5 endpoints. Send your API key as Authorization: Bearer <key> on each request; see The API and AI assistants for keys, errors, idempotency and the conventions every endpoint shares.
GET /api/attachments/usage
How much the organisation's attachments take up, and the plan's limits
used_bytes, file_bytes (the largest file the plan takes) and storage_bytes (the organisation's total; null for no limit).
Responses:
| Status | Meaning |
|---|---|
| 200 | The usage and limits |
| 401 | Missing or invalid API key (Error) |
GET /api/tasks/{id}/attachments
The files attached to a task
The same list each task carries as attachments (read-only on the task).
Parameters:
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | integer | Yes | From 1 to 2147483647. |
Responses:
| Status | Meaning |
|---|---|
| 200 | The files, oldest first (array of Attachment) |
| 401 | Missing or invalid API key (Error) |
| 404 | Item (or its parent) does not exist (Error) |
POST /api/tasks/{id}/attachments
Attach a file to a task (not viewers)
The file is the request body (any Content-Type) and its name goes in name. Allowed: pdf, png, jpg, jpeg, gif, webp, txt, log, md, csv, json, zip, docx, xlsx, pptx, odt, ods and odp; the file's first bytes must match its extension, and programs and scripts are refused whatever their name. A file over the plan's largest file is a 413 (code: attachment_too_large); one that would take the organisation past its plan's total is a 409 (code: attachment_storage_full). Logged in the activity. Files are never sent to any AI provider.
Parameters:
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | integer | Yes | From 1 to 2147483647. |
name | query | string | Yes | Up to 200 characters. |
X-Actor | header | string | No | Name recorded in the activity log (up to 200 characters, URI-encoded if not ASCII). |
Request body (application/octet-stream, required)
Responses:
| Status | Meaning |
|---|---|
| 201 | The attachment (Attachment) |
| 400 | The request body is invalid or is not valid JSON (Error) |
| 401 | Missing or invalid API key (Error) |
| 404 | Item (or its parent) does not exist (Error) |
| 409 | The organisation's attachments would pass the plan's total |
| 413 | The file is larger than the plan allows |
GET /api/attachments/{id}/download
Download an attached file
Only for members of the organisation that owns it (viewers included). Always sent as a download, never to be shown in a page: Content-Type: application/octet-stream, Content-Disposition: attachment with the file's name, X-Content-Type-Options: nosniff and Cache-Control: no-store.
Parameters:
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | integer | Yes | From 1 to 2147483647. |
Responses:
| Status | Meaning |
|---|---|
| 200 | The file |
| 401 | Missing or invalid API key (Error) |
| 404 | Item (or its parent) does not exist (Error) |
DELETE /api/attachments/{id}
Delete an attachment (not viewers); the file is removed from storage
Parameters:
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | integer | Yes | From 1 to 2147483647. |
X-Actor | header | string | No | Name recorded in the activity log (up to 200 characters, URI-encoded if not ASCII). |
Responses:
| Status | Meaning |
|---|---|
| 204 | Deleted |
| 401 | Missing or invalid API key (Error) |
| 404 | Item (or its parent) does not exist (Error) |