---
title: "Upload and verify one private chat document"
method: POST
path: "/v1/agent-chat-attachments"
tags: ["Agent chats"]
---

# Upload and verify one private chat document

`POST /v1/agent-chat-attachments`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/agent-chat-attachments`
- Auth: HTTP bearer

Upload and verify one private chat document. Send multipart/form-data with exactly one file field, or application/json with fileName, optional mediaType and complete file data as canonical padded base64. Do not include a data URL prefix. The shared byte validator chooses the canonical file type. Unknown fields and noncanonical encoding are rejected. Validation and private storage verification finish synchronously; the response is ready for use in ordered attachmentIds on chat start or send. There is no finalize call. Supports PDF, DOCX, UTF-8 text/source/config, Markdown, CSV, JSON and supported images. Maximum 20 MiB of decoded bytes per file, ten pending files and 40 MiB total per person and organization. Pending uploads expire after 24 hours. Upload retries create another ID; recover lost responses with the pending list. Requires agents.write and a user OAuth token. Organization API keys cannot use this operation. Requires rollout-agent-access-writes and allow-public-agent-writes. New upload and message binding also require allow-document-processing.

## Query parameters

- `organizationId` string

## Request body

- PublicChatAttachmentUploadData
  - `fileName` string, required
  - `mediaType` string
  - `data` string, required

## Response `201`

Success

- object
  - `success` unknown, required
  - `data` PublicChatAttachmentResult, required
    - `organizationId` string, required
    - `attachment` object, required
      - `id` string, required
      - `fileName` string, required
      - `mediaType` 'application/json' | 'application/pdf' | 'application/vnd.openxmlformats-officedocument.wordprocessingml.document' | 'image/gif' | 'image/jpeg' | 'image/png' | 'image/webp' | 'text/csv' | 'text/markdown' | 'text/plain', required
      - `sizeBytes` integer, required
      - `downloadUrl` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `413`: File exceeds 20 MiB or pending files exceed the shared 40 MiB limit.
- `503`: New public writes or document processing are paused.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/agent-chat-attachments/post.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)