> ## Documentation Index > Fetch the complete documentation index at: https://docs.routemcp.io/llms.txt > Use this file to discover all available pages before exploring further. # Upload an attachment > Upload a file as a canonical Attachment. **Multipart only** (`Content-Type: multipart/form-data`). Per-file size cap: **25 MB**. Optionally attach to a parent record by supplying `related_object_type` + `related_object_id`. The response includes a signed RouteMCP proxy URL (`file_url`) you can use to fetch the file content. ## OpenAPI ````yaml /api-reference/openapi.json post /accounting/attachment openapi: 3.0.0 info: title: RouteMCP API description: >- Unified API for integrations. Connect to multiple providers through a single API. version: '1.0' contact: {} servers: - url: https://api.routemcp.io/api/v1 description: Production security: - bearerAuth: [] tags: [] paths: /accounting/attachment: post: tags: - Accounting Resources summary: Upload an attachment description: >- Upload a file as a canonical Attachment. **Multipart only** (`Content-Type: multipart/form-data`). Per-file size cap: **25 MB**. Optionally attach to a parent record by supplying `related_object_type` + `related_object_id`. The response includes a signed RouteMCP proxy URL (`file_url`) you can use to fetch the file content. operationId: AccountingResourceController_uploadAttachment_v1 parameters: - $ref: '#/components/parameters/ProviderQueryRequired' - $ref: '#/components/parameters/XEndUserIdHeader' requestBody: required: true description: >- Multipart form body. The `file` part carries the binary file content and is required; all other parts are optional metadata that lets you name the file, set its MIME type, or link it to a parent record. content: multipart/form-data: schema: $ref: '#/components/schemas/AccountingAttachmentMultipartWrite' encoding: file: contentType: application/octet-stream responses: '201': description: Attachment uploaded. content: application/json: examples: attachment: summary: Attachment uploaded value: success: true statusCode: 201 message: Created data: id: urn:xero:attachment:2d03a37c-d389-4d7d-999a-80353b19e789 remote_id: 2d03a37c-d389-4d7d-999a-80353b19e789 file_name: team-lunch-receipt.pdf mime_type: application/pdf file_url: >- https://api.routemcp.io/api/v1/attachments/proxy/abc123?token=... created_at: '2026-05-15T13:00:00Z' modified_at: '2026-05-15T13:00:00Z' schema: $ref: '#/components/schemas/UploadAttachmentResponse' '400': description: Multipart body missing the required `file` part. '401': description: Missing or invalid API key. '405': description: Provider does not support attachment uploads. '413': description: File exceeds the 25 MB cap. '415': description: Request sent as `application/json` instead of `multipart/form-data`. security: - bearerAuth: [] components: parameters: ProviderQueryRequired: name: provider required: true in: query description: >- Provider slug identifying which connected provider to target (e.g. `hubspot`, `pipedrive`, `zoho-crm`, `quickbooks-online`, `xero`, `zoho-books`). Required — single-record operations always target a specific provider. schema: example: hubspot type: string XEndUserIdHeader: name: X-End-User-Id required: true in: header description: >- Identifier of the end user whose connected provider should be queried. This is the same `endUserId` you supplied when creating the connect token. Required on every CRM and accounting call. schema: example: user-001 type: string schemas: AccountingAttachmentMultipartWrite: type: object title: Attachment (multipart write body) description: >- Multipart write body for `POST /accounting/attachment`. Send the binary file content in the `file` part. Per-file size cap: 25 MB. Content replacement is not supported on Update/Patch — DELETE and POST a new file to replace an existing one. required: - file properties: file: type: string format: binary description: >- Binary file content. Use a `file` form field in the multipart body — every modern OpenAPI tool (Mintlify, Scalar, Postman, Swagger) renders a native file-picker for this. file_name: type: string example: team-lunch-receipt.pdf description: >- Optional override for the on-disk filename. Falls back to the uploaded file's own name if omitted. mime_type: type: string example: application/pdf description: >- Optional MIME type override. Falls back to the multipart part's `Content-Type` if omitted. related_object_type: type: string enum: - INVOICE - BILL - EXPENSE - PURCHASE_ORDER - JOURNAL_ENTRY - CONTACT - ITEM description: >- Optional canonical type of a parent record to attach to. Provider support varies — Xero's Files API uploads to the library by default; QBO attaches to the referenced record. related_object_id: type: string example: 019d04a5-invoice-uuid description: >- Optional id of the parent record (in URN or raw form). Required when `related_object_type` is set. integration_params: type: object additionalProperties: true description: >- Provider-specific passthrough fields. Encoded as a JSON-stringified value when sent over multipart. UploadAttachmentResponse: type: object title: UploadAttachmentResponse description: >- Envelope returned by `POST /accounting/attachment`. `data` is the canonical Attachment record, including a RouteMCP-proxied `file_url` for downloading the file content. properties: success: type: boolean example: true description: Always `true` for successful (2xx) responses. statusCode: type: integer example: 201 description: >- HTTP status code mirrored inside the envelope. `201` on successful upload. message: type: string example: Created data: title: Attachment type: object description: The uploaded attachment record. allOf: - $ref: '#/components/schemas/AccountingCommonResourceFields' - $ref: '#/components/schemas/AccountingAttachment' - type: object properties: file_url: type: string format: uri example: >- https://api.routemcp.io/api/v1/attachments/proxy/abc123?token=... description: >- Short-lived, signed RouteMCP proxy URL for downloading the file. Resolves to the upstream provider's file storage; the token expires after a few minutes. required: - success - statusCode - message - data AccountingCommonResourceFields: type: object description: Fields present on every accounting resource returned by RouteMCP. properties: id: type: string example: urn:uuid:0958cbc6-6040-430a-848e-aafacbadf4ae description: >- Canonical RouteMCP identifier. URN-prefixed UUID for most records. For QuickBooks Online, AR/AP-aware resources (Invoice, Bill, Payment, BillPayment, Customer, Vendor) use a provider-discriminated URN (`urn:qbo::`). remote_id: type: string nullable: true example: EILBM0XYAR1 description: Provider-native record id. created_at: type: string format: date-time nullable: true example: '2026-04-15T10:30:00.000Z' description: >- ISO-8601 timestamp of when the record was created in the provider system. `null` for on-demand reports. modified_at: type: string format: date-time nullable: true example: '2026-04-16T15:45:00.000Z' description: >- ISO-8601 timestamp of when the record was last updated in the provider system. `null` for on-demand reports. remote_was_deleted: type: boolean example: false description: '`true` when the upstream provider has soft-deleted the record.' providerSlug: type: string example: quickbooks-online description: >- Slug of the source provider (e.g. `quickbooks-online`, `xero`, `zoho-books`). providerId: type: string format: uuid example: a1b2c3d4-e5f6-7890-abcd-ef1234567890 description: >- Internal RouteMCP connection id linking the record to a specific tenant-provider connection. AccountingAttachment: type: object title: Attachment description: >- Read-side shape of an attachment record (List / Get responses). Writes use a different envelope — see `AccountingAttachmentMultipartWrite` for Create and `AccountingAttachmentPartial` for Update/Patch. properties: file_name: type: string example: team-lunch-receipt.pdf file_url: type: string example: https://files.routemcp.io/u/abc123/team-lunch-receipt.pdf description: >- URL where the attachment file can be downloaded. May be a permanent provider-hosted URL (e.g. QBO `Attachable.FileAccessUri`) or a short-lived signed URL depending on the provider. Response-only — ignored on write. mime_type: type: string example: application/pdf description: >- MIME type of the uploaded file. Populated on read; settable on Create via the multipart write body. company: type: string example: 019d04a5-2012-7119-bc07-75c081250434 description: UUID of the associated company / subsidiary. integration_params: type: object additionalProperties: true description: Provider-specific passthrough fields. securitySchemes: bearerAuth: type: apiKey in: header name: Authorization description: >- Enter your API key with the Bearer prefix — e.g. Bearer sk_live_xxx (production) or Bearer sk_test_xxx (sandbox) ````