# Upload a contract attachment

> POST /api/customers/{id}/contracts/{contractId}/attachments on the Vigilbase One API.

Source: https://docs.vigilbase.com/one/api/reference/customers/post-customers-id-contracts-contract-id-attachments

`POST https://one.vigilbase.com/api/customers/{id}/contracts/{contractId}/attachments`

## Authorizations

- `Authorization` (string, header, required): Bearer access token from Vigilbase Identity (`auth.vigilbase.com`), sent as `Authorization: Bearer <token>`. The CLI gets one with `vigilbase login`. Organisation API keys can't call this endpoint: it takes a file upload.
- Permissions checked: `write:contracts`

## Path parameters

- `id` (string, required)
- `contractId` (string, required)

## Body (multipart/form-data)

Multipart form upload.

## Responses

### 200

Success

### 401

Authentication required

### 403

Not permitted

## Example request

```bash
# Token from `vigilbase login`. API keys can't call this.
curl --request POST \
  --url 'https://one.vigilbase.com/api/customers/{id}/contracts/{contractId}/attachments' \
  --header "Authorization: Bearer $VIGILBASE_TOKEN" \
  --form '<field>=@./path/to/file'
```