{"record":{"id":"5dd651bc6f73007a","repo":"payloadcms/payload","slug":"pasting-from-url-is-not-enabled-for-this-collectio","errorCode":null,"errorMessage":"Pasting from URL is not enabled for this collection.","messagePattern":"Pasting from URL is not enabled for this collection\\.","errorType":"http","errorClass":"APIError","httpStatus":400,"severity":"error","filePath":"packages/payload/src/uploads/endpoints/getFileFromURL.ts","lineNumber":27,"sourceCode":"import { safeFetch } from '../safeFetch.js'\n\n// If doc id is provided, it means we are updating the doc\n// /:collectionSlug/paste-url/:doc-id?src=:fileUrl\n\n// If doc id is not provided, it means we are creating a new doc\n// /:collectionSlug/paste-url?src=:fileUrl\n\nexport const getFileFromURLHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { optionalID: true })\n\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const config = collection?.config\n\n  if (!config.upload?.pasteURL) {\n    throw new APIError('Pasting from URL is not enabled for this collection.', 400)\n  }\n\n  if (id) {\n    // updating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access.update)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  } else {\n    // creating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access?.create)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  if (!req.url) {\n    throw new APIError('Request URL is missing.', 400)","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/uploads/endpoints/getFileFromURL.ts#L9-L45","documentation":"APIError (HTTP 400) thrown when the target collection's config.upload.pasteURL is falsy. The paste-from-URL feature is opt-in per collection; if not configured the endpoint refuses before any network call.","triggerScenarios":"Hitting /api/:collection/paste-url on a collection whose upload block doesn't define `pasteURL` (or sets it to false). Even an otherwise-valid upload collection without pasteURL enabled will trigger this.","commonSituations":"Frontend 'paste image from URL' button wired to a collection that wasn't configured for it; copy-pasting a collection config and forgetting the pasteURL key; expecting pasteURL to default on.","solutions":["Enable pasteURL on the collection: add `pasteURL: { allowList: [...] }` (or `pasteURL: true`) to the upload config.","If you don't want this feature, remove/disable the UI button that calls the endpoint.","Confirm you're targeting the right collection slug — the configured one is the only one that works."],"exampleFix":"// before\nupload: { staticDir: 'media', mimeTypes: ['image/*'] }\n// after — enable paste-from-URL with an allow list\nupload: {\n  staticDir: 'media',\n  mimeTypes: ['image/*'],\n  pasteURL: { allowList: [{ hostname: 'cdn.example.com', protocol: 'https' }] },\n}","handlingStrategy":"type-guard","validationCode":"function pasteUrlEnabled(cfg: { upload?: { pasteURL?: unknown } }): boolean {\n  return Boolean(cfg?.upload?.pasteURL)\n}\nif (!pasteUrlEnabled(collectionConfig)) disablePasteUrlButton()","typeGuard":"const collectionSupportsPasteUrl = (c: { upload?: { pasteURL?: unknown } }): boolean =>\n  Boolean(c?.upload && c.upload.pasteURL)","tryCatchPattern":"try {\n  await fetch(`/api/${slug}/paste-url?src=${encodeURIComponent(src)}`, { method: 'POST' })\n} catch (e) {\n  if (/Pasting from URL is not enabled/.test(e.message)) disablePasteUrlButton()\n}","preventionTips":["Reflect pasteURL capability in your collection schema metadata so the UI can adapt.","Keep pasteURL config consistent across environments.","Document which collections support paste-URL.","Gate the UI button on a feature flag derived from server config."],"tags":["upload","config","paste-url"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}