attachments

Create a registration attachment

Changed on

Uploads a document that answers a compliance requirement, such as the proof of address a country asks for before it approves a number. Send the file as a multipart/form-data body with the bytes in a file part.

A requirement whose data_type is document is answered with attachment IDs rather than a typed value. Pass the returned ID as the answer's attachment_id, or in its attachment_ids where the requirement accepts several. Upload before you file the submission that cites the attachment. An unused attachment expires after seven days. After a submission cites it, the attachment no longer expires and you can reuse it elsewhere in the workspace, including as evidence for a 10DLC registration. Toll-free verification evidence must be a PNG or JPEG image.

PNG, JPEG, and PDF files up to 10 MB are accepted. Uploading a file whose contents match an existing attachment returns that attachment instead of creating a duplicate.

post/v1/compliance/attachments

Request

  • Base URL: https://us1.platform.bird.com
  • URL: https://us1.platform.bird.com/v1/compliance/attachments
  • Auth: one of:
    • HTTP bearer
    • API key in cookie bird_session

Headers

Idempotency-Keystring

Client-supplied key. On operations supporting request deduplication, a retained response is replayed for duplicate requests with the same key within the idempotency window (3 hours by default). This protection requires a workspace, organization, or staff-account scope. User-only and unscoped unauthenticated operations, streams, and operations with a separate replay contract do not use this response replay.

On a supported operation, if idempotency protection is unavailable before execution, the API returns 503 IdempotencyUnavailable (E01033) without executing this attempt. Retry with backoff using the same key and request. An operation that takes effect before its response is retained can still execute again on retry.

Two distinct 409 errors signal misuse:

  • request_in_progress (E01004): The same key is currently being processed by a concurrent request. Wait briefly and retry. The lock expires within 30 seconds.
  • idempotency_key_reuse (E01005): The same key has already completed against a different request body or method. Generate a new key.

Recommended key format is <event-type>/<entity-id> (for example welcome-user/usr_abc123).

X-Workspace-Idstring

Workspace context for the request. Required for dashboard authentication and master keys. Workspace keys and access tokens already identify their workspace; send that workspace or omit the header. A different one is rejected.

X-Organization-Idstring

Organization context for the request. Required for dashboard authentication. An API key or access token carries its own organization, so send either that organization or no header at all; a different one is rejected.

Response

An attachment with identical contents already existed and was returned unchanged.

created_atstring date-time required
updated_atstring date-time required
idstring required
filenamestring required

The uploaded file's name.

content_typestring required

The file's content type, determined from its contents.

size_bytesinteger required

The file's size in bytes.

descriptionstring

A short note describing what the file shows.

status'draft' | 'attached' required

Lifecycle of an attachment. draft is a file that has been uploaded but nothing has been registered or submitted with it yet, and it is discarded at its expires_at. attached means at least one registration has cited it, so it is kept permanently and can no longer be deleted.

download_urlstring uri required

Short-lived signed URL for downloading or previewing the attachment. Valid for 24 hours from when the resource was fetched; request a fresh resource to obtain a new URL after expiry. Do not cache beyond download_url_expires_at. Registration authorities (10DLC and toll-free carriers) retrieve evidence via a separate, longer-lived token; this URL is not that token.

preview_urlstring uri

Optional signed URL for inline viewing on an isolated storage origin. Valid for one hour; fetch the attachment again to refresh it.

download_url_expires_atstring date-time required

When download_url expires. Both fields are always present; the server returns an error rather than omitting them.

expires_atstring date-time nullable required

When this attachment is discarded if nothing is registered or submitted with it. Null once its status is attached.

Example response

{
  "created_at": "2026-05-20T09:14:52Z",
  "updated_at": "2026-05-25T16:42:01Z",
  "id": "tca_01krdgeqcxet5s7t44vh8rt9mg"
}

Changes