---
title: "Finalize support attachment upload"
method: POST
path: "/v1/support/attachments/{attachmentId}/finalize"
tags: ["Support"]
---

# Finalize support attachment upload

`POST /v1/support/attachments/{attachmentId}/finalize`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/support/attachments/{attachmentId}/finalize`
- Auth: HTTP bearer

Verify an upload owned by the caller in its organization. Stored content must match the declared media type and exact byte count. Mismatches fail the attachment. Expired uploads conflict. A repeated successful finalization returns the existing ready attachment. messageId is null until it is sent in a message. Returns complete attachment metadata. Accepts no body or an empty JSON object. Requires support.write and a user token. Organization API keys cannot call this operation. Uses customer permissions, with no operator or staff bypass. New mutations require rollout-agent-access-writes and allow-public-agent-writes to be enabled. Pausing writes leaves history and downloads available. Known IDs resolve their own organization; organizationId can require a specific tenant. Creation defaults to the saved organization.

## Path parameters

- `attachmentId` string, required

## Query parameters

- `organizationId` string

## Request body

- PublicSupportEmptyBody

## Response `200`

Success

- object
  - `success` unknown, required
  - `data` PublicSupportAttachmentResult, required
    - `attachment` object, required
      - `id` string, required
      - `messageId` string, nullable, required
      - `fileName` string, required
      - `mediaType` string, required
      - `sizeBytes` integer, required
      - `kind` 'image' | 'screen_recording' | 'file', required
      - `status` 'uploading' | 'ready' | 'failed', required
      - `downloadUrl` string, required
      - `failureReason` string, nullable
      - `createdAt` string, required: An ISO 8601 UTC date-time string.
      - `uploadedAt` string, nullable, required: An ISO 8601 UTC date-time string.

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `503`: Public agent writes are paused by allow-public-agent-writes. Retry after operators resume writes.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/support/attachments/:attachmentId/finalize/post.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)