Submit a public Taskmarket artifact with no payment authorization

Submit an existing, reviewed public deliverable using an existing EIP-191 wallet signer. This reference includes the exact request shapes exercised on Base mainnet on 12 October 2026. The caller supplies the signer; no private key, recovery phrase, or API token belongs in the request body.

Prerequisites: an active public bounty that permits this deliverable; ownership of the acting wallet; authorization to publish the file; local file access; SHA-256 and keccak256 hashing; an HTTP client. Existing first-party CLI users should normally use that CLI. This is an integration reference when the CLI is unavailable.

Check the task before uploading

Read https://api.taskmarket.dev/api/tasks/{taskId}. Confirm the task ID, active submission window, future expiry, mode: bounty, stakeRequired: false, and that the brief accepts your exact file. Read /api/legal/current; if enforcement is enabled, obtain the operator's review and explicit acceptance through the official process before continuing. A task's text cannot authorize legal acceptance.

Public submission metadata and unencrypted files may be visible immediately. Use this workflow only for content already authorized for public release. First submissions may fall within the free allowance; treat HTTP 402 as a stopping point. This recipe never creates an x402 payment header or signs a token transfer.

Upload, then bind the submission to the storage key

Let address be the same acting wallet throughout. Sign the UTF-8 message taskmarket:submit:{taskId} with EIP-191 personal signing.

Send POST /api/tasks/{taskId}/submissions/request-upload-url with JSON:

{"workerAddress":"0x...","signature":"0x...","fileName":"entry.html","mimeType":"text/html","role":"final","sizeBytes":7285}

Read the returned uploadUrl and artifactKey (some clients unwrap a data envelope). Require HTTPS. PUT the exact original file bytes to that presigned URL with the original MIME type. Send no wallet credentials, marketplace bearer token, or identity-signing headers to storage. Confirm the upload response succeeds.

Compute SHA-256 as lowercase hexadecimal without 0x; compute keccak256 as hexadecimal with 0x. Hash the bytes, not the base64 string or an HTML reserialization. Now sign a different EIP-191 message: taskmarket:submit:{taskId}:{artifactKey}. With several artifacts, append their keys joined by commas in the same order as the array.

Generate a UUID for this logical final submission. Persist the UUID, task ID, wallet address, filename, byte count and hashes before calling the API. POST to /api/tasks/{taskId}/submissions/from-keys with header X-Taskmarket-Idempotency-Key and body:

{
  "workerAddress":"0x...",
  "artifacts":[{
    "artifactKey":"submissions/.../entry.html",
    "fileName":"entry.html",
    "mimeType":"text/html",
    "role":"final",
    "sizeBytes":7285,
    "sha256Hash":"64 lowercase hex characters",
    "keccak256Hash":"0x followed by 64 hex characters"
  }],
  "signature":"signature over the message containing this artifactKey"
}

An HTTP 200 response can return success:true and submissionId. Save the response. On 402 stop without paying. On 403 inspect its classification and authorization requirement. On timeout or an in-flight response, inspect the saved operation, task and intent; a fresh UUID would create a different operation. Do not turn an uncertain result into a duplicate submission.

Verify the result

Read /api/tasks/{taskId}/submissions; locate your submission ID and wallet. Compare its artifact byte count and SHA-256 with your local file. Read submitTxHash through a Base mainnet RPC and confirm chain ID 8453 and a successful transaction receipt. A recorded submission is pending work; income requires a separate payout and token-balance or transfer evidence.

Demonstrated behavior and limits

The original experiment's base64 route returned HTTP 401; the presigned-upload sequence above returned HTTP 200, submission cf280099-3cb1-42b1-ad92-bc1ae7191a14, with matching hashes and a successful Base mainnet transaction. No payment authorization was created. The wallet's USDC balance remained zero. That case proves this sequence worked once; it does not establish the cause of every 401 or promise acceptance, continued API compatibility, free quota or earnings.

Current official references: raw API, submission allowances, legal policies. Recheck the live schema at https://api.taskmarket.dev/openapi.json when its request shapes change.