---
title: "Upload provider attachment"
method: PUT
path: "/api/organization-providers/v3/{organization_provider_id}/attachments"
tags: ["v3"]
---

# Upload provider attachment

`PUT /api/organization-providers/v3/{organization_provider_id}/attachments`

## Request

- Base URL: `https://pre-api.joincandidhealth.com`
- URL: `https://pre-api.joincandidhealth.com/api/organization-providers/v3/{organization_provider_id}/attachments`
- Auth: HTTP bearer

Uploads a file to the provider. Accepted file types are W9, PECOS_RECORD, and BANK_LETTER_OR_VOIDED_CHECK.
Only one file per type is allowed per provider — uploading when a file of the same type already exists returns a 409.

## Path parameters

- `organization_provider_id` string, uuid, required

## Request body `multipart/form-data`

- object
  - `attachment_file` string, binary, required: The file to upload.
  - `file_type` 'W9' | 'PECOS_RECORD' | 'BANK_LETTER_OR_VOIDED_CHECK', required

## Response `200`

Response with status 200

- string, uuid

## Changes

- **2026-09-17** `24b2d80d577a`: 2 breaking, 1 warning, 6 info
  - request property `file_type` was restricted to a list of enum values
  - the response's body type changed from no type to `string`, and format from no format to `uuid` for status `200`
  - deleted the `header` request parameter `Authorization`
  - the endpoint scheme security `OAuthScheme` was added to the API
  - …5 more
- **2026-09-12** `3a81ee81d4ed`: 1 info
  - api operation id `upload_attachment` removed and replaced with `v3_upload_attachment`
- **2026-08-01** `2acbb818b302`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/joincandidhealth/apis/api-reference/changes/api/organization-providers/v3/:organization_provider_id/attachments/put.md)

---

[API](https://skmtc.dev/joincandidhealth/apis/api-reference.md) - [All operations](https://skmtc.dev/joincandidhealth/apis/api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/joincandidhealth/apis/api-reference/revisions/d8b0a61873e2?raw)