--- title: "Create an attachment" method: POST path: "/entry/{entry_slug}/attachment/{tab_slug}" tags: ["Attachments"] --- # Create an attachment `POST /entry/{entry_slug}/attachment/{tab_slug}` Creates an attachment on the specified entry under the specified tab. ## Headers - `Accept` 'application/vnd.Creative Force.v2.3+json' | 'application/vnd.Creative Force.v2.3+xml', required - `x-api-language` string[] ## Request body - object - `filename` string, required — Original filename of the uploaded file, including the extension. - `data` string, byte, required — Base64-encoded contents of the file. The encoded payload must round-trip cleanly through standard base64 decoding; payloads with stray characters, incorrect padding, or other malformed encoding are rejected. - `order` integer, required — Position of the attachment within its tab. Lower values sort earlier. - `attachment_fields` object — Values for the form fields captured against this attachment, keyed by field slug. Each value must conform to the type of the corresponding field on the parent attachments tab: - `text`, `textarea`, `email`, `url`, `phone`, `ai` — string. - `numeric` — number. - `currency` — string holding a decimal value, for example `"1234.56"`. - `checkbox` — boolean (`true`/`false`; `1` and `0` are also accepted). - `radio`, `drop-down-list` — string matching one of the defined option keys for the field (case-insensitive). - `checkboxlist` — array of option keys, or a comma-separated string such as `"opt1,opt2"`. - `country` — ISO 3166 alpha-2 country code; lower-case codes are accepted and stored upper-cased. - `date` — `YYYY-MM-DD` string or an object such as `{date: "2026-06-16"}`; the bare string form is wrapped server-side into the object form. - `datetime` — `YYYY-MM-DD HH:MM` string or an object such as `{date: "2026-06-16 14:30"}`; same wrapping behaviour as `date`. - `time` — `HH:MM` string. Field slugs that do not exist on the parent tab are rejected. Fields marked as required on the parent tab must be supplied; omitting them returns a 422. `formula` fields are computed server-side and cannot be set through this property. `file` fields are not settable here; upload files through `POST /entry/{entry_slug}/upload/{field_slug}` instead. `table` and `lookup` field types are not handled by this property; consult their dedicated endpoints if your tab uses them. ## Response `201` Attachment created. - AttachmentCreateResult — Receipt returned after an attachment is created. Carries the short opaque token and canonical URL for the new attachment together with the underlying file record, so callers can immediately reference the new attachment and fetch the stored file. - `token` string — Opaque identifier for the new attachment. Used as the `{token}` path parameter on `/attachment/{token}`. - `link` string, uri — Canonical URL for the new attachment resource. - `file` UploadResult — Receipt returned when a file is uploaded to a category, chapter, entry, or user field. Carries the original filename, a short opaque token that addresses the stored file, and the canonical URL through which the file can be retrieved. - `filename` string — Original filename of the uploaded file, including the extension. - `token` string — Opaque identifier for the stored file. Used as the `{token}` path parameter on `/file/{token}`. - `link` string, uri — Canonical URL for retrieving the uploaded file. ## Other responses - `400` — Request was rejected before the endpoint could process it. Common causes: invalid `Accept` header, unsupported `x-api-language` code, empty request body on `POST` / `PUT`, invalid JSON in the request body, or an invalid slug format in a path parameter. - `401` — Missing `x-api-key` header. - `403` — Authenticated request denied. Common causes: invalid or unknown API key, suspended account, or `api` feature not enabled for the account. - `404` — Resource identified by the path slug does not exist. Returned when the slug is well-formed but no record matches it. - `422` — Request was syntactically valid but could not be processed. Returned in two scenarios: - **Field-level validation failure** — one or more request fields violated the endpoint's validation rules. The body includes an `errors` map keyed by field name with one or more validation messages each. - **Resource-state precondition failure** — the request fields were all valid, but the target resource was in a state that does not permit the requested operation. The body carries only `message` and `status_code`; no `errors` map. - `429` — Rate limit of 60 requests per minute exceeded. - `503` — Service is temporarily unavailable due to regional maintenance. ## Changes - **2026-07-07** (v2) `9b9103538ceb` — 2 info - api tag `Attachments` added - api tag `Attachment` removed - **2026-07-01** (v2) `e96a96d4507e` — 8 info - added the media type `application/xml` for the response with the status `201` - added the media type `application/xml` for the response with the status `400` - added the media type `application/xml` for the response with the status `401` - added the media type `application/xml` for the response with the status `403` - …4 more [Change history](https://skmtc.dev/tectonic/apis/award-force-api/changes/entry/:entry_slug/attachment/:tab_slug/post.md) --- [API](https://skmtc.dev/tectonic/apis/award-force-api.md) · [All operations](https://skmtc.dev/tectonic/apis/award-force-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tectonic/award-force-api/revisions/e2511e46f9f2/schema)