Attachments

Attach an existing repo upload to a thread, reply, pull, or pull review.

File uploads Attachments OpenAPI JSON
Attachment requests only link uploads that already exist in the same repo. Create the upload first with the file upload API, then send its upload_uuid. Attachment endpoints do not accept file bytes.

Attach

POST /api/v1/teams/{team_slug}/repos/{repo_slug}/threads/{number}/attachments
POST /api/v1/teams/{team_slug}/repos/{repo_slug}/threads/{number}/replies/{reply_number}/attachments
POST /api/v1/teams/{team_slug}/repos/{repo_slug}/pulls/{number}/attachments
POST /api/v1/teams/{team_slug}/repos/{repo_slug}/pulls/{number}/reviews/{review_uuid}/attachments

POST /api/v1/users/{username}/repos/{repo_slug}/threads/{number}/attachments
POST /api/v1/users/{username}/repos/{repo_slug}/threads/{number}/replies/{reply_number}/attachments
POST /api/v1/users/{username}/repos/{repo_slug}/pulls/{number}/attachments
POST /api/v1/users/{username}/repos/{repo_slug}/pulls/{number}/reviews/{review_uuid}/attachments

Send a JSON body containing the existing upload UUID:

{
  "upload_uuid": "93dc0846-f01f-46a5-83b1-782bef8d7229"
}

The upload must be active and belong to the target repo. A closed pull can receive an attachment; a merged pull, removed thread or reply, and removed pull review cannot.

Detach

Append /{upload_uuid} to any attach endpoint and send DELETE.

DELETE /api/v1/teams/{team_slug}/repos/{repo_slug}/threads/{number}/attachments/{upload_uuid}
DELETE /api/v1/users/{username}/repos/{repo_slug}/pulls/{number}/reviews/{review_uuid}/attachments/{upload_uuid}

Detaching remains available after the upload or target is removed and after a pull is merged. The user who created the attachment can always detach it.

Permissions

  • Thread attachments require the thread creator.
  • Reply attachments require the reply creator.
  • Pull attachments require the pull creator or a repo maintainer.
  • Pull review attachments require the review author.

Responses and errors

  • 201 Created returns upload metadata, attachment attribution, and active upload links.
  • 204 No Content confirms a detach.
  • 403 Forbidden indicates missing write access or an archived repo.
  • 404 Not Found indicates a missing target, upload, or attachment.
  • 409 Conflict indicates a duplicate, removed upload, or read-only target.

Successful attach and detach operations emit attachment-created and attachment-deleted events with repo and target scopes.