Upload an incident attachment

Uploads one incident attachment and returns its stored filename, media type, size and identifier.

POST https://app.upfour.io/v1/incidents/{incidentID}/attachments

A real request. Sending it changes data in your up4 account.

Authorization

AuthorizationA pls_ key. It stays in this browser tab. Needs incident.write.

Path

incidentIDpath · requiredPart of the request path.

This call takes multipart/form-data. The console sends JSON only; use the curl example.

Headers

Idempotency-KeyheaderGenerated automatically when empty. How it works

Sent directly from your browser to https://app.upfour.io/v1. Mutating calls get an automatic Idempotency-Key when the field is empty.

Request

Responsenot sent yet

Fill in a key and press Send request (⌘↵).
The answer appears here.

scope incident.write stable Idempotency-Key supported returns 201

Parameters

Field	Type	Description
`incidentID` required	uuid	path parameter

Body

multipart/form-data required

filefilerequired

Returns

A successful request returns 201 with application/json.

Response fields 1 top-level fields

Field Type Description

data IncidentAttachment

IncidentAttachment · 8 fields

Field	Type	Description
`created_at`	string (date-time)
`file_size`	integer
`filename`	string
`id`	uuid
`incident_id`	uuid
`mime_type`	string
`storage_key`	string	The server-side storage key of the file. Download it from the attachment endpoint instead.
`uploaded_by`	uuid · nullable

Errors

Only the errors this operation can return. Every error uses the same envelope.

Status	Code	Meaning
400	`attachment_empty`	The attachment file is empty. When: Uploading an incident attachment of zero bytes. Fix: Upload a file that has content. Stable codes next to the English message: `attachment_empty` (the file has no content), `attachment_type_unsupported` (only images, PDF, text, CSV and JSON can be attached), `upload_no_file` (the form has no `file` part), `upload_invalid` (the multipart form could not be read).
413	`attachment_too_large`	The attachment is over the size limit. When: Uploading an incident attachment larger than the limit; details.max_bytes gives it. Fix: Compress or split the file below details.max_bytes. `attachment_too_large`: the file is larger than 10 MB (`error.details.max_bytes`). A proxy in front of the API may answer 413 with a plain HTML body and no code.
400	`attachment_type_unsupported`	The attachment's file type is not accepted. When: Uploading an incident attachment whose MIME type is not on the allowed list. Fix: Upload a file of an allowed type.
400	`bad_request`	The request is malformed or fails validation.
402	`billing_action_unavailable`	The Company's billing state does not allow this action. When: A metered or limited action while the billing state, such as paused or without credit, blocks it; details holds the action and billing_state. Fix: Top up the credit or change the plan, then retry.
404	`not_found`	The requested resource does not exist or is outside the caller's scope.
403	`permission_denied`	The credentials do not permit this action.
503	`quota_gate_unavailable`	The limit check itself failed, so the action was not carried out. When: The quota service could not decide while the request ran. Fix: Retry in a moment; nothing was changed.
403 / 429	`quota_limit_reached`	A usage or inventory limit of the Company was reached. When: Counters and concurrency limits answer 429 with Retry-After, inventory and capacity limits answer 403; details holds purpose, limit and window. Fix: On 429 wait Retry-After seconds; on 403 free something up, request a higher limit where details.raise_request is true, or buy an extension.
200 / 410 / 413 / 422	`request_failed`	The request could not be completed.
503	`service_unavailable`	The service or a required dependency is temporarily unavailable.
400	`upload_invalid`	The upload could not be read as a multipart form. When: A body that is not a valid multipart form, or whose file cannot be parsed. Fix: Send a well-formed multipart/form-data request.
400	`upload_no_file`	The multipart request has no file part. When: An upload request without a file field. Fix: Send the file as multipart/form-data in the field the operation names.

Every call can also return unauthorized (401), rate_limit_exceeded (429) or internal_error (500 / 502). See Responses and errors.

import { readFile } from "node:fs/promises"; const fileBytes = await readFile("./file.png"); const form = new FormData(); form.append("file", new Blob([fileBytes]), "file.png"); const res = await fetch("https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments", { method: "POST", headers: { Authorization: `Bearer ${process.env.UP4_API_KEY}`, }, body: form, }); console.log(res.status, await res.json());

import os import requests res = requests.post( "https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments", headers={"Authorization": f"Bearer {os.environ['UP4_API_KEY']}"}, files={"file": open("./file.png", "rb")}, ) print(res.status_code, res.json())

package main import ( "bytes" "fmt" "io" "mime/multipart" "net/http" "os" ) func main() { var buf bytes.Buffer w := multipart.NewWriter(&buf) part, _ := w.CreateFormFile("file", "file.png") file, _ := os.Open("./file.png") io.Copy(part, file) w.Close() req, _ := http.NewRequest("POST", "https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments", &buf) req.Header.Set("Authorization", "Bearer "+os.Getenv("UP4_API_KEY")) req.Header.Set("Content-Type", w.FormDataContentType()) res, err := http.DefaultClient.Do(req) if err != nil { panic(err) } defer res.Body.Close() out, _ := io.ReadAll(res.Body) fmt.Println(res.StatusCode, string(out)) }

<?php $ch = curl_init("https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments"); curl_setopt_array($ch, [ CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => [ "Authorization: Bearer " . getenv("UP4_API_KEY"), ], CURLOPT_POSTFIELDS => ["file" => new CURLFile("./file.png")], ]); $response = curl_exec($ch); echo curl_getinfo($ch, CURLINFO_RESPONSE_CODE), " ", $response, "\n"; curl_close($ch);

{ "data": { "created_at": "2026-10-27T09:00:00Z", "file_size": 42, "filename": "checkout-error.txt", "id": "00000000-0000-4000-8000-000000000002", "incident_id": "00000000-0000-4000-8000-000000000001", "mime_type": "text/plain", "storage_key": "00000000-0000-4000-8000-000000000001/00000000-0000-4000-8000-000000000003_checkout-error.txt", "uploaded_by": "00000000-0000-4000-8000-000000000004" } }