Attachments over the API

Files that belong to a record: a signed contract on a deal, an ID scan on a customer, a brief on a lead. Reads take attachments:view, writes…

Files that belong to a record: a signed contract on a deal, an ID scan on a customer, a brief on a lead. Reads take attachments:view, writes attachments:configure.

Call	What it does
GET /v1/objects/{object}/records/{id}/attachments	The record’s files, newest first.
POST /v1/objects/{object}/records/{id}/attachments	Upload one file (multipart/form-data, field file).
GET /v1/attachments/{id}	Metadata plus a signed download link valid for ten minutes.
DELETE /v1/attachments/{id}	Remove the row and the stored file.

curl -X POST "$F9_BASE/v1/objects/deals/records/$DEAL_ID/attachments" \
  -H "x-api-key: $F9_KEY" -F "file=@contract.pdf"

Rules

• Up to 10 MB per file. Executable and script files (.exe, .js, .sh, …) are refused. Everything else is stored as sent; the API does not inspect content.
• The record must be readable by the credential: every call proves the record first, so a file on a record outside your reach is a 404, never a listing.
• Files live in a private bucket keyed <workspace>/<object>/<record>/…. Nothing is served from a public URL; download_url is a signed link that expires (expires_in seconds). Mint another when you need one.
• Deleting removes the row and, best effort, the object. The row is the source of truth.

Parity

The same attachment rows the app shows on a record. The app’s own uploads (fax documents, WhatsApp media) live in their own buckets and are not listed here.