Upload a private conversation attachment
Uploads one private file to a conversation as multipart/form-data using the file field.
/api/conversations/{conversationId}/attachmentsUploads one private file to a conversation as multipart/form-data using the file field. The server enforces the 12 MiB request limit, validates the media type, stores the object privately, and returns attachment metadata with a download URL. Private operator Email attachments use a session-authorized proxy instead of a transferable signed URL. A visitor bearer token may upload only to its own conversation; organization API keys may upload only within their organization. Do not persist the signed URL; request a fresh attachment or access URL when it expires. Upload scanning and storage failures return an error without publishing a usable attachment.
Endpoint requirements
- Credentials
- Use either
Bearer API keyorX-API-Key header. - Required scope
conversations:write- Module
- Automation & API module (
api_access) - Organization and site scope
- Requests can access only resources owned by the authenticated organization. The API does not reveal whether an identifier belongs to another organization or site.
- Retry behavior
- Non-idempotent: Repeating this request may create duplicate work or side effects. After an ambiguous timeout, check the resource state before retrying.
Path Parameters
Resource identifier.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidHeader Parameters
DA-4035: selects the active site (project) for project-scoped operations. Accepts a site UUID, or the literal all to aggregate across every accessible site on read-only aggregate routes (single-or-all-read). Mutations and single-site routes reject all. Path-owned project routes (/api/projects/{projectId}/…) resolve the site from the URL and ignore this header. Conflicting selectors across header/query/body/path return PROJECT_CONTEXT_CONFLICT (400); an archived site returns PROJECT_ARCHIVED (410).
Request Body
multipart/form-data
TypeScript Definitions
Use the request body type in TypeScript.
Request body accepted by this operation.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
{ "id": "66666666-6666-4666-8666-666666666666", "attachmentId": "66666666-6666-4666-8666-666666666666", "filename": "invoice-2026.pdf", "originalName": "invoice-2026.pdf", "mimeType": "application/pdf", "size": 18432, "url": "https://files.example.invalid/private/signed-download"}Request examples
curl
curl --request POST \
'https://api.convor.io/api/conversations/22222222-2222-4222-8222-222222222222/attachments' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer convor_sk_...' \
--form 'file=@/path/to/example.txt'JavaScript
const formData = new FormData();
formData.append("file", new File(["replace-with-file-bytes"], "example.txt", {type: "text/plain"}));
const response = await fetch("https://api.convor.io/api/conversations/22222222-2222-4222-8222-222222222222/attachments", {
method: "POST",
headers: {
"Accept": "application/json",
"Authorization": "Bearer convor_sk_..."
},
body: formData,
});
const contentType = response.headers.get("content-type") ?? "";
const data = response.status === 204
? null
: contentType.includes("json")
? await response.json()
: contentType.startsWith("text/")
? await response.text()
: await response.blob();
if (!response.ok) {
const message = typeof data === "object" && data !== null
&& "error" in data && typeof data.error === "object"
&& data.error !== null && "message" in data.error
? String(data.error.message)
: "Convor API request failed (" + response.status + ")";
throw new Error(message);
}
console.log(data);Was this page helpful?