If your integration gets a 403 Forbidden response on a POST or PUT request to the MediaLab API, while GET requests such as /api/user/info work fine, the request body is most likely sent as multipart/form-data.

For security reasons, MediaLab only accepts multipart/form-data requests on the dedicated upload endpoints. Regular API calls, including POST /api/upload/id, must send their parameters as application/x-www-form-urlencoded. A multipart request to a regular API endpoint is rejected before it reaches the API, so you get a plain 403 page instead of a JSON error.

Why this happens

Many HTTP clients use multipart/form-data by default when you add body fields:

• Postman – the form-data body option.
• curl – the -F / --form option.
• JavaScript – passing a FormData object to fetch or XMLHttpRequest.
• PHP / Guzzle – the multipart request option.

None of the regular API endpoints need multipart. Creating an upload with POST /api/upload/id only sends parameters such as folder_id and autofinish. The file itself is uploaded afterwards to the upload URLs returned in the response.

How to Resolve

Send the same parameters as application/x-www-form-urlencoded:

• Postman – change the body type from form-data to x-www-form-urlencoded. You can keep the same keys and values.
• curl – use -d / --data instead of -F:

curl -X POST https://<your-medialab-domain>/api/upload/id \
  -H "Authorization: Bearer <access_token>" \
  -d folder_id=1234 \
  -d autofinish=false

• JavaScript – use URLSearchParams instead of FormData:

await fetch('https://<your-medialab-domain>/api/upload/id', {
  method: 'POST',
  headers: { Authorization: 'Bearer <access_token>' },
  body: new URLSearchParams({ folder_id: '1234', autofinish: 'false' }),
})

• PHP / Guzzle – use the form_params request option instead of multipart.

After this change, the request reaches the API and you get a normal JSON response. If you still get a 403 after switching to x-www-form-urlencoded, please contact MediaLab's service desk and include the endpoint, the time of the request and the response you received.