{"record":{"id":"bd2cf3f682f79085","repo":"payloadcms/payload","slug":"uploading-files-from-urls-is-disabled-for-collecti","errorCode":null,"errorMessage":"Uploading files from URLs is disabled for collection \"${collectionSlug}\".","messagePattern":"Uploading files from URLs is disabled for collection \"(.+?)\"\\.","errorType":"validation","errorClass":"APIError","httpStatus":400,"severity":"error","filePath":"packages/plugin-mcp/src/mcp/builtin/collections/fileInput.ts","lineNumber":90,"sourceCode":"  if (!uploadConfig) {\n    throw new APIError(`Collection \"${collectionSlug}\" does not support file uploads.`, 400)\n  }\n\n  const maxFileSize = req.payload.config.upload.limits?.fileSize\n  let file: File\n\n  if (input.source === 'base64') {\n    const data = decodeBase64({ maxFileSize, value: input.data })\n\n    file = {\n      name: sanitizeFilename(input.name),\n      data,\n      mimetype: input.mimeType,\n      size: data.length,\n    }\n  } else {\n    if (uploadConfig.pasteURL === false) {\n      throw new APIError(\n        `Uploading files from URLs is disabled for collection \"${collectionSlug}\".`,\n        400,\n      )\n    }\n\n    const url = new URL(input.url)\n\n    if (!['http:', 'https:'].includes(url.protocol)) {\n      throw new APIError('File URLs must use http or https.', 400)\n    }\n\n    if (\n      typeof uploadConfig.pasteURL === 'object' &&\n      !isURLAllowed(input.url, uploadConfig.pasteURL.allowList)\n    ) {\n      throw new APIError('The provided file URL is not allowed.', 400)\n    }\n","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/plugin-mcp/src/mcp/builtin/collections/fileInput.ts#L72-L108","documentation":"Thrown as a 400 when the caller uses `source: 'externalURL'` but the collection's upload config explicitly disables URL pasting via `pasteURL: false`. It is a deliberate guard — the operator has opted out of remote-URL ingestion for this collection.","triggerScenarios":"An MCP upload tool call with `source: 'externalURL'` against a collection whose `upload.pasteURL === false`; an environment where paste-from-URL was turned off for security but a client still tries the externalURL source.","commonSituations":"Compliance/security hardening that disabled `pasteURL`; copying a tool invocation that worked on a different (pasteURL-enabled) collection; misreading `pasteURL: false` as the default.","solutions":["Switch the tool call to `source: 'base64'` (download the URL server-side yourself, then pass the bytes)","If remote-URL ingestion is intended for this collection, set `upload.pasteURL` to `true` or to an `{ allowList }` object","Use `source: 'uploadReference'` after a normal staged upload"],"exampleFix":"// before — collection has pasteURL disabled\nupload: { staticURL: '/media', pasteURL: false }\n// after — re-enable with an allowlist\nupload: { staticURL: '/media', pasteURL: { allowList: ['https://cdn.example.com'] } }","handlingStrategy":"validation","validationCode":"// Check the collection's pasteURL setting before using externalURL\nconst cfg = payload.config.collections.find(c => c.slug === slug)?.upload\nif (cfg?.pasteURL === false) throw new Error(`${slug} has pasteURL disabled — use base64`)","typeGuard":null,"tryCatchPattern":"import { APIError } from 'payload'\ntry {\n  await tool.call({ source: 'externalURL', url })\n} catch (e) {\n  if (e instanceof APIError && e.statusCode === 400 && /Uploading files from URLs is disabled/.test(e.message)) {\n    // fall back to fetching then base64\n    const buf = Buffer.from(await (await fetch(url)).arrayBuffer())\n    return tool.call({ source: 'base64', name, mimeType, data: buf.toString('base64') })\n  }\n  throw e\n}","preventionTips":["Inspect each upload collection's `pasteURL` setting before offering an externalURL option in the UI","When in doubt, prefer base64 for small files — it bypasses the pasteURL gate entirely","Document per-collection whether paste-from-URL is enabled so clients choose the right source"],"tags":["mcp","file-upload","paste-url","configuration","security"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}