---
title: "Create workflow attachment upload URL"
method: POST
path: "/api/workflow-attachments/upload-url"
tags: ["workflow_attachments"]
---

# Create workflow attachment upload URL

`POST /api/workflow-attachments/upload-url`

## Request

- Base URL: `https://beta.getsales.io/playtables/v1`
- URL: `https://beta.getsales.io/playtables/v1/api/workflow-attachments/upload-url`
- Auth: HTTP bearer and API key in header `Team-SID`

The agent's way to add a file to the library, since bytes cannot ride JSON: this mints a signed single-use URL; then PUT the raw file bytes to it as the body (a plain HTTP request with the file's Content-Type, one of result.content_types, no bearer, at most max_bytes), which stores the file exactly as the multipart upload does and answers the wf_at_ row; then name that sid in an email_send step's attachments[]. Nothing exists until the PUT lands; the link dies in 15 minutes.

Contract:
- MCP tool `create_workflow_attachment_upload_url`, registry package `mcp.playtables/workflow_attachments`, mount `playtables.workflows`.
- Operation `action`, response envelope `action`.
- Flags: none.

## Request body

- CreateWorkflowAttachmentUploadUrlRequest: Request body of `create_workflow_attachment_upload_url`.
  - `name` string: The file name the recipient sees (1..255); default: the file name the PUT declares in Content-Disposition, else upload with the extension of its Content-Type.

## Response `200`

`action` success envelope.

- CreateWorkflowAttachmentUploadUrlResponse
  - `success` true, required
  - `operation` 'action', required
  - `action` string, required: kebab-case verb; matches the route segment.
  - `item` unknown, required
  - `result` object, required
    - `upload_url` string, required: The signed URL to PUT the bytes to, used exactly as given (the signature covers the path and the query); one use, then gone.
    - `method` 'PUT', required
    - `expires_at` string, required: ISO 8601 UTC: the link stops working here, 15 minutes after the mint; mint again after it.
    - `max_bytes` integer, required: The body cap in bytes (10 MB, the multipart rule); a larger PUT is 422 on file.
    - `content_types` string[], required: The Content-Type values the PUT accepts: the document, image and archive families of the multipart allow-list. The bytes are sniffed too, so a script declared as a PDF is 422.
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables/revisions/aa394506515d?raw)