---
title: "Create support attachment upload"
method: POST
path: "/v1/support/attachments"
tags: ["Support"]
---

# Create support attachment upload

`POST /v1/support/attachments`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/support/attachments`
- Auth: HTTP bearer

Reserve an image or screen recording upload owned by the caller. clientAttachmentId is a UUID; retry an unexpired pending reservation using identical metadata. Images may be at most 10 MiB and screen recordings 100 MiB. fileName is a display name without path separators or control characters. PUT the exact bytes to upload.url using upload.method and upload.mediaType as Content-Type. Do not forward the API bearer token to that signed storage URL. Then finalize the attachment before including its ID in a message. The upload URL expires at upload.expiresAt. Requires support.write and a user token. Organization API keys cannot call this operation. Uses customer permissions, with no operator or staff bypass. New mutations require rollout-agent-access-writes and allow-public-agent-writes to be enabled. Pausing writes leaves history and downloads available. Known IDs resolve their own organization; organizationId can require a specific tenant. Creation defaults to the saved organization.

## Query parameters

- `organizationId` string

## Request body

- PublicSupportCreateAttachmentUpload
  - `clientAttachmentId` string, uuid, required
  - `fileName` string, required
  - `mediaType` 'image/gif' | 'image/jpeg' | 'image/png' | 'image/webp' | 'video/mp4' | 'video/quicktime' | 'video/webm', required
  - `sizeBytes` integer, required

## Response `201`

Success

- object
  - `success` unknown, required
  - `data` PublicSupportAttachmentUploadIntent, required
    - `attachment` object, required
      - `id` string, required
      - `messageId` string, nullable, required
      - `fileName` string, required
      - `mediaType` string, required
      - `sizeBytes` integer, required
      - `kind` 'image' | 'screen_recording' | 'file', required
      - `status` 'uploading' | 'ready' | 'failed', required
      - `downloadUrl` string, required
      - `failureReason` string, nullable
      - `createdAt` string, required: An ISO 8601 UTC date-time string.
      - `uploadedAt` string, nullable, required: An ISO 8601 UTC date-time string.
    - `upload` SupportAttachmentUploadTargetEncoded, required
      - `method` 'PUT', required
      - `url` string, required
      - `mediaType` 'image/gif' | 'image/jpeg' | 'image/png' | 'image/webp' | 'video/mp4' | 'video/quicktime' | 'video/webm' | 'application/pdf' | 'application/octet-stream', required
      - `expiresAt` string, required: An ISO 8601 UTC date-time string.

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `503`: Public agent writes are paused by allow-public-agent-writes. Retry after operators resume writes.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/support/attachments/post.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)