---
title: "Upload a file"
method: POST
path: "/tasks/{taskId}/attachments"
tags: ["Attachments"]
---

# Upload a file

`POST /tasks/{taskId}/attachments`

## Request

- Base URL: `https://tasg.app/api/v1`
- URL: `https://tasg.app/api/v1/tasks/{taskId}/attachments`
- Auth: HTTP bearer

multipart/form-data with a single `file` field, max 25 MB. Allowed types: JPEG, PNG, GIF, WebP, PDF, plain text, CSV, ZIP, Word, Excel, PowerPoint (SVG is refused). The project owner is notified.

## Path parameters

- `taskId` string, uuid, required

## Response `201`

Stored.

- Attachment
  - `id` string, uuid, required
  - `task_id` string, uuid, required
  - `comment_id` string, uuid, nullable
  - `filename` string, required
  - `file_size` integer, required: Bytes.
  - `mime_type` string, required
  - `url` string, required: Relative download path (`/uploads/…`); requires the same Authorization header.
  - `uploaded_by` string, uuid, required
  - `created_at` string, date-time, required

## Other responses

- `400`: Validation failed: the body or query did not match the schema, or a business rule was violated. `error` says which.
- `401`: Missing, invalid, expired or revoked credentials.
- `403`: Authenticated, but not allowed: not a member, insufficient project role or the API token lacks the required scope.
- `404`: Not found, or not visible to the caller (tenancy is enforced: foreign resources look identical to missing ones).
- `429`: Rate limited. Back off and retry after the window in the `RateLimit-*` headers.

---

[API](https://skmtc.dev/tasg/apis/tasg-api.md) · [All operations](https://skmtc.dev/tasg/apis/tasg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tasg/apis/tasg-api/revisions/cd2a1dbaf5cf?raw)