Add Task Attachments

Endpoint

POST /v2/tasks/{task_id}/attachments

Authentication

This endpoint requires an OAuth access token. Send it as a bearer token:

Authorization: Bearer your_access_token

Required scope: tasks:write

The upload runs as the access token’s user, and the resulting activity log entry is attributed to them. A user who cannot reach the task receives 403.

Path Parameters

Parameter	Type	Required	Description
`task_id`	integer	Yes	ID of the task to attach files to

Request Body

All fields are optional, but a request that supplies neither files nor attachment_ids records nothing.

Field	Type	Required	Description
`files`	array	No	Files to upload and attach. Defaults to an empty list. See File Object below
`attach_to_task`	boolean	No	When `true`, the files are stored on the task itself as well as recorded on the activity log. When `false` they are recorded on the activity log only. Defaults to `false`
`attachment_ids`	array of integers or null	No	IDs of attachments that already exist on the task. Used when `attach_to_task` is `false` to reference them from the new activity log entry. Defaults to `null`
`reply_to`	integer or null	No	ID of an activity log entry this attachment is a reply to. Defaults to `null`
`user_email`	string or null	No	Ignored on this endpoint. The upload is always attributed to the access token’s user. Accepted for compatibility with the API-key surface

File Object

Field	Type	Required	Description
`filename`	string	Yes	Filename including its extension (e.g. `"amendment.pdf"`). The extension is read from this value
`base64_content`	string	Yes	Base64-encoded file content

Request Example

curl -X POST "https://platform.chamelio.ai/v2/tasks/12345/attachments" \
  -H "Authorization: Bearer your_access_token" \
  -H "Content-Type: application/json" \
  -d '{
    "files": [
      {
        "filename": "counterparty-redlines.pdf",
        "base64_content": "JVBERi0xLjQKJeLjz9MK..."
      }
    ],
    "attach_to_task": true
  }'

import base64
import requests

task_id = 12345

with open("counterparty-redlines.pdf", "rb") as f:
    content = base64.b64encode(f.read()).decode()

url = f"https://platform.chamelio.ai/v2/tasks/{task_id}/attachments"
headers = {
    "Authorization": "Bearer your_access_token",
    "Content-Type": "application/json"
}
payload = {
    "files": [
        {
            "filename": "counterparty-redlines.pdf",
            "base64_content": content
        }
    ],
    "attach_to_task": True
}

response = requests.post(url, headers=headers, json=payload)
print(response.json())

const taskId = 12345;

const response = await fetch(
  `https://platform.chamelio.ai/v2/tasks/${taskId}/attachments`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'Bearer your_access_token',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      files: [
        {
          filename: 'counterparty-redlines.pdf',
          base64_content: 'JVBERi0xLjQKJeLjz9MK...'
        }
      ],
      attach_to_task: true
    })
  }
);

const data = await response.json();
console.log(data);

Response

Success Response

Status Code: 200 OK

{
  "attachment_ids": [8821, 8822]
}

Response Fields

Field	Type	Description
`attachment_ids`	array of integers	IDs of the attachments that were added, in the order the files were supplied

Error Responses

400 Bad Request

Returned when the access token has no user behind it. client_credentials tokens act as the admin who created the application, so this applies only to tokens issued before application creators were recorded.

{
  "detail": "client_credentials tokens are not associated with a user"
}

401 Unauthorized

Returned when the access token is missing, unknown, revoked, or expired, or when an X-API-Key was sent instead of a bearer token. See OAuth error responses.

{
  "detail": "Invalid access token"
}

403 Forbidden

Returned when the token does not carry the required scope.

{
  "detail": "Insufficient scope; this endpoint requires: tasks:write"
}

Or when the access token’s user may not reach the task.

{
  "detail": "You do not have access to this resource"
}

404 Not Found

Returned when no task exists with the given ID.

{
  "detail": "Not found"
}

422 Unprocessable Entity

Returned when the request body fails validation, for example a file missing its base64_content.

{
  "detail": [
    {
      "loc": ["body", "files", 0, "base64_content"],
      "msg": "Field required",
      "type": "missing"
    }
  ]
}

429 Too Many Requests

Returned when your organization exceeds its per-minute request limit.

{
  "detail": "Rate limit exceeded"
}

500 Internal Server Error

Returned when the request fails due to a server error.

{
  "detail": "Failed to add task attachments"
}

Notes

attach_to_task controls where the files land. With false (the default) they are uploaded and referenced from a new activity log entry, leaving the task’s own file list untouched. With true they are additionally stored on the task, so they appear in List Task Files.

Pass reply_to with the ID of an existing activity log entry to thread the attachment underneath it, for example when responding to a counterparty email already recorded on the task. Entry IDs come from Get Activity Logs.

To reference files already on the task from a new activity log entry without re-uploading them, send their attachment_ids with attach_to_task set to false.

Use Cases

This endpoint is useful for:

Email ingestion - Attach documents received from a counterparty to the task they belong to
Supporting documentation - Add approvals, quotes, or certificates alongside a contract under review
Threaded correspondence - Use reply_to to keep an exchange and its attachments together on the activity log

Overview

API Key Access

OAuth App Access

Webhooks

Endpoint

Authentication

Path Parameters

Request Body

File Object

Request Example

Response

Success Response

Response Fields

Error Responses

400 Bad Request

401 Unauthorized

403 Forbidden

404 Not Found

422 Unprocessable Entity

429 Too Many Requests

500 Internal Server Error

Notes

Use Cases

​Endpoint

​Authentication

​Path Parameters

​Request Body

​File Object

​Request Example

​Response

​Success Response

​Response Fields

​Error Responses

​400 Bad Request

​401 Unauthorized

​403 Forbidden

​404 Not Found

​422 Unprocessable Entity

​429 Too Many Requests

​500 Internal Server Error

​Notes

​Use Cases

Endpoint

Authentication

Path Parameters

Request Body

File Object

Request Example

Response

Success Response

Response Fields

Error Responses

400 Bad Request

401 Unauthorized

403 Forbidden

404 Not Found

422 Unprocessable Entity

429 Too Many Requests

500 Internal Server Error

Notes

Use Cases