---
title: "Upload Apple Messages for Business review evidence"
method: POST
path: "/v1/amb/business-account-attachments"
tags: ["amb-business-accounts"]
---

# Upload Apple Messages for Business review evidence

`POST /v1/amb/business-account-attachments`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/amb/business-account-attachments`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Uploads a private PDF or MP4 for a later business submission and returns expiring download and preview links.

## Headers

- `Idempotency-Key` string
- `X-Workspace-Id` string
- `X-Organization-Id` string

## Response `200`

An existing same-content attachment in this workspace, which may already be committed.

- Attachment: A supporting document uploaded for compliance answers or SMS registrations, including number ownership evidence, 10DLC campaign evidence and toll-free verification opt-in screenshots. Reference its ID from the relevant answer or registration attachment field to submit it as evidence.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `id` string, required
  - `filename` string, required: The uploaded file's name.
  - `content_type` string, required: The file's content type, determined from its contents.
  - `size_bytes` integer, required: The file's size in bytes.
  - `description` string: A short note describing what the file shows.
  - `status` 'draft' | 'attached', required: Lifecycle of an attachment. `draft` is a file that has been uploaded but nothing has been registered or submitted with it yet, and it is discarded at its `expires_at`. `attached` means at least one registration has cited it, so it is kept permanently and can no longer be deleted.
  - `download_url` string, uri, required: Short-lived signed URL for downloading or previewing the attachment. Valid for 24 hours from when the resource was fetched; request a fresh resource to obtain a new URL after expiry. Do not cache beyond `download_url_expires_at`. Registration authorities (10DLC and toll-free carriers) retrieve evidence via a separate, longer-lived token; this URL is not that token.
  - `preview_url` string, uri: Optional signed URL for inline viewing on an isolated storage origin. Valid for one hour; fetch the attachment again to refresh it.
  - `download_url_expires_at` string, date-time, required: When `download_url` expires. Both fields are always present; the server returns an error rather than omitting them.
  - `expires_at` string, date-time, nullable, required: When this attachment is discarded if nothing is registered or submitted with it. Null once its status is `attached`.

## Other responses

- `201`: The uploaded evidence attachment.
- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `409`: Resource conflict
- `413`: Request body or message size exceeds the allowed limit
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error
- `503`: The service is temporarily unavailable. If `Retry-After` is present, wait for that delay before retrying; otherwise, retry with exponential backoff. Reuse the same idempotency key and request when retrying a mutation.

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/3e2a50466454?raw)