---
title: "Upload a file"
method: POST
path: "/api/external/v2/file_attachments"
tags: ["File Attachments"]
---

# Upload a file

`POST /api/external/v2/file_attachments`

## Request

- Base URL: `https://app.pennylane.com`
- URL: `https://app.pennylane.com/api/external/v2/file_attachments`
- Auth: OAuth 2
  - Authorization code: `https://app.pennylane.com/oauth/authorize`
  - Token URL: `https://app.pennylane.com/oauth/oauth/token` scopes: `file_attachments:all`

Upload a file to attach to any resource that provides a `file_attachment_id`.

The maximum allowed file size is 100MB.
Note that this will not upload a file into the DMS (GED).


> ℹ️
> This endpoint requires the following scope: `file_attachments:all`

## Headers

- `X-Company-Id` string

## Request body `multipart/form-data`

- object
  - `file` string, binary, required: The file you want to upload. Allowed content types: - image/png - image/jpeg - image/tiff - image/bmp - image/gif - application/pdf
  - `filename` string: Name of the file. If not provided, the default value will be the uploaded file name.

## Response `201`

Returns the created attachment

- object
  - `id` integer, required
  - `url` string, required: URL to the uploaded file.
  - `filename` string, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Bad request
- `401`: Access token is missing or invalid
- `403`: Access to this resource forbidden
- `404`: The resource was not found
- `422`: Unprocessable content

## Changes

- **2026-11-03** `871f863307e5`: 1 info
  - added the new optional `header` request parameter `X-Company-Id`

[Operation history](https://skmtc.dev/pennylane/apis/company-v2/changes/api/external/v2/file_attachments/post.md)

---

[API](https://skmtc.dev/pennylane/apis/company-v2.md) - [All operations](https://skmtc.dev/pennylane/apis/company-v2/llms.txt) - [OpenAPI document](https://skmtc.dev/pennylane/apis/company-v2/revisions/871f863307e5?raw)