_at - can_edit - update_available - is_modified DutyError: type: object description: >- Error payload inside the response envelope. Present only on non-2xx responses. properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string description: >- Human-readable error message, localized by the caller's Accept-Language. May contain field names, IDs, or other context from the failing request. required: - code - message ErrorResponse: type: object description: Response envelope for errors. `error` is required; `data` is absent. properties: request_id: type: string example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: $ref: '#/components/schemas/DutyError' required: - request_id - error ErrorCode: type: string description: >- Flashduty error code enum. Every failed API response sets `error.code` to one of these values. The value is a stable wire string — not a localized message and not a numeric status. HTTP status is informational. enum: - OK - InvalidParameter - BadRequest - InvalidContentType - ResourceNotFound - NoLicense - ReferenceExist - Unauthorized - BalanceNotEnough - AccessDenied - RouteNotFound - MethodNotAllowed - UndonedOrderExist - RequestLocked - EntityTooLarge - RequestTooFrequently - RequestVerifyRequired - DangerousOperation - InternalError - ServiceUnavailable responses: BadRequest: description: Invalid request — usually a missing or malformed parameter. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingParameter: summary: Missing required parameter value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InvalidParameter message: The specified parameter skill_id is not valid. Unauthorized: description: Missing or invalid app_key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingAppKey: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: Unauthorized message: You are unauthorized. Forbidden: description: The app_key is valid but lacks permission for this operation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: accessDenied: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: AccessDenied message: Access Denied. TooManyRequests: description: Rate limit hit. Either the global API limit or a per-account limit. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: rateLimited: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: RequestTooFrequently message: Request too frequently. ServerError: description: Unexpected server-side error. Include the request_id when reporting. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InternalError message: >- We encountered an internal error, and it has been reported. Please try again later. securitySchemes: AppKeyAuth: type: apiKey in: query name: app_key description: >- App key issued from the Flashduty console. Required on every public API call. Keep it secret — it grants the same access as the owning account. ````