Viralz MCP reference

Start here

Connect it to Claude Code in one command.

The easy path: paste one command, a browser window opens, you click approve, and the tools appear. No passwords or keys to copy. The token variant further down is only for a tool that cannot open that approval window.

Endpoint	Toolset	What you get
https://viralzbackend-production.up.railway.app/api/mcp/core	Core toolset	The curated set, and the one to point a client at first. Everything you need to write, preview, schedule, publish and cancel a LinkedIn post is in here. Add ?tools=full to the same URL to get the full set instead.
https://viralzbackend-production.up.railway.app/api/mcp/mcp	Full toolset	Every tool on every enabled track. Today that is the core set plus whatever the brand.md and research flags expose — see Tracks under Tools. Same auth, same transport.

# 1. Add the server. This is the whole install.

claude mcp add --transport http viralz https://viralzbackend-production.up.railway.app/api/mcp/core

# Claude Code registers itself and opens a browser to authorize.

# If it does not, or you added it earlier, run:

claude mcp login viralz

# 2. Or, for a client that cannot do OAuth, paste a token instead.

# Mint a vir_ token on the Connect screen at /console.

claude mcp add --transport http viralz https://viralzbackend-production.up.railway.app/api/mcp/core \

--header "Authorization: Bearer $VIRALZ_MCP_TOKEN"

# 3. Confirm it came up. `list` health-checks every server.

claude mcp list

claude mcp get viralz

# Want everything instead of the curated set? Use the full endpoint:

claude mcp add --transport http viralz https://viralzbackend-production.up.railway.app/api/mcp/mcp

Add the server

One command, nothing to configure. The --transport http part is required — without it the connection will not start. “viralz” is just the name it gets on your machine; call it what you like.

Approve in the browser

Claude Code opens a browser window where you approve the connection — much like signing in with Google. Nobody copies a password or key. If your tool cannot open that window, create a vir_ token on the Connect screen at /console and add it with --header instead.

Check it connected

claude mcp list checks every connection and shows viralz as connected; claude mcp get viralz shows what was stored. If it says pending or failing, walk through the Troubleshooting section below.

Preview a post first

Ask your assistant to preview a post before anything else. A preview is free, changes nothing, and shows which LinkedIn account the post would land on — proof the whole connection works. It is also required: publishing and scheduling both refuse without the confirmation a preview returns.

Any other MCP client

Other tools — Codex, Cursor, Claude Desktop, your own setup — connect to the same address. The Connect screen at /console shows the exact setup block for each of them, and creates tokens for the ones that need one.

What it does

One door, and it is open.

Point your AI assistant at Viralz and it can preview, publish and schedule LinkedIn posts on the account you connected — with text, an image, an animated GIF or a video. Everything below is something it can do today; nothing on this page is a promise.

Post text to LinkedIn immediately — text on its own is a complete post.
Schedule a post for a future time, in any timezone.
Attach one image — PNG, JPEG, WebP or GIF.
Post an animated GIF, and it stays animated.
Attach a video — MP4, MOV or WebM — to a post now or to a scheduled one.
Preview first: see which LinkedIn account it would land on before anything is sent.
List everything queued, and cancel a scheduled post while it is still pending.
Read the account's Viralz token balance, what each action costs, and the recent statement.
Build and store a brand.md from a website, and read, edit or delete it later — brand.md track.
Build 1080x1350 infographic and slider templates in that brand's colours and fonts, and fetch the material for a signature and CTA — brand.md track.

POST /api/mcp/mcp

Full endpoint

POST /api/mcp/core

Core endpoint

JSON-RPC 2.0 over Streamable HTTP

Transport

Other clients

No secret to paste, unless you want to.

Most tools connect without you ever touching a password or key: they open a browser window, you approve, done. Point Claude Code, Codex, Cursor or any compatible tool at the address and let it set itself up.

Point your client at the address

Use /api/mcp/core for the everyday set, or /api/mcp/mcp for everything. The Connect screen at /console shows the live tool count for your account.

Approve in the browser

The tool registers itself and asks you to approve the connection in a browser window — no password or key changes hands.

Or paste a token

For a tool that cannot open a browser, create a vir_ token on the Connect screen and paste it where that tool asks for one. Making a new token switches the old one off immediately, so update every tool that used it.

Authentication

Access always travels as a token inside the request itself — being signed in on the website is not enough and does not connect an assistant.
Two kinds of tokens work: the ones minted automatically by the browser approval, and vir_ tokens you create on the Connect screen.
Tools can register themselves — there is no manual approval step on our side.

Tools

Preview, then publish or schedule.

The order is enforced by the server, not suggested: publishing and scheduling both refuse without a confirmation token from a preview of identical content.

Preview

Call preview_linkedin_post with the text and any media. It returns the LinkedIn account the post would land on, the size and kind of the attached file, and a confirmation token. Show the user that account name and text — this is the last honest moment to catch a post going to the wrong profile.

Post now, or schedule

publish_linkedin_post goes out immediately. schedule_linkedin_post queues it for a future timezone-aware instant. Both take the confirmation token from step 1 and refuse without it. The token fingerprints the exact bytes, so swapping the file after the user approved it is caught.

Check, and cancel if needed

list_scheduled_linkedin_posts shows the queue and its statuses. cancel_scheduled_linkedin_post stops a pending post. Once a post is published — now or by the scheduler — it cannot be recalled through Viralz.

Publishing cannot be undone

Viralz cannot delete a published LinkedIn post, and publishing is not idempotent — retrying with the same confirmation token posts a second copy. If a publish call times out, check the feed rather than retrying. A scheduled post is cancellable only while it is still pending.

Feature tracks

Two groups of tools sit behind an environment flag. A tool on a switched-off track is not hidden — it is absent from tools/list and tools/call answers “Unknown tool”, so a client cannot build a retry around it.

Track	Flag	Default	What that means
brand.md	MCP_ENABLE_BRAND_TOOLS	On unless switched off	Opt-OUT: unset means ON, and the deployed server has it on. Set the variable to 0 to remove all seven brand tools from both endpoints.
Bracket research	MCP_ENABLE_BRACKET_RESEARCH	Off unless switched on	Opt-IN: unset means OFF, which is the deployed default. Its two tools are documented here so the surface is not a secret, but you cannot call them today unless your server sets the variable to 1.

Every tool

Every tool, with what you give it and what it hands back. Required arguments are marked; everything else is optional. A misspelled argument is refused loudly rather than silently ignored.

Tool	What it does	Changes something
preview_linkedin_post	Dry run. Checks that LinkedIn is connected and allowed to post, validates the text and media, and returns which account the post would land on plus a confirmation token. Publishes nothing and makes no LinkedIn API call. Always call this first.	No — read only
publish_linkedin_post	Posts right now. Requires the confirmation token from a preview of identical content. Irreversible and public — Viralz cannot delete a published post — and NOT idempotent: retrying with the same token posts a second copy, so on a timeout check the feed instead of retrying.	Yes
schedule_linkedin_post	Queues a post for a future time. Cancellable while it is still pending; once the worker publishes it, it is as irreversible as posting now. Same confirmation token rule as publishing.	Yes
list_scheduled_linkedin_posts	Everything queued for this account with its id, scheduled time and status — pending, processing, posted, failed or cancelled. Use it to find the id to cancel, and to check what already went out before retrying anything.	No — read only
cancel_scheduled_linkedin_post	Cancels a scheduled post so it never publishes. Works only while it is still pending. This is the safety valve, and it is deliberately rate limited far more loosely than publishing.	Yes
create_media_upload_ticket	A short-lived credential for uploading an image or video file to Viralz, for when the file is on disk rather than something you can inline. Returns a ready-to-run curl command; pass the mediaRef it prints as media_ref. This is the only way to attach a video that is not already at a public URL. Uploads nothing and posts nothing by itself.	Yes
get_app_overview	What this account has connected and what the server can currently do for it.	No — read only
get_mcp_agent_readme	The agent-facing readme: the rules an agent should follow before it posts anything.	No — read only
get_viralz_token_balance	How many Viralz tokens this account has left, what each action costs, and the recent statement. Read-only and free. Check it before a batch of posts so an empty balance turns up first rather than halfway through.	No — read only
create_brand_md	Scrapes a website with Firecrawl and builds its brand.md — colours, fonts, logo and team photo URLs, voice, messaging. Returns markdown meant to be written to ./brand.md and hand-edited. Re-running within 7 days returns the cached brand and asks you to confirm the site really changed before scraping again.	Yes
get_brand_md	Reads a stored brand.md. Omit the url for the most recently updated one.	No — read only
list_brand_profiles	Every website this account has a stored brand.md for, newest first, each with its brand name. Reading a stored brand costs nothing; re-scraping one costs credits.	No — read only
update_brand_md	Saves an edited brand.md back to Viralz. The stored document is the source of truth — editing the local file alone changes nothing until this runs.	Yes
delete_brand_md	Deletes a stored brand.md.	Yes
create_brand_template	Builds LinkedIn document templates from a stored brand.md: a 1080x1350 infographic page and/or an N-slide slider, as self-contained HTML that prints to the PDF LinkedIn wants. It returns empty slots plus per-page guidance — you write the copy, the template carries the brand's colours, fonts, logo and page geometry. Needs a brand.md to exist first.	No — read only
create_brand_signature	Fetches the MATERIAL for two identity components — the signature (picture, name, @company) and the CTA pill. You design them from it; Viralz stores the material, not your design. Free for the user's own identity, because it asks LinkedIn using the account they already connected. It scrapes with Apify, spending credits, when you pass linkedinUrl.	Yes
research_linkedin_urls	Hands in a few LinkedIn profile URLs and builds the Gold/Silver/Bronze best practices from their posts. Returns a runId immediately: the scraping and analysis happen in the background, so do not wait on the call. Costs scraping credits per profile.	Yes
get_bracket_best_practices	The Gold/Silver/Bronze best practices: the named winning patterns per bracket with the posts they came from, the bronze-to-gold ladder, and the creators each bracket is built on. While a run is still working it reports its stage with ready: false — a not-yet answer is never returned as an empty one.	No — read only

How many of these your assistant actually sees depends on what is switched on for your server and which address you connected to. The live numbers for your account are on the Connect screen at /console — this page deliberately prints no total, because a printed number would go stale.

Arguments and returns

preview_linkedin_post

Read only

Argument	Type	Required	Notes
commentary	string	Optional	The post text, exactly as it should appear. Required in practice unless you attach media — a post needs one or the other.
visibility	string — "PUBLIC" \| "CONNECTIONS", default "PUBLIC"	Optional	PUBLIC is anyone; CONNECTIONS is the member's connections only. Never widen what the user asked for.
media_ref	string	Optional	A mediaRef from POST /api/mcp/media, valid 86400 seconds. The route for a file on disk, and the only route for a video that is not already at a public URL. Mutually exclusive with media_url and media_base64.
media_url	string	Optional	A public http(s) URL pointing straight at the bytes, not at a page that displays them. The server downloads it, so the file never passes through the conversation. An undeclared URL is fetched under the 6 MB image limit, so pass media_mime_type too when it is a video.
media_base64	string	Optional	Inline media, base64 (a data: URI prefix is allowed). Caps at 8,000,000 characters, about 6 MB of file, so it suits images and never video — use media_ref or media_url for a video. The string travels through the agent's own context in full.
media_mime_type	string — one of the seven allowed types	Optional	Treated as a claim and checked against the file's magic bytes; a mismatch is refused rather than guessed at. Omit it to let the bytes decide, which is always right with media_url.

Returns ok, status: "preview", account (the LinkedIn identity that would receive the post), commentary, visibility, media (a summary of the file), confirmationToken, confirmationExpiresInSeconds: 600, and a warning restating that nothing was posted.

publish_linkedin_post

Writes

Argument	Type	Required	Notes
commentary	string	Optional	The post text, exactly as it should appear. Required in practice unless you attach media — a post needs one or the other.
visibility	string — "PUBLIC" \| "CONNECTIONS", default "PUBLIC"	Optional	PUBLIC is anyone; CONNECTIONS is the member's connections only. Never widen what the user asked for.
media_ref	string	Optional	A mediaRef from POST /api/mcp/media, valid 86400 seconds. The route for a file on disk, and the only route for a video that is not already at a public URL. Mutually exclusive with media_url and media_base64.
media_url	string	Optional	A public http(s) URL pointing straight at the bytes, not at a page that displays them. The server downloads it, so the file never passes through the conversation. An undeclared URL is fetched under the 6 MB image limit, so pass media_mime_type too when it is a video.
media_base64	string	Optional	Inline media, base64 (a data: URI prefix is allowed). Caps at 8,000,000 characters, about 6 MB of file, so it suits images and never video — use media_ref or media_url for a video. The string travels through the agent's own context in full.
media_mime_type	string — one of the seven allowed types	Optional	Treated as a claim and checked against the file's magic bytes; a mismatch is refused rather than guessed at. Omit it to let the bytes decide, which is always right with media_url.
confirmation_token	string	Required	The confirmationToken from a preview_linkedin_post call whose commentary, visibility and media were identical. Expires after 600 seconds.
confirm_publish	boolean — must be true	Required	An explicit acknowledgement that this call puts a real post on a real person's feed. Set it only after the user has seen the preview's account name and post text.

Returns ok, status: "published", account, postUrn, postUrl (the link to the live post — show it to the user), authorUrn, recoverable: false, plus message, showTheUser and retryGuidance strings that spell out that a retry would double-post.

schedule_linkedin_post

Writes

Argument	Type	Required	Notes
commentary	string	Optional	The post text, exactly as it should appear. Required in practice unless you attach media — a post needs one or the other.
visibility	string — "PUBLIC" \| "CONNECTIONS", default "PUBLIC"	Optional	PUBLIC is anyone; CONNECTIONS is the member's connections only. Never widen what the user asked for.
media_ref	string	Optional	A mediaRef from POST /api/mcp/media, valid 86400 seconds. The route for a file on disk, and the only route for a video that is not already at a public URL. Mutually exclusive with media_url and media_base64.
media_url	string	Optional	A public http(s) URL pointing straight at the bytes, not at a page that displays them. The server downloads it, so the file never passes through the conversation. An undeclared URL is fetched under the 6 MB image limit, so pass media_mime_type too when it is a video.
media_base64	string	Optional	Inline media, base64 (a data: URI prefix is allowed). Caps at 8,000,000 characters, about 6 MB of file, so it suits images and never video — use media_ref or media_url for a video. The string travels through the agent's own context in full.
media_mime_type	string — one of the seven allowed types	Optional	Treated as a claim and checked against the file's magic bytes; a mismatch is refused rather than guessed at. Omit it to let the bytes decide, which is always right with media_url.
scheduled_at	string — ISO-8601 with an offset or a trailing Z	Required	When to publish, e.g. 2026-08-20T09:00:00Z. Must carry a timezone and must be in the future — a past time is refused rather than published on the scheduler's next pass.
confirmation_token	string	Required	The confirmationToken from a preview_linkedin_post call whose commentary, visibility and media were identical. Expires after 600 seconds.
confirm_publish	boolean — must be true	Required	An explicit acknowledgement that this call puts a real post on a real person's feed. Set it only after the user has seen the preview's account name and post text.

Returns ok, status: "scheduled", account, item (the queued row, including its id and scheduled time), and a message naming the cancel tool.

list_scheduled_linkedin_posts

Read only

Takes no arguments.

Returns ok, status: "ok", items — the queue, each entry carrying its id, scheduled time and status.

cancel_scheduled_linkedin_post

Writes

Argument	Type	Required	Notes
post_id	string	Required	The id of an item from list_scheduled_linkedin_posts.

Returns ok, status: "cancelled", item — the cancelled row, or item: null with a message when it was already cancelled.

create_media_upload_ticket

Writes

Takes no arguments.

Returns ok, status: "ok", uploadUrl, uploadTicket, expiresInSeconds: 600, a ready-to-run curl command, and accepts — the type and size ceilings in words.

get_app_overview

Read only

Takes no arguments.

Returns product, mission, and the capability list the server builds from its enabled tracks.

get_mcp_agent_readme

Read only

Takes no arguments.

Returns The readme document, including the Claude Design handoff rule and whatever is temporarily switched off.

get_viralz_token_balance

Read only

Takes no arguments.

Returns ok, status, balance, monthlyAllowance and allowanceNote (the grant does NOT roll over — a period's unused tokens expire), expiresAt, daysUntilExpiry and expiringSoon (true inside the last 7 days with a positive balance, plus an expiryWarning sentence to relay to the user), defaultCost, costs per action, and statement — the last 20 entries. On a server with metering switched off it answers status: "not_metered" rather than a number.

create_brand_md

WritesSpends creditsMCP_ENABLE_BRAND_TOOLS

Argument	Type	Required	Notes
url	string	Required	The website, e.g. viralz.dev or https://viralz.dev. Normalised before storage, so viralz.dev and https://VIRALZ.dev/ are the same brand.
forceRefresh	boolean — default false	Optional	Re-scrape even when a brand extracted less than 7 days ago exists. Set it only after the user has confirmed the site's visual style actually changed.

Returns The extracted brand, plus cacheHit and needsRefreshConfirmation. On a cache hit it also returns suggestedQuestion — the question to put to the user before spending a scrape.

get_brand_md

Read onlyMCP_ENABLE_BRAND_TOOLS

Argument	Type	Required	Notes
url	string	Optional	Which stored brand to read. Omit it for the most recently updated one.

Returns found: true plus the stored document, or found: false with brands — everything that IS stored — and a note pointing at create_brand_md.

list_brand_profiles

Read onlyMCP_ENABLE_BRAND_TOOLS

Argument	Type	Required	Notes
query	string	Optional	Case-insensitive substring matched against the brand NAME and the website URL, so brandfetch, Brandfetch and brandfetch.com all find the same brand. Omit it to list everything. Above 100 stored brands this searches the 100 most recently updated.

Returns The stored brands, newest first, each with its name and website URL.

update_brand_md

WritesMCP_ENABLE_BRAND_TOOLS

Argument	Type	Required	Notes
url	string	Required	Which stored brand this document belongs to.
markdown	string	Required	The full edited brand.md body. It REPLACES the stored document outright — send the whole file, not a diff or a fragment.

Returns saved: true plus the stored record.

delete_brand_md

WritesMCP_ENABLE_BRAND_TOOLS

Argument	Type	Required	Notes
url	string	Required	Which stored brand to delete.

Returns deleted — true when a stored brand was removed.

create_brand_template

Read onlyMCP_ENABLE_BRAND_TOOLS

Argument	Type	Required	Notes
url	string	Optional	Which stored brand to build in. Omit it for the most recently updated one.
kind	string — "infographic" \| "slider" \| "background" \| "both", default "both"	Optional	infographic is one page; slider is a multi-page carousel; background is just the 1080x1350 canvas layer as a starting point. both returns infographic and slider in one call.
slides	integer — 4 to 14, default 12	Optional	Pages in the slider, counting the hook, the CTA and the closing slide. Ignored for kind: infographic.
includePhoto	boolean — default false	Optional	Return the stored LinkedIn profile picture as a data URI so you can design with the face. Off by default because the image runs to a few hundred thousand characters; the result says photoAvailable: true when there is one to ask for.

Returns The template HTML and its per-page guidance, or found: false with the stored brands and a note when there is no brand.md to build from. Viralz does not store the finished design — keep it in the user's project folder.

create_brand_signature

WritesMCP_ENABLE_BRAND_TOOLS

Argument	Type	Required	Notes
linkedinUrl	string	Optional	Someone ELSE's profile URL (/in/<slug>). Omit it for the user's own signature — that path uses their connected account and spends no credits. Supplying a URL forces a paid profile scrape.
url	string	Optional	Which stored brand to attach the signature to. Omit it for the most recently updated one.
name	string	Optional	Override the scraped display name.
company	string	Optional	Override the scraped company, rendered as @Company.
positioning	string	Optional	The one line shown on the CTA pill. Defaults to the brand's tagline. Keep it short — the pill does not wrap.
ctaAction	string — "follow" \| "message", default "follow"	Optional	The CTA pill's button. Ask the user which action they actually want from a reader.
photoStyle	string — "color" \| "grayscale", default "color"	Optional	Applied as a CSS filter, so switching later never needs another scrape.

Returns found: true, websiteUrl, signature (without the photo bytes), hasPhoto, hasCompany, photoSource, identitySource — which path actually ran, free or scraped — and replacedStoredSignatureFor. persisted: false means the identity could not be stored but the material is still usable now.

research_linkedin_urls

WritesSpends creditsMCP_ENABLE_BRACKET_RESEARCH

Argument	Type	Required	Notes
urls	array of string — 1 to 9 items	Required	LinkedIn PROFILE urls. Company pages (/company/...) are not profiles and are rejected. At most 9: there are nine bracket seats and a tenth creator would never be scraped. Duplicates are dropped.

Returns runId, status, accepted, rejected, background: true, and resultTool — the tool to read the answer with.

get_bracket_best_practices

Read onlyMCP_ENABLE_BRACKET_RESEARCH

Argument	Type	Required	Notes
run_id	string	Optional	Which run to read, from research_linkedin_urls. Omit it for the most recent run — that is the normal call.

Returns ready, status, brackets, ladder — or ready: false with the current stage while the run is still working, and a note pointing at research_linkedin_urls when there is no run at all.

Images and video

One file per post. The bytes decide what it is.

6 MB

Image — PNG, JPEG, WebP, GIF

100 MB

Video — MP4, MOV, WebM

Files per post — one image or one video

image/png
image/jpeg — image/jpg is folded to image/jpeg
image/webp
image/gif — animated GIFs keep their animation
video/mp4 — the format to prefer for video
video/quicktime — .mov
video/webm

Three ways to attach one file: `media_ref` from an upload ticket (best for anything on disk, and the only route for video that is not already online), `media_url` for something already at a public https URL, or `media_base64` for a small image. One file per post.
Video goes by `media_ref` or `media_url`, never inline. `media_base64` caps at roughly 6 MB, so a real video does not fit — and a base64 string travels through the agent's own context in full, which is the failure the upload route exists to remove.
The declared mime type is a CLAIM that gets checked, never trusted: the bytes are sniffed and a file whose magic bytes contradict its declared type is rejected rather than silently re-labelled. A GIF stays a GIF and an MP4 stays an MP4.
An audio file in an MP4 container (M4A) is not a video and is refused, rather than uploaded as one and rejected by LinkedIn after your quota is spent.
LinkedIn processes video asynchronously. Viralz waits for it to finish before creating the post, so a video LinkedIn cannot process fails BEFORE anything is published rather than becoming a post with a broken attachment.

Posting something you made in Claude Design

An animation is not a video. A design that moves on the Claude Design canvas is HTML and CSS, and Viralz needs actual video bytes — nothing converts one into the other. Three steps, and the third is the one people skip:

Ask Claude Design for a video, not an animation

An animated canvas is not an exportable video. Say you want a video file of the design, and check you have one — an .mp4, .mov or .webm — before going further.

Download it

The file has to exist on the machine your agent can reach. A preview in a browser tab, a canvas, a share link or an artifact page is not a file it can upload.

Name the downloaded file in your prompt

“Post ~/Downloads/ladder.mp4 to LinkedIn”. The agent uploads it with create_media_upload_ticket, previews it, and shows you the account and the text before anything is published.

A still is not the post you asked for

If your agent offers to screen-record the animation for you, or to post a still image instead, it has skipped step 1 — the still is a different post from the one you asked for. Ask it for the video file instead. The HTML, zip, PDF and PPTX exports are not media LinkedIn accepts and will be refused.

Rate limits

Two budgets, and only one of them is ours.

Bucket	Budget	Charged on
mcp-transport	600 / hour	Every request, every method, including GET and DELETE.
mcp-read	300 / hour	tools/call on a read-only tool.
mcp-write	60 / hour	tools/call on a tool that writes.
mcp-expensive	20 / hour	tools/call on a tool that spends vendor budget.

A throttled tool call still returns 200

Budgets are counted per account, not per computer. A tool call over its hourly budget gets a polite answer saying so — the connection stays up; wait a bit and try again. (For builders: an over-budget tool call still returns HTTP 200 with isError: true; only the transport budget answers a real 429 with Retry-After.)

LinkedIn's own daily budget

LinkedIn itself allows 150 requests per member per day, separate from the Viralz budgets above. A text post uses 1. A post with an image or video uses about 3. A preview uses none at all — so preview as often as you like.

Troubleshooting

When the connection will not come up.

401 invalid_token: the connection needs a token, not a website login. Being signed in in the browser is not enough — connect the tool via the Start here steps.
HTTP URL rejected: the address must start with https://. For local experiments, use a tunnel — the refusal comes from your tool, not from us.
402 on a tool call: the account behind the token has no active subscription. Previews still answer, so you can prove the connection works.
A rate-limit message: you hit an hourly budget. The connection is fine — wait a bit and try again, and do not treat that answer as success.
Token stopped working after regeneration: making a new token switches the old one off immediately. Update every tool that used it.
media_ref rejected as invalid or expired: an upload is valid for 24 hours and only for the account that uploaded it. Upload the file again and use the new reference.
confirmation_content_changed: the text or file changed after the preview. Approval covers exactly what was shown — preview the final version again.

Live component health is on the status page.