payloadcms/payload · error · APIError

Pasting from URL is not enabled for this collection.

Error message

Pasting from URL is not enabled for this collection.

What it means

APIError (HTTP 400) thrown when the target collection's config.upload.pasteURL is falsy. The paste-from-URL feature is opt-in per collection; if not configured the endpoint refuses before any network call.

Source

Thrown at packages/payload/src/uploads/endpoints/getFileFromURL.ts:27

import { safeFetch } from '../safeFetch.js'

// If doc id is provided, it means we are updating the doc
// /:collectionSlug/paste-url/:doc-id?src=:fileUrl

// If doc id is not provided, it means we are creating a new doc
// /:collectionSlug/paste-url?src=:fileUrl

export const getFileFromURLHandler: PayloadHandler = async (req) => {
  const { id, collection } = getRequestCollectionWithID(req, { optionalID: true })

  if (!req.user) {
    throw new Forbidden(req.t)
  }

  const config = collection?.config

  if (!config.upload?.pasteURL) {
    throw new APIError('Pasting from URL is not enabled for this collection.', 400)
  }

  if (id) {
    // updating doc
    const accessResult = await executeAccess({ slug: config.slug, req }, config.access.update)
    if (!accessResult) {
      throw new Forbidden(req.t)
    }
  } else {
    // creating doc
    const accessResult = await executeAccess({ slug: config.slug, req }, config.access?.create)
    if (!accessResult) {
      throw new Forbidden(req.t)
    }
  }

  if (!req.url) {
    throw new APIError('Request URL is missing.', 400)

View on GitHub (pinned to 00c58b35c0)

Solutions

1. Enable pasteURL on the collection: add `pasteURL: { allowList: [...] }` (or `pasteURL: true`) to the upload config.
2. If you don't want this feature, remove/disable the UI button that calls the endpoint.
3. Confirm you're targeting the right collection slug — the configured one is the only one that works.

Example fix

// before
upload: { staticDir: 'media', mimeTypes: ['image/*'] }
// after — enable paste-from-URL with an allow list
upload: {
  staticDir: 'media',
  mimeTypes: ['image/*'],
  pasteURL: { allowList: [{ hostname: 'cdn.example.com', protocol: 'https' }] },
}

function pasteUrlEnabled(cfg: { upload?: { pasteURL?: unknown } }): boolean {
  return Boolean(cfg?.upload?.pasteURL)
}
if (!pasteUrlEnabled(collectionConfig)) disablePasteUrlButton()

const collectionSupportsPasteUrl = (c: { upload?: { pasteURL?: unknown } }): boolean =>
  Boolean(c?.upload && c.upload.pasteURL)

try {
  await fetch(`/api/${slug}/paste-url?src=${encodeURIComponent(src)}`, { method: 'POST' })
} catch (e) {
  if (/Pasting from URL is not enabled/.test(e.message)) disablePasteUrlButton()
}

When it happens

Trigger: Hitting /api/:collection/paste-url on a collection whose upload block doesn't define `pasteURL` (or sets it to false). Even an otherwise-valid upload collection without pasteURL enabled will trigger this.

Common situations: Frontend 'paste image from URL' button wired to a collection that wasn't configured for it; copy-pasting a collection config and forgetting the pasteURL key; expecting pasteURL to default on.

Related errors

• storage contains an invalid entry: expected an object with a
• Field ${field.label} has reserved name '${fieldName}'.
• Field "${field.name}" of type "${field.type}" has an empty r
• Field ${field.label} has invalid relationship '${relationshi
• File type '${file.mimetype}' is not allowed.

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/5dd651bc6f73007a. Report an issue: GitHub.