Upload an attachment

POST /api/v1/community/attachments

Deposits a file and returns its attachment id. No post is touched: send the id to Attach to a thread when you are ready. An attachment left unattached for 24 hours is deleted.

The body is multipart/form-data with one part named file.

Authorization

Request headers

No Idempotency-Key: a deposit claims no key, and every call stores a new file.

Request body

Example

curl -X POST "$COHORTE_API_BASE_URL/api/v1/community/attachments" \
  -H "x-api-key: $COHORTE_API_KEY" \
  -F "file=@call-grid.zip"

Response

• 201 Created — the file is stored.
• 400 Bad Request — no file part, an empty file, a refused type, or a file over 10 MB.
• 401 Unauthorized — the key is missing, invalid, or no longer attached to a member.

Response fields

Example response

{
  "success": true,
  "data": {
    "id": "0f1c6d8a-2a5e-4f51-9d1e-7c4b2a9f3e10",
    "name": "call-grid.zip",
    "mimeType": "application/zip",
    "sizeBytes": 204800,
    "threadId": null,
    "replyId": null,
    "createdAt": "2026-09-21T10:12:00.000Z"
  },
  "correlationId": "1b1f7a1e-6d54-4f0c-8f97-2b2a1a7f5d33"
}

Notes

• The stored path is opaque and never returned: a file is only reachable through the application, which re-checks the space permission.
• Archives are never opened server-side, not even to count their entries.

Related

• Attach to a thread