The API checks file paths and YouTube links when you create an asset

Creating an asset through the API now protects the files on your player: a file path has to point into the asset folder, and a youtube_asset needs a YouTube link. An integration that relied on either may need a change.

July 8, 2026

Anthias 2026.07.1 protects the files on your player when assets are created through the API. We recommend upgrading every player.

The change is to creating an asset with a POST to /api/v1/assets, /api/v1.1/assets, /api/v1.2/assets or /api/v2/assets. Two kinds of request that used to be accepted are now refused:

• A uri that is a file path has to point at a file inside the player's asset folder. A file uploaded through /api/v1/file_asset or /api/v2/file_asset lands there, so uploading a file and then creating the asset from the uri the upload returns works as before.
• An asset whose mimetype is youtube_asset needs a YouTube link as its uri: an http or https address on youtube.com, www.youtube.com, m.youtube.com, music.youtube.com or youtu.be.

A refused request gets a 400 response with the reason under uri, either Invalid file path. Failed to add asset. or A youtube_asset URI must point at a YouTube URL.:

{"uri": ["Invalid file path. Failed to add asset."]}

A uri that isn't a valid address now gets a 400 the same way, with Invalid URL. Failed to add asset. under uri. Before, a file path that didn't exist and an invalid address both got a 500 response with the message under error.

If this affects you: if your integration creates assets from files already on the player, upload each file through file_asset first and create the asset from the uri that comes back. If it sends links that aren't YouTube videos as youtube_asset, send them with the mimetype that matches, such as webpage. If it looks for error in a 500 response to spot a bad address, read uri in the 400 response instead.