---
title: "Upload a finding attachment"
method: POST
path: "/v1/pentests/{pentest_slug}/findings/attachments"
tags: ["pentests"]
---

# Upload a finding attachment

`POST /v1/pentests/{pentest_slug}/findings/attachments`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/pentests/{pentest_slug}/findings/attachments`
- Auth: none declared

Store a file the caller will reference from a later submission.

Reserved for machine integrators. The attachment is stored with no
finding: the engine uploads before the finding exists and lists the
returned id in ``SubmitFindingRequest.attachments``, which the ingest
then claims onto the created row.

Args:
    pentest_slug (str): Public pentest identifier.
    db (AsyncSession): Request-scoped database session.
    context (ActiveContext): Resolved caller identity and scope.
    attachment (UploadFile): The multipart file part.

Returns:
    FindingAttachmentUploadResponse: The stored attachment's id.

## Path parameters

- `pentest_slug` string, required

## Request body `multipart/form-data`

- BodyPentestsFindingsAttachments
  - `attachment` string, binary, required: The file to upload.

## Response `200`

Successful Response

- FindingAttachmentUploadResponse: Response from a successful finding-attachment upload. Attributes: attachment_id (int): The stored attachment's id, to be listed in a later submission's ``attachments`` so the ingest claims it.
  - `attachment_id` integer, required: Id of the uploaded attachment.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)