---
type: api
title: Upload a source map
description: Upload a source map for a specific service and version. You must have `all` Kibana privileges for the APM and User Experience feature.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-uploadsourcemap
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-uploadsourcemap
products:
  - Kibana
---

# Upload a source map

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/apm/sourcemaps`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

## Description

Upload a source map for a specific service and version. You must have `all` Kibana privileges for the APM and User Experience feature.
The maximum payload size is `1mb`. If you attempt to upload a source map that exceeds the maximum payload size, you will get a 413 error. Before uploading source maps that exceed this default, change the maximum payload size allowed by Kibana with the `server.maxPayload` variable.

## Request Body

`multipart/form-data`

- `bundle_filepath` (string) — required
  The absolute path of the final bundle as used in the web application.
- `service_name` (string) — required
  The name of the service that the service map should apply to.
- `service_version` (string) — required
  The version of the service that the service map should apply to.
- `sourcemap` (string) — required
  The source map. It can be a string or file upload. It must follow the
[source map format specification](https://tc39.es/ecma426/).

## Responses

#### `200`

Successful response

`application/json`

- `body` (string)
- `compressionAlgorithm` (string)
  Compression Algorithm
- `created` (string)
  Created date
- `decodedSha256` (string)
  Decoded SHA-256
- `decodedSize` (number)
  Decoded size
- `encodedSha256` (string)
  Encoded SHA-256
- `encodedSize` (number)
  Encoded size
- `encryptionAlgorithm` (string)
  Encryption Algorithm
- `id` (string)
  Identifier
- `identifier` (string)
  Identifier
- `packageName` (string)
  Package name
- `relative_url` (string)
  Relative URL
- `type` (string)
  Type
#### `400`

Bad Request response

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Error message
- `statusCode` (number)
  Error status code
#### `401`

Unauthorized response

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Error message
- `statusCode` (number)
  Error status code
#### `403`

Forbidden response

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Error message
- `statusCode` (number)
  Error status code
#### `500`

Internal Server Error response

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Error message
- `statusCode` (number)
  Error status code
#### `501`

Not Implemented response

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Error message
- `statusCode` (number)
  Error status code
## Code Examples

#### curl

```curl
curl -X POST "http://localhost:5601/api/apm/sourcemaps" \
-H 'Content-Type: multipart/form-data' \
-H 'kbn-xsrf: true' \
-H 'Authorization: ApiKey ${YOUR_API_KEY}' \
-F 'service_name="foo"' \
-F 'service_version="1.0.0"' \
-F 'bundle_filepath="/test/e2e/general-usecase/bundle.js"' \
-F 'sourcemap="{\"version\":3,\"file\":\"static/js/main.chunk.js\",\"sources\":[\"fleet-source-map-client/src/index.css\",\"fleet-source-map-client/src/App.js\",\"webpack:///./src/index.css?bb0a\",\"fleet-source-map-client/src/index.js\",\"fleet-source-map-client/src/reportWebVitals.js\"],\"sourcesContent\":[\"content\"],\"mappings\":\"mapping\",\"sourceRoot\":\"\"}"'
```

## Request Examples

#### Upload source map

An example of a multipart/form-data request body for `POST /api/apm/sourcemaps`.
Each field is a separate form part; `sourcemap` is the source map file content (typically uploaded as a file).

```json
{
  "bundle_filepath": "/test/e2e/general-usecase/bundle.js.map",
  "service_name": "opbeans-node",
  "service_version": "1.0.0",
  "sourcemap": "{\u0022version\u0022:3,\u0022sources\u0022:[\u0022bundle.js\u0022],\u0022names\u0022:[],\u0022mappings\u0022:\u0022AAAA\u0022,\u0022file\u0022:\u0022bundle.js\u0022,\u0022sourcesContent\u0022:[\u0022console.log(\u0027hello\u0027);\u0022]}"
}
```

## Response Examples

#### Upload source map response1

A successful response from `POST /api/apm/sourcemaps`.

```json
{
  "body": "eJyFkL1OwzAUhd/Fc\u002BMbYMuCEBIbHRjKgBgc96R16tiWr1OQqr47NwqJxEK3q/PzWccXxchnZ7E1A1SjuhjVZtF2yOxiEPlO17oWox3D3uPFeSRTjmJQARfCPeiAgGx8NTKsYdAc1T3rwaSJGcds8Sp3c1HnhfywUZ3QhMTFFGepZxqMC9oex3CS9tpk1XyozgOlmoVKuJX1DqEQZ0su7PGtLU\u002BV/3JPKc3cL7TJ2FNDRPov4bFta3MDM4f7W69lpJjLO9qdK8bzVPhcJz3HUCQ4LbO/p5hCSC4cZPByrp/wFqOklbpefwAhzpqI",
  "compressionAlgorithm": "zlib",
  "created": "2021-07-09T20:47:44.812Z",
  "decodedSha256": "644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
  "decodedSize": 441,
  "encodedSha256": "024c72749c3e3dd411b103f7040ae62633558608f480bce4b108cf5b2275bd24",
  "encodedSize": 237,
  "encryptionAlgorithm": "none",
  "id": "apm:foo-1.0.0-644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
  "identifier": "foo-1.0.0",
  "packageName": "apm",
  "relative_url": "/api/fleet/artifacts/foo-1.0.0/644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
  "type": "sourcemap"
}
```

#### Bad request

An example of a 400 Bad Request response, returned when the request payload or query parameters fail validation.

```json
{
  "error": "Bad Request",
  "message": "[request body]: expected value of type [string] but got [undefined]",
  "statusCode": 400
}
```

#### Unauthorized

An example of a 401 Unauthorized response, returned when the request is missing valid authentication credentials.

```json
{
  "error": "Unauthorized",
  "message": "[security_exception]: missing authentication credentials for REST request",
  "statusCode": 401
}
```

#### Forbidden

An example of a 403 Forbidden response, returned when the authenticated user lacks the required APM and User Experience privileges.

```json
{
  "error": "Forbidden",
  "message": "Insufficient privileges to perform this action. The APM and User Experience feature requires \u0060all\u0060 privileges.",
  "statusCode": 403
}
```

#### Internal server error

An example of a 500 Internal Server Error response, returned when an unexpected error occurs while processing the request.

```json
{
  "error": "Internal Server Error",
  "message": "An internal server error occurred. Check the Kibana server logs for details.",
  "statusCode": 500
}
```

#### Not implemented

An example of a 501 Not Implemented response, returned when the source map feature is not available on the current deployment.

```json
{
  "error": "Not Implemented",
  "message": "Not Implemented",
  "statusCode": 501
}
```