---
title: "Attach a file reference to an expense"
method: POST
path: "/v1/expenses/{expenseId}/attachments"
tags: ["Expenses"]
---

# Attach a file reference to an expense

`POST /v1/expenses/{expenseId}/attachments`

## Request

- Base URL: `https://api.frihet.io`
- URL: `https://api.frihet.io/v1/expenses/{expenseId}/attachments`
- Auth: API key in header `X-API-Key`

Appends an existing safe file reference to an expense. The request
accepts metadata only: no raw bytes, local paths, signed URLs, or
secrets. MIME type and size are validated server-side.

## Path parameters

- `expenseId` string, required

## Request body

- FileAttachmentInput
  - `fileId` string: Opaque uploaded file reference. Not a path or URL.
  - `fileReferenceId` string: Opaque uploaded file reference. Not a path or URL.
  - `originalName` string: Filename only; local paths are rejected.
  - `fileName` string: Filename only; local paths are rejected.
  - `contentType` 'application/pdf' | 'image/jpeg' | 'image/jpg' | 'image/png' | 'image/webp' | 'image/heic' | 'image/heif' | 'image/tiff'
  - `size` integer
  - `sizeBytes` integer
  - `checksumSha256` string

## Response `200`

Attachment reference appended

- object
  - `data` object
    - `expenseId` string
    - `attachment` FileAttachment
      - `fileId` string, required: Opaque uploaded file reference. Not a path or URL.
      - `originalName` string, required: Filename only; local paths are rejected.
      - `contentType` 'application/pdf' | 'image/jpeg' | 'image/jpg' | 'image/png' | 'image/webp' | 'image/heic' | 'image/heif' | 'image/tiff', required
      - `size` integer, required
      - `checksumSha256` string

## Other responses

- `400`: Bad request - invalid parameters or request body
- `401`: Authentication required or invalid API key
- `404`: Resource not found
- `429`: Rate limit exceeded (100 requests per minute)
- `500`: Internal server error

---

[API](https://skmtc.dev/frihet/apis/frihet-api.md) · [All operations](https://skmtc.dev/frihet/apis/frihet-api/llms.txt) · [OpenAPI document](https://skmtc.dev/frihet/apis/frihet-api/revisions/3dd37f6a72d1?raw)