# Preview creative assets before uploading

Preview creative assets before permanently uploading them. The endpoint validates
files and metadata and returns the submission shape that `/creative_upload` would
process, without creating creatives.
Creative upload limits:
| Creative upload shape | Limit |
|  --- | --- |
| Plain/non-ZIP uploaded files | 500KB per uploaded file |
| Uploaded ZIP package | 10MB per ZIP file |
| Direct files in the uploaded outer ZIP | 500KB per direct file |
| Assets inside an inner HTML5 package ZIP | 500KB recommended maximum; warning only |
| Uploaded filename form parts | 10 files max |

Send all files in a request with either the `filename` multipart field name
or the legacy `filename[]` multipart field name; do not mix both field names
in the same request. The OpenAPI
`x-max-file-size: 10485760` value is the transport/schema ceiling for uploaded
ZIP parts. Non-ZIP 500KB and direct outer-ZIP file 500KB limits are endpoint
validation rules. Assets inside an inner HTML5 package ZIP over 500KB are
accepted with a `meta.warnings` entry unless the `html5-file-too-large` sub_code
is promoted to an error by configuration. If multiple ZIP files are uploaded,
ZIP structural/content validation preserves the legacy behavior of validating
the first ZIP selected by the request.
Top-level uploads may use image extensions (`.gif`, `.jpg`, `.jpeg`, `.png`,
`.tiff`, `.tif`, `.svg`), the legacy `.swf` extension, loose HTML/CSS/JS/font
extensions (`.html`, `.htm`, `.css`, `.js`, `.woff`, `.woff2`, `.ttf`, `.otf`),
or ZIP packages. ZIP-inner HTML5 assets may use image extensions plus `.html`,
`.htm`, `.css`, `.js`, `.woff`, `.woff2`, `.ttf`, `.otf`, `.mp4`, and `.webm`.
HTML5 packages must use a two-level ZIP structure: the outer ZIP contains one
or more inner ZIP files, each inner ZIP contains the HTML5 creative assets, and
backup images are included in the outer ZIP. Loose files must not be uploaded
alongside an HTML5 ZIP package. Nested ZIPs beyond two levels are rejected.
HTML5 validation errors and warnings use these stable `sub_code` values:
| `sub_code` | Default disposition | Scope | Trigger |
|  --- | --- | --- | --- |
| `html5-missing-click-tracker` | Error | Inner package | No HTML/JS file contains a MediaMath click-tracker macro |
| `html5-noscript-tag` | Warning | Inner package | Root HTML contains a `<noscript>` tag |
| `html5-storage-api` | Warning | Inner package | HTML/JS file uses `localStorage` or `sessionStorage` |
| `html5-external-reference` | Warning | Inner package | Root HTML references an external asset |
| `html5-invalid-filename-chars` | Warning | Inner package | File name contains spaces, non-ASCII, or other non-standard characters |
| `html5-missing-file-extension` | Warning | Inner package | Extensionless file is recognized by content signature or root HTML reference |
| `html5-unsafe-filename-path` | Error | Inner package | File path is absolute, contains `.`/`..`, drive-letter, or UNC path components |
| `html5-filename-too-long` | Error | Inner package | File path exceeds 255 characters |
| `html5-unsupported-file-type` | Error | Outer ZIP and inner package | File extension is not allowed |
| `html5-file-too-large` | Warning | Inner package | Inner package asset exceeds the recommended 500KB maximum |
| `html5-file-too-large` | Error | Outer ZIP direct entry | Direct entry in uploaded outer ZIP exceeds 500KB |
| `html5-file-read-error` | Error | Inner package | Extracted HTML/JS file cannot be read |
| `html5-backup-mismatch` | Warning | HTML5 package auto-discovery | Backup image matches the package name only by letter case |
| `html5-backup-mismatch` | Error | HTML5 package auto-discovery | No backup metadata and no matching backup image exists |
| `html5-backup-mismatch` | Error | HTML5 package manual backup | Specified backup file is absent from the ZIP |
| `html5-invalid-package-structure` | Error | Outer ZIP | HTML appears directly in the outer ZIP |
| `html5-nested-zip-too-deep` | Error | Outer ZIP | ZIP nesting exceeds two levels |
| `html5-separate-files` | Error | Multipart request | Loose files are uploaded alongside an HTML5 ZIP package |
| `html5-submission-name-mismatch` | Error | Outer ZIP (HTML5) | Inner ZIP name is missing from `metadata.submissions[].name` |
| `submission-name-mismatch` | Error | Outer ZIP (non-HTML5) | Plain ZIP file is missing from `metadata.submissions[].name` |
| `zip-too-large` | Error | Uploaded ZIP | Uploaded ZIP exceeds 10MB |
| `html5-validation-error` | Error | Fallback | Internal fallback for an unmapped HTML5 validation rule |

Endpoint: POST /creative_draft
Version: 3.0.1807
Security: Auth0

## Security:

  - `Auth0` (unknown)
    oauth2 scopes: offline_access, manage:services

## Request fields (multipart/form-data):

  - `filename` (array, required)
    Creative files to upload. Send all files in a request as either `filename`
or the legacy `filename[]` field name; do not mix both field names in the
same request.
Loose/non-ZIP uploads are limited to 500KB per file. Uploaded ZIP packages are
limited to 10MB per ZIP. Direct files in the uploaded outer ZIP are limited to
500KB. Assets inside an inner HTML5 package ZIP over 500KB are accepted with a
warning unless the `html5-file-too-large` sub_code is promoted to an error. If
multiple ZIP files are uploaded, ZIP structural/content validation preserves the
legacy behavior of validating the first ZIP selected by the request.

  - `metadata` (object, required)
    JSON metadata for the preview request. `submissions` is optional for draft:
when omitted, the API attempts to infer submission entries from the uploaded
files.

  - `metadata.advertiser_id` (integer, required)
    Example: 123

  - `metadata.is_https` (boolean)

  - `metadata.submissions` (array)
    Optional submission details for uploaded files.

  - `metadata.submissions.name` (string, required)
    The creative file name. For loose/non-ZIP uploads this is the uploaded
filename. For regular ZIPs this is a file inside the ZIP. For HTML5
packages this is the inner ZIP filename, such as `interactive_ad.zip`.
    Example: banner_300x250.jpg

  - `metadata.submissions.click_through_url` (string, required)
    Example: https://example.com/click

  - `metadata.submissions.landing_page` (string)
    Example: https://example.com/landing

  - `metadata.submissions.concept_id` (integer)
    Example: 123

  - `metadata.submissions.backup` (string)
    Optional backup image filename for HTML5 creatives. Backup images must be
inside the HTML5 ZIP package. If omitted, the API attempts to find an
image with the same base filename as the HTML5 package.
    Example: backup_image.jpg

  - `metadata.submissions.mraid_type` (string)
    Optional MRAID type. `expandable` requires the `expandable` image field;
`expandable` must not be supplied for other MRAID types.
    Enum: "static", "expandable", "interstitial"

  - `metadata.submissions.expandable` (string)
    Required when `mraid_type` is `expandable`; otherwise invalid.
    Example: expandable_image.jpg

## Request examples:

  - `Single image preview request` (unknown)

  - `Multiple images preview request` (unknown)

  - `HTML5 creative ZIP preview request` (unknown)

  - `MRAID expandable preview request` (unknown)

## Response 200:

  - `200` (unknown)
    Preview generated successfully

## Response 200 fields (application/json):

  - `data` (object)

  - `data.uploaded_files` (array)

  - `data.uploaded_files.name` (string)

  - `data.metadata` (object)

  - `data.metadata.advertiser_id` (integer)

  - `data.metadata.is_https` (boolean)

  - `data.metadata.submissions` (array)

  - `data.metadata.submissions.name` (string)
    The creative file name. For loose/non-ZIP uploads this is the uploaded
filename. For regular ZIPs this is a file inside the ZIP. For HTML5
packages this is the inner ZIP filename, such as `interactive_ad.zip`.
    Example: banner_300x250.jpg

  - `data.metadata.submissions.click_through_url` (string)
    Example: https://example.com/click

  - `data.metadata.submissions.landing_page` (string)
    Example: https://example.com/landing

  - `data.metadata.submissions.concept_id` (integer)
    Example: 123

  - `data.metadata.submissions.backup` (string)
    Optional backup image filename for HTML5 creatives. Backup images must be
inside the HTML5 ZIP package. If omitted, the API attempts to find an
image with the same base filename as the HTML5 package.
    Example: backup_image.jpg

  - `data.metadata.submissions.mraid_type` (string)
    Optional MRAID type. `expandable` requires the `expandable` image field;
`expandable` must not be supplied for other MRAID types.
    Enum: "static", "expandable", "interstitial"

  - `data.metadata.submissions.expandable` (string)
    Required when `mraid_type` is `expandable`; otherwise invalid.
    Example: expandable_image.jpg

  - `meta` (object)

  - `meta.status` (string, required)
    Example: success

  - `meta.warnings` (array)

  - `meta.warnings.code` (string)
    Example: warning

  - `meta.warnings.sub_code` (string)
    Example: html5-noscript-tag

  - `meta.warnings.message` (string)

  - `meta.warnings.field` (string)

## Response 400:

  - `400` (unknown)
    Bad request

## Response 400 fields (application/json):

  - `errors` (array, required)

  - `errors.code` (string)

  - `errors.sub_code` (string)
    Optional identifier that refines the generic `code` category (e.g. `html5-noscript-tag`). Present on HTML5 upload/preview validation errors; absent otherwise.

  - `errors.field` (string)
    Optional when it is a schema error

  - `errors.message` (string)

  - `meta` (object, required)

  - `meta.status` (string, required)

## Response 401:

  - `401` (unknown)
    Error response

## Response 401 fields (application/json):

  - `errors` (array, required)

  - `errors.code` (string)

  - `errors.sub_code` (string)
    Optional identifier that refines the generic `code` category (e.g. `html5-noscript-tag`). Present on HTML5 upload/preview validation errors; absent otherwise.

  - `errors.field` (string)
    Optional when it is a schema error

  - `errors.message` (string)

  - `meta` (object, required)

  - `meta.status` (string, required)

## Response 403:

  - `403` (unknown)
    Error response

## Response 403 fields (application/json):

  - `errors` (array, required)

  - `errors.code` (string)

  - `errors.sub_code` (string)
    Optional identifier that refines the generic `code` category (e.g. `html5-noscript-tag`). Present on HTML5 upload/preview validation errors; absent otherwise.

  - `errors.field` (string)
    Optional when it is a schema error

  - `errors.message` (string)

  - `meta` (object, required)

  - `meta.status` (string, required)

## Response 200 examples:

  - `Single image preview` (unknown)

  - `HTML5 creative preview with non-blocking warnings` (unknown)

## Response 400 examples:

  - `Loose uploaded file over 500KB` (unknown)

  - `Uploaded ZIP over 10MB` (unknown)

  - `Direct outer-ZIP entry over 500KB` (unknown)

  - `HTML5 package with multiple blocking violations` (unknown)