---
title: "Create attachment"
method: POST
path: "/v3/attachments"
tags: ["Attachments"]
---

# Create attachment

`POST /v3/attachments`

## Request

- Base URL: `https://harvest.greenhouse.io`
- URL: `https://harvest.greenhouse.io/v3/attachments`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://auth.greenhouse.io/authorize`
    - Client credentials
    - Token URL: `https://auth.greenhouse.io/token` scopes: `harvest:attachments:create`
  - HTTP bearer

Attach a file to an existing application. Supply the bytes inline as base64-encoded `content`, or point Greenhouse at a publicly fetchable `url` and we will download the file on your behalf — exactly one of the two is required. `type` controls how the attachment is classified in Greenhouse (resume, cover_letter, offer_letter, etc.); uploading a `resume` or `cover_letter` replaces any prior attachment of that type by reclassifying the existing one as `other`. Filenames are validated against the organization's blocklisted-extensions list (for example, `.html` is rejected for `take_home_test`).

## Request body

- union
  - object
    - `application_id` integer, required: Id of the application the attachment will be associated with.
    - `filename` string, required: Filename to store the attachment under, including extension. Extensions present in the organization's blocklisted-extensions list are rejected.
    - `type` 'resume' | 'cover_letter' | 'take_home_test' | 'offer_packet' | 'offer_letter' | 'signed_offer_letter' | 'other' | 'form_attachment' | 'midfunnel_agreement' | 'automated_agreement', required: Classification of the attachment. `resume`, `cover_letter`, and `take_home_test` are candidate-supplied documents; `offer_packet`, `offer_letter`, and `signed_offer_letter` are offer documents; `midfunnel_agreement` and `automated_agreement` are e-signed documents; `form_attachment` is generated by Greenhouse forms; `other` is the free-form bucket.
    - `content` string, required: Base64-encoded file contents. Provide either `content` or `url`, not both.
    - `url` string: Publicly fetchable URL Greenhouse should download the file from. Provide either `url` or `content`, not both.
    - `visibility` 'admin_only' | 'private' | 'public': Who can see the attachment within Greenhouse. `public` is visible to site admins, job admins, and assigned interviewers; `admin_only` is restricted to site admins and assigned job admins; `private` is restricted to admins with explicit private-candidate access. Defaults are inferred from `type` when omitted.
  - object
    - `application_id` integer, required: Id of the application the attachment will be associated with.
    - `filename` string, required: Filename to store the attachment under, including extension. Extensions present in the organization's blocklisted-extensions list are rejected.
    - `type` 'resume' | 'cover_letter' | 'take_home_test' | 'offer_packet' | 'offer_letter' | 'signed_offer_letter' | 'other' | 'form_attachment' | 'midfunnel_agreement' | 'automated_agreement', required: Classification of the attachment. `resume`, `cover_letter`, and `take_home_test` are candidate-supplied documents; `offer_packet`, `offer_letter`, and `signed_offer_letter` are offer documents; `midfunnel_agreement` and `automated_agreement` are e-signed documents; `form_attachment` is generated by Greenhouse forms; `other` is the free-form bucket.
    - `content` string: Base64-encoded file contents. Provide either `content` or `url`, not both.
    - `url` string, required: Publicly fetchable URL Greenhouse should download the file from. Provide either `url` or `content`, not both.
    - `visibility` 'admin_only' | 'private' | 'public': Who can see the attachment within Greenhouse. `public` is visible to site admins, job admins, and assigned interviewers; `admin_only` is restricted to site admins and assigned job admins; `private` is restricted to admins with explicit private-candidate access. Defaults are inferred from `type` when omitted.

## Response `201`

Successful

- object
  - `id` integer
  - `created_at` string, date-time
  - `updated_at` string, date-time
  - `application_id` integer: Id of the application this attachment is associated with.
  - `candidate_id` integer, nullable: Id of the candidate (person) the attachment ultimately belongs to, resolved through the application. `null` if the application's candidate cannot be resolved.
  - `type` 'resume' | 'cover_letter' | 'take_home_test' | 'offer_packet' | 'offer_letter' | 'signed_offer_letter' | 'other' | 'form_attachment' | 'midfunnel_agreement' | 'automated_agreement': Classification of the attachment. `resume`, `cover_letter`, and `take_home_test` are candidate-supplied documents; `offer_packet`, `offer_letter`, and `signed_offer_letter` are offer documents; `midfunnel_agreement` and `automated_agreement` are e-signed documents; `form_attachment` is generated by Greenhouse forms; `other` is a free-form bucket for any document that doesn't fit the above.
  - `filename` string: Original filename of the uploaded document, including extension.
  - `url` string: Time-limited download URL for the underlying file. The link may be served via a Greenhouse redirect endpoint that issues a fresh short-lived file URL on each request — HTTP clients should follow redirects when downloading. Links expire after seven days; refetch the attachment to obtain a fresh URL.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `422`: Unprocessable Content

---

[API](https://skmtc.dev/greenhouse/apis/harvest-api.md) - [All operations](https://skmtc.dev/greenhouse/apis/harvest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/greenhouse/apis/harvest-api/revisions/822822e3f771?raw)