---
title: "Search workflow attachments"
method: POST
path: "/api/workflow-attachments/search"
tags: ["workflow_attachments"]
---

# Search workflow attachments

`POST /api/workflow-attachments/search`

## Request

- Base URL: `https://beta.getsales.io/playtables/v1`
- URL: `https://beta.getsales.io/playtables/v1/api/workflow-attachments/search`
- Auth: HTTP bearer and API key in header `Team-SID`

List the team's uploaded files, the library an email_send step picks from: how a file a person uploaded becomes the wf_at_ sid a step's attachments[] carries. q or name for the label they said, sid.in to check refs already in a step are still live, mime_type / size_bytes to pick between similar files. Sort created_at (default, newest first), name or size_bytes; page_size:0 = the library size. Metadata only: the bytes never ride the wire and there is no download, so a file cannot be read here.

Contract:
- MCP tool `search_workflow_attachments`, registry package `mcp.playtables/workflow_attachments`, mount `playtables.workflows`.
- Operation `search`, response envelope `search`.
- Flags: read only.

## Request body

- SearchWorkflowAttachmentsRequest: Request body of `search_workflow_attachments`.
  - `filter` object: Field filters, ANDed: {field: {eq | ne | in | nin | gte | lte | gt | lt | is_null}}; q inside it is free text. Omit for every row.
    - `q` string: Free text over name (MySQL LIKE, prefix/infix - a small per-team library, no FULLTEXT).
    - `sid` object: Prefix-validated wf_at_ sid(s) - also the point-lookup path (no get tool), and how a step ref is resolved to a live row.
      - `eq` string: Attachment sid (wf_at_…).
      - `in` string[]
    - `name` object: Exact file name; substring matching goes through q.
      - `eq` string
      - `in` string[]
    - `mime_type` object: Exact media type, e.g. { eq: 'application/pdf' }. There is no family prefix match: pass the types you want in `in`.
      - `eq` string
      - `in` string[]
    - `created_at` object: ISO 8601 range over the upload time; combine bounds in one object.
      - `gte` string
      - `lte` string
      - `gt` string
      - `lt` string
    - `deleted_at` object: Default scope is { is_null: true } (live files).
      - `gte` string
      - `lte` string
      - `is_null` boolean
  - `sort` object: One column and its direction; omit for the default order.
    - `field` 'name' | 'created_at' | 'size_bytes', required: The column to order by.
    - `direction` 'asc' | 'desc': asc or desc; default desc.
  - `page_size` integer: 0..500, default 50; 0 = counts only, 1 = the first row.
  - `cursor` string, nullable: pagination.next_cursor of the previous page.

## Response `200`

`search` success envelope.

- SearchWorkflowAttachmentsResponse
  - `success` true, required
  - `operation` 'search', required
  - `items` object[], required
    - `item` object, required
      - `sid` string, required: Attachment sid (wf_at_…) - the value an email_send step stores in its attachments[].sid.
      - `team_sid` string, required: Owning team (ts_tm_…, external - gs.service.id).
      - `name` string, required: File name the recipient sees (1..255): the name given at upload, else the upload's own. Fixed at upload.
      - `mime_type` string, required: Media type as sniffed at upload (1..127), e.g. 'application/pdf'; 'application/octet-stream' when it could not be sniffed.
      - `size_bytes` integer, required: File size in bytes, 0..10485760 (10 MB, the upload ceiling).
      - `created_by` object, required: Actor that uploaded the file (AccessIdentityValue).
        - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
        - `actor_sid` string, nullable, required
        - `team_sid` string, required
        - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
        - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
        - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
        - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
        - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
        - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
      - `created_at` string, required: ISO 8601 UTC - the upload time.
      - `updated_at` string, required: ISO 8601 UTC.
      - `deleted_at` string, nullable, required: ISO 8601 UTC; null = live (soft delete).
    - `included` object, required
  - `pagination` object, required
    - `next_cursor` string, nullable, required
    - `has_more` boolean, required
    - `total_count` integer, nullable, required
  - `applied_filters` object, required
  - `includes` string[], required
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.
  - `counts` object
    - `total_count` integer, required: Files matching the filter (full filter scope, not the page).
    - `groups` union, required: Always empty - the library has no bounded group axis. PHP serialises an empty map as [].
      - object
      - unknown[]
        - unknown

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables/revisions/aa394506515d?raw)