Upload an attachment

curl --request POST \
  --url https://api.routemcp.io/api/v1/accounting/attachment \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: multipart/form-data' \
  --header 'X-End-User-Id: <x-end-user-id>' \
  --form file='@example-file' \
  --form file_name=team-lunch-receipt.pdf \
  --form mime_type=application/pdf \
  --form related_object_id=019d04a5-invoice-uuid \
  --form 'integration_params={}'

import requests

url = "https://api.routemcp.io/api/v1/accounting/attachment"

files = { "file": ("example-file", open("example-file", "rb")) }
payload = {
    "file_name": "team-lunch-receipt.pdf",
    "mime_type": "application/pdf",
    "related_object_id": "019d04a5-invoice-uuid",
    "integration_params": "{}"
}
headers = {
    "X-End-User-Id": "<x-end-user-id>",
    "Authorization": "<api-key>"
}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('file', '<string>');
form.append('file_name', 'team-lunch-receipt.pdf');
form.append('mime_type', 'application/pdf');
form.append('related_object_id', '019d04a5-invoice-uuid');
form.append('integration_params', '{}');

const options = {
  method: 'POST',
  headers: {'X-End-User-Id': '<x-end-user-id>', Authorization: '<api-key>'}
};

options.body = form;

fetch('https://api.routemcp.io/api/v1/accounting/attachment', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.routemcp.io/api/v1/accounting/attachment",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file_name\"\r\n\r\nteam-lunch-receipt.pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mime_type\"\r\n\r\napplication/pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"related_object_id\"\r\n\r\n019d04a5-invoice-uuid\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"integration_params\"\r\n\r\n{}\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: multipart/form-data",
    "X-End-User-Id: <x-end-user-id>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.routemcp.io/api/v1/accounting/attachment"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file_name\"\r\n\r\nteam-lunch-receipt.pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mime_type\"\r\n\r\napplication/pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"related_object_id\"\r\n\r\n019d04a5-invoice-uuid\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"integration_params\"\r\n\r\n{}\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-End-User-Id", "<x-end-user-id>")
	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.routemcp.io/api/v1/accounting/attachment")
  .header("X-End-User-Id", "<x-end-user-id>")
  .header("Authorization", "<api-key>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file_name\"\r\n\r\nteam-lunch-receipt.pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mime_type\"\r\n\r\napplication/pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"related_object_id\"\r\n\r\n019d04a5-invoice-uuid\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"integration_params\"\r\n\r\n{}\r\n-----011000010111000001101001--")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.routemcp.io/api/v1/accounting/attachment")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-End-User-Id"] = '<x-end-user-id>'
request["Authorization"] = '<api-key>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file_name\"\r\n\r\nteam-lunch-receipt.pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mime_type\"\r\n\r\napplication/pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"related_object_id\"\r\n\r\n019d04a5-invoice-uuid\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"integration_params\"\r\n\r\n{}\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "statusCode": 201,
  "message": "Created",
  "data": {
    "id": "urn:xero:attachment:2d03a37c-d389-4d7d-999a-80353b19e789",
    "remote_id": "2d03a37c-d389-4d7d-999a-80353b19e789",
    "file_name": "team-lunch-receipt.pdf",
    "mime_type": "application/pdf",
    "file_url": "https://api.routemcp.io/api/v1/attachments/proxy/abc123?token=...",
    "created_at": "2026-05-15T13:00:00Z",
    "modified_at": "2026-05-15T13:00:00Z"
  }
}

POST

accounting

attachment

Upload an attachment

curl --request POST \
  --url https://api.routemcp.io/api/v1/accounting/attachment \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: multipart/form-data' \
  --header 'X-End-User-Id: <x-end-user-id>' \
  --form file='@example-file' \
  --form file_name=team-lunch-receipt.pdf \
  --form mime_type=application/pdf \
  --form related_object_id=019d04a5-invoice-uuid \
  --form 'integration_params={}'

import requests

url = "https://api.routemcp.io/api/v1/accounting/attachment"

files = { "file": ("example-file", open("example-file", "rb")) }
payload = {
    "file_name": "team-lunch-receipt.pdf",
    "mime_type": "application/pdf",
    "related_object_id": "019d04a5-invoice-uuid",
    "integration_params": "{}"
}
headers = {
    "X-End-User-Id": "<x-end-user-id>",
    "Authorization": "<api-key>"
}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('file', '<string>');
form.append('file_name', 'team-lunch-receipt.pdf');
form.append('mime_type', 'application/pdf');
form.append('related_object_id', '019d04a5-invoice-uuid');
form.append('integration_params', '{}');

const options = {
  method: 'POST',
  headers: {'X-End-User-Id': '<x-end-user-id>', Authorization: '<api-key>'}
};

options.body = form;

fetch('https://api.routemcp.io/api/v1/accounting/attachment', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.routemcp.io/api/v1/accounting/attachment",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file_name\"\r\n\r\nteam-lunch-receipt.pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mime_type\"\r\n\r\napplication/pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"related_object_id\"\r\n\r\n019d04a5-invoice-uuid\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"integration_params\"\r\n\r\n{}\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: multipart/form-data",
    "X-End-User-Id: <x-end-user-id>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.routemcp.io/api/v1/accounting/attachment"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file_name\"\r\n\r\nteam-lunch-receipt.pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mime_type\"\r\n\r\napplication/pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"related_object_id\"\r\n\r\n019d04a5-invoice-uuid\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"integration_params\"\r\n\r\n{}\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-End-User-Id", "<x-end-user-id>")
	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.routemcp.io/api/v1/accounting/attachment")
  .header("X-End-User-Id", "<x-end-user-id>")
  .header("Authorization", "<api-key>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file_name\"\r\n\r\nteam-lunch-receipt.pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mime_type\"\r\n\r\napplication/pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"related_object_id\"\r\n\r\n019d04a5-invoice-uuid\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"integration_params\"\r\n\r\n{}\r\n-----011000010111000001101001--")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.routemcp.io/api/v1/accounting/attachment")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-End-User-Id"] = '<x-end-user-id>'
request["Authorization"] = '<api-key>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file_name\"\r\n\r\nteam-lunch-receipt.pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mime_type\"\r\n\r\napplication/pdf\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"related_object_id\"\r\n\r\n019d04a5-invoice-uuid\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"integration_params\"\r\n\r\n{}\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "statusCode": 201,
  "message": "Created",
  "data": {
    "id": "urn:xero:attachment:2d03a37c-d389-4d7d-999a-80353b19e789",
    "remote_id": "2d03a37c-d389-4d7d-999a-80353b19e789",
    "file_name": "team-lunch-receipt.pdf",
    "mime_type": "application/pdf",
    "file_url": "https://api.routemcp.io/api/v1/attachments/proxy/abc123?token=...",
    "created_at": "2026-05-15T13:00:00Z",
    "modified_at": "2026-05-15T13:00:00Z"
  }
}

Authorizations

Authorization

string

header

required

Enter your API key with the Bearer prefix — e.g. Bearer sk_live_xxx (production) or Bearer sk_test_xxx (sandbox)

Headers

X-End-User-Id

string

required

Identifier of the end user whose connected provider should be queried. This is the same endUserId you supplied when creating the connect token. Required on every CRM and accounting call.

Example:

"user-001"

Query Parameters

provider

string

required

Provider slug identifying which connected provider to target (e.g. hubspot, pipedrive, zoho-crm, quickbooks-online, xero, zoho-books). Required — single-record operations always target a specific provider.

Example:

"hubspot"

Body

multipart/form-data

Multipart form body. The file part carries the binary file content and is required; all other parts are optional metadata that lets you name the file, set its MIME type, or link it to a parent record.

Multipart write body for POST /accounting/attachment. Send the binary file content in the file part. Per-file size cap: 25 MB. Content replacement is not supported on Update/Patch — DELETE and POST a new file to replace an existing one.

file

required

Binary file content. Use a file form field in the multipart body — every modern OpenAPI tool (Mintlify, Scalar, Postman, Swagger) renders a native file-picker for this.

file_name

string

Optional override for the on-disk filename. Falls back to the uploaded file's own name if omitted.

Example:

"team-lunch-receipt.pdf"

mime_type

string

Optional MIME type override. Falls back to the multipart part's Content-Type if omitted.

Example:

"application/pdf"

Optional canonical type of a parent record to attach to. Provider support varies — Xero's Files API uploads to the library by default; QBO attaches to the referenced record.

Available options:

INVOICE,

BILL,

EXPENSE,

PURCHASE_ORDER,

JOURNAL_ENTRY,

CONTACT,

ITEM

Optional id of the parent record (in URN or raw form). Required when related_object_type is set.

Example:

"019d04a5-invoice-uuid"

integration_params

object

Provider-specific passthrough fields. Encoded as a JSON-stringified value when sent over multipart.

Response

Attachment uploaded.

Envelope returned by POST /accounting/attachment. data is the canonical Attachment record, including a RouteMCP-proxied file_url for downloading the file content.

success

boolean

required

Always true for successful (2xx) responses.

Example:

true

statusCode

integer

required

HTTP status code mirrored inside the envelope. 201 on successful upload.

Example:

201

message

string

required

Example:

"Created"

data

Attachment · object

required

The uploaded attachment record.

Show child attributes

Create a new resource Get a single resource by provider-native ID

Overview

CRM Resources

Workspaces

HTTP Streaming Chat

Accounting Resources

Field Mappings

Connect

Upload an attachment

Authorizations

Headers

Query Parameters

Body

Response