Upload Attachment

POST /attachments

Store a file and answer with the attachment_id a turn references it by.

multipart/form-data with a file part and an optional filename field, at most 16 MiB. The type is read from the bytes: jpeg, png, webp and gif images (re-encoded within 2048 px, without EXIF or any other metadata), application/pdf, and audio. Anything else is 422 attachment_media_type_unsupported, and bytes that are not what the declared type says are 422 attachment_media_type_mismatch. The answer describes the stored file.

An upload that no run uses is deleted after 24 hours (expires_at).

Role floor

Requires member or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Responses

Status	Description	Body
201	Successful Response	AttachmentView

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

curl -X POST https://your-deployment.example.com/attachments \
  -H "Authorization: Bearer $COBRE_TOKEN"

Response — AttachmentView

Field	Type		Notes
attachment_id	string (uuid)	required	—
media_type	string	required	—
size_bytes	integer	required	—
width	integer | null	optional	—
height	integer | null	optional	—
filename	string | null	optional	—
expires_at	string (date-time) | null	optional	—