---
title: "Upload session file"
method: POST
path: "/v1/agents/sessions/{session_id}/files"
tags: ["Sessions"]
---

# Upload session file

`POST /v1/agents/sessions/{session_id}/files`

## Request

- Base URL: `https://api.sandbase.ai`
- URL: `https://api.sandbase.ai/v1/agents/sessions/{session_id}/files`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Upload one attachment (multipart field file, maximum 5 MiB) into the Session workspace. Idempotency-Key is required. Supported extensions: .txt, .md, .csv, .log, .json, .pdf, .png, .jpg, .jpeg, .webp. A failed transfer still returns 201 with status failed.

## Headers

- `Idempotency-Key` string, required

## Response `201`

Attachment record

- SessionFile
  - `id` string, required: Attachment ID (`fil_` prefix).
  - `session_id` string, required
  - `name` string, required
  - `mime_type` string, required
  - `size_bytes` integer, required
  - `status` 'pending' | 'ready' | 'failed' | 'deleted', required: Only ready attachments can be sent or downloaded.
  - `error_code` string
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: invalid_request (malformed JSON, unknown fields, failed validation, or an unsupported option)
- `401`: unauthorized: missing, malformed, or conflicting API key headers
- `402`: spending_limit_exceeded: API key spending limit or organization balance exhausted
- `403`: insufficient_scope (scoped key) or org_disabled
- `404`: not_found: the resource does not exist in this organization
- `409`: conflict: stale row_version, lifecycle state, or Idempotency-Key reused with a different body
- `503`: authorization_unavailable, admission_unavailable, executor_unavailable, storage_unavailable, or internal_error

---

[API](https://skmtc.dev/sandbase/apis/sandbase-api.md) · [All operations](https://skmtc.dev/sandbase/apis/sandbase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sandbase/apis/sandbase-api/revisions/d40df2467ba2?raw)