# Upload an incident attachment — API reference

> Uploads one incident attachment and returns its stored filename, media type, size and identifier.

Source: https://upfour.io/docs/api/incidents/upload-an-incident-attachment

[Developers](https://upfour.io/docs/api.md)/[Incidents](https://upfour.io/docs/api/incidents.md)

Uploads one incident attachment and returns its stored filename, media type, size and identifier.

POST https://app.upfour.io/v1/incidents/{incidentID}/attachments

scope incident.write stable [Idempotency-Key supported](https://upfour.io/docs/api/idempotency.md) returns 201

## Parameters

| Field | Type | Description |
| --- | --- | --- |
| `incidentID` required | uuid | path parameter |

## Body

`multipart/form-data` required

filefile (required)

## Returns

A successful request returns `201` with application/json.

Response fields 1 top-level fields

| Field | Type | Description |
| --- | --- | --- |
| `data` | IncidentAttachment | |
| IncidentAttachment · 8 fields FieldTypeDescription `created_at` string (date-time) `file_size` integer `filename` string `id` uuid `incident_id` uuid `mime_type` string `storage_key` string The server-side storage key of the file. Download it from the attachment endpoint instead. `uploaded_by` uuid  · nullable | | |

## Errors

Only the errors this operation can return. Every error uses the [same envelope](https://upfour.io/docs/api/responses.md).

| Status | Code | Meaning |
| --- | --- | --- |
| 400 | [attachment_empty](https://upfour.io/docs/api/errors#code-attachment_empty) | The attachment file is empty. **When:** Uploading an incident attachment of zero bytes. **Fix:** Upload a file that has content. Stable codes next to the English message: `attachment_empty` (the file has no content), `attachment_type_unsupported` (only images, PDF, text, CSV and JSON can be attached), `upload_no_file` (the form has no `file` part), `upload_invalid` (the multipart form could not be read). |
| 413 | [attachment_too_large](https://upfour.io/docs/api/errors#code-attachment_too_large) | The attachment is over the size limit. **When:** Uploading an incident attachment larger than the limit; details.max_bytes gives it. **Fix:** Compress or split the file below details.max_bytes. `attachment_too_large`: the file is larger than 10 MB (`error.details.max_bytes`). A proxy in front of the API may answer 413 with a plain HTML body and no code. |
| 400 | [attachment_type_unsupported](https://upfour.io/docs/api/errors#code-attachment_type_unsupported) | The attachment's file type is not accepted. **When:** Uploading an incident attachment whose MIME type is not on the allowed list. **Fix:** Upload a file of an allowed type. |
| 400 | [bad_request](https://upfour.io/docs/api/errors#code-bad_request) | The request is malformed or fails validation. |
| 402 | [billing_action_unavailable](https://upfour.io/docs/api/errors#code-billing_action_unavailable) | The Company's billing state does not allow this action. **When:** A metered or limited action while the billing state, such as paused or without credit, blocks it; details holds the action and billing_state. **Fix:** Top up the credit or change the plan, then retry. |
| 404 | [not_found](https://upfour.io/docs/api/errors#code-not_found) | The requested resource does not exist or is outside the caller's scope. |
| 403 | [permission_denied](https://upfour.io/docs/api/errors#code-permission_denied) | The credentials do not permit this action. |
| 503 | [quota_gate_unavailable](https://upfour.io/docs/api/errors#code-quota_gate_unavailable) | The limit check itself failed, so the action was not carried out. **When:** The quota service could not decide while the request ran. **Fix:** Retry in a moment; nothing was changed. |
| 403 / 429 | [quota_limit_reached](https://upfour.io/docs/api/errors#code-quota_limit_reached) | A usage or inventory limit of the Company was reached. **When:** Counters and concurrency limits answer 429 with Retry-After, inventory and capacity limits answer 403; details holds purpose, limit and window. **Fix:** On 429 wait Retry-After seconds; on 403 free something up, request a higher limit where details.raise_request is true, or buy an extension. |
| 200 / 410 / 413 / 422 | [request_failed](https://upfour.io/docs/api/errors#code-request_failed) | The request could not be completed. |
| 503 | [service_unavailable](https://upfour.io/docs/api/errors#code-service_unavailable) | The service or a required dependency is temporarily unavailable. |
| 400 | [upload_invalid](https://upfour.io/docs/api/errors#code-upload_invalid) | The upload could not be read as a multipart form. **When:** A body that is not a valid multipart form, or whose file cannot be parsed. **Fix:** Send a well-formed multipart/form-data request. |
| 400 | [upload_no_file](https://upfour.io/docs/api/errors#code-upload_no_file) | The multipart request has no file part. **When:** An upload request without a file field. **Fix:** Send the file as multipart/form-data in the field the operation names. |

Every call can also return `unauthorized` (401), `rate_limit_exceeded` (429) or `internal_error` (500 / 502). See [Responses and errors](https://upfour.io/docs/api/responses.md).

[PreviousList incident attachments](https://upfour.io/docs/api/incidents/list-incident-attachments.md) [NextDelete an incident attachment](https://upfour.io/docs/api/incidents/delete-an-incident-attachment.md)

## Request

### cURL

```bash
curl -s -X POST "https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments" \
  -H "Authorization: Bearer $UP4_API_KEY" \
  -F "file=@./file.png"
```

### JavaScript

```javascript
import { readFile } from "node:fs/promises";

const fileBytes = await readFile("./file.png");

const form = new FormData();
form.append("file", new Blob([fileBytes]), "file.png");

const res = await fetch("https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.UP4_API_KEY}`,
  },
  body: form,
});
console.log(res.status, await res.json());
```

### Python

```python
import os
import requests

res = requests.post(
    "https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments",
    headers={"Authorization": f"Bearer {os.environ['UP4_API_KEY']}"},
    files={"file": open("./file.png", "rb")},
)
print(res.status_code, res.json())
```

### Go

```go
package main

import (
	"bytes"
	"fmt"
	"io"
	"mime/multipart"
	"net/http"
	"os"
)

func main() {
	var buf bytes.Buffer
	w := multipart.NewWriter(&buf)
	part, _ := w.CreateFormFile("file", "file.png")
	file, _ := os.Open("./file.png")
	io.Copy(part, file)
	w.Close()
	req, _ := http.NewRequest("POST", "https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments", &buf)
	req.Header.Set("Authorization", "Bearer "+os.Getenv("UP4_API_KEY"))
	req.Header.Set("Content-Type", w.FormDataContentType())
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	out, _ := io.ReadAll(res.Body)
	fmt.Println(res.StatusCode, string(out))
}
```

### PHP

```php
<?php
$ch = curl_init("https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments");
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer " . getenv("UP4_API_KEY"),
    ],
    CURLOPT_POSTFIELDS => ["file" => new CURLFile("./file.png")],
]);
$response = curl_exec($ch);
echo curl_getinfo($ch, CURLINFO_RESPONSE_CODE), " ", $response, "\n";
curl_close($ch);
```

## Response

### 201

```json
{
  "data": {
    "created_at": "2026-10-27T09:00:00Z",
    "file_size": 42,
    "filename": "checkout-error.txt",
    "id": "00000000-0000-4000-8000-000000000002",
    "incident_id": "00000000-0000-4000-8000-000000000001",
    "mime_type": "text/plain",
    "storage_key": "00000000-0000-4000-8000-000000000001/00000000-0000-4000-8000-000000000003_checkout-error.txt",
    "uploaded_by": "00000000-0000-4000-8000-000000000004"
  }
}
```

### 200

```json
{
  "error": {
    "code": "request_failed",
    "message": "The request could not be completed.",
    "request_id": "req_…"
  }
}
```

### 400

```json
{
  "error": {
    "code": "attachment_empty",
    "message": "The attachment file is empty.",
    "request_id": "req_…"
  }
}
```

### 402

```json
{
  "error": {
    "code": "billing_action_unavailable",
    "message": "The Company's billing state does not allow this action.",
    "request_id": "req_…"
  }
}
```

### 403

```json
{
  "error": {
    "code": "permission_denied",
    "message": "The credentials do not permit this action.",
    "request_id": "req_…"
  }
}
```

### 404

```json
{
  "error": {
    "code": "not_found",
    "message": "The requested resource does not exist or is outside the caller's scope.",
    "request_id": "req_…"
  }
}
```

### 410

```json
{
  "error": {
    "code": "request_failed",
    "message": "The request could not be completed.",
    "request_id": "req_…"
  }
}
```

### 413

```json
{
  "error": {
    "code": "attachment_too_large",
    "message": "The attachment is over the size limit.",
    "request_id": "req_…"
  }
}
```

### 422

```json
{
  "error": {
    "code": "request_failed",
    "message": "The request could not be completed.",
    "request_id": "req_…"
  }
}
```

### 429

```json
{
  "error": {
    "code": "quota_limit_reached",
    "message": "A usage or inventory limit of the Company was reached.",
    "request_id": "req_…"
  }
}
```

### 503

```json
{
  "error": {
    "code": "quota_gate_unavailable",
    "message": "The limit check itself failed, so the action was not carried out.",
    "request_id": "req_…"
  }
}
```