Uploads one private file to a conversation as `multipart/form-data` using the `file` field. The server enforces the 12 MiB request limit, validates the media type, stores the object privately, and returns attachment metadata with a short-lived signed download URL. A visitor bearer token may upload only to its own conversation; organization API keys may upload only within their organization. Authenticate with an organization API key sent in `X-API-Key` or as a Bearer token and carrying the exact `conversations:write` scope. API-key access also requires the Automation & API module (`automation_api`). Authorized dashboard sessions remain supported where the route already permits them. The request is isolated to the authenticated organization. Resource and site/project identifiers must belong to that organization; out-of-scope identifiers are not disclosed. Do not persist the signed URL; request a fresh attachment or access URL when it expires. Upload scanning and storage failures return an error without publishing a usable attachment. Retry behavior: This operation is not idempotent. After an ambiguous timeout, read the resource state before retrying to avoid duplicate work, messages, files, bookings, exports, or events.
/api/conversations/{conversationId}/attachmentsOrganization API key supplied as Authorization: Bearer convor_sk_....
In: header
multipart/form-data
TypeScript Definitions
Use the request body type in TypeScript.
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
{
"id": "66666666-6666-4666-8666-666666666666",
"attachmentId": "66666666-6666-4666-8666-666666666666",
"filename": "invoice-2026.pdf",
"originalName": "invoice-2026.pdf",
"mimeType": "application/pdf",
"size": 18432,
"url": "https://files.example.invalid/private/signed-download"
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}curl --request POST \
'https://api.convor.io/api/conversations/22222222-2222-4222-8222-222222222222/attachments' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer convor_sk_...' \
--form 'file=@/path/to/example.txt'const formData = new FormData();
formData.append("file", new File(["replace-with-file-bytes"], "example.txt", {type: "text/plain"}));
const response = await fetch("https://api.convor.io/api/conversations/22222222-2222-4222-8222-222222222222/attachments", {
method: "POST",
headers: {
"Accept": "application/json",
"Authorization": "Bearer convor_sk_..."
},
body: formData,
});
const contentType = response.headers.get("content-type") ?? "";
const data = response.status === 204
? null
: contentType.includes("json")
? await response.json()
: contentType.startsWith("text/")
? await response.text()
: await response.blob();
if (!response.ok) {
const message = typeof data === "object" && data !== null
&& "error" in data && typeof data.error === "object"
&& data.error !== null && "message" in data.error
? String(data.error.message)
: "Convor API request failed (" + response.status + ")";
throw new Error(message);
}
console.log(data);Was this page helpful?
Get a private attachment and a fresh signed URL
Returns private attachment metadata and a newly signed download URL. The attachment must belong to the path conversation and authenticated organization. Visitor bearer callers can access only attachments in their own conversation. Authenticate with an organization API key sent in `X-API-Key` or as a Bearer token and carrying the exact `conversations:read` scope. API-key access also requires the Automation & API module (`automation_api`). Authorized dashboard sessions remain supported where the route already permits them. The request is isolated to the authenticated organization. Resource and site/project identifiers must belong to that organization; out-of-scope identifiers are not disclosed. The signed URL is temporary and must not be treated as a stable public object URL. Retry behavior: This read-only operation is safe to retry.
Visitors
Visitor management