> ## Documentation Index
> Fetch the complete documentation index at: https://flow9.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Attachments over the API

> Files that belong to a record: a signed contract on a deal, an ID scan on a customer, a brief on a lead. Reads take attachments:view, writes…

Files that belong to a record: a signed contract on a deal, an ID scan on a
customer, a brief on a lead. Reads take `attachments:view`, writes
`attachments:configure`.

| Call                                                 | What it does                                                    |
| ---------------------------------------------------- | --------------------------------------------------------------- |
| `GET /v1/objects/{object}/records/{id}/attachments`  | The record's files, newest first.                               |
| `POST /v1/objects/{object}/records/{id}/attachments` | Upload one file (`multipart/form-data`, field `file`).          |
| `GET /v1/attachments/{id}`                           | Metadata plus a **signed download link** valid for ten minutes. |
| `DELETE /v1/attachments/{id}`                        | Remove the row and the stored file.                             |

```bash theme={null}
curl -X POST "$F9_BASE/v1/objects/deals/records/$DEAL_ID/attachments" \
  -H "x-api-key: $F9_KEY" -F "file=@contract.pdf"
```

## Rules

* **Up to 10 MB** per file. Executable and script files (`.exe`, `.js`, `.sh`, …)
  are refused. Everything else is stored as sent; the API does not inspect
  content.
* The record must be readable by the credential: every call proves the record
  first, so a file on a record outside your reach is a `404`, never a listing.
* Files live in a private bucket keyed `<workspace>/<object>/<record>/…`. Nothing
  is served from a public URL; `download_url` is a signed link that expires
  (`expires_in` seconds). Mint another when you need one.
* Deleting removes the row and, best effort, the object. The row is the source of
  truth.

## Parity

The same `attachment` rows the app shows on a record. The app's own uploads
(fax documents, WhatsApp media) live in their own buckets and are not listed
here.