# Upload a support attachment

> Upload a file for a support request (`POST /api/support/attachments`).

Source: https://docs.vigilbase.com/one/api/reference/support/post-support-attachments

`POST https://one.vigilbase.com/api/support/attachments`

Upload a file for a support request (`POST /api/support/attachments`). Multipart with one `file` field: a JPEG, PNG or PDF of at most 10 MB, its type read from its bytes. Same access as raising a request: `support:access`, and staff name the customer with `?customerId=` (validated before the body is read). The file goes to Pylon's `POST /attachments`; the response is Pylon's signed link, which `POST /api/support/tickets` and `POST /api/support/tickets/{issueId}/reply` accept in `attachmentUrls`. Nothing is stored in One. 20 uploads per user per 10 minutes.

## Authorizations

- `Authorization` (string, header, required): Bearer access token from Vigilbase Identity (`auth.vigilbase.com`), sent as `Authorization: Bearer <token>`. The CLI gets one with `vigilbase login`. Organisation API keys can't call this endpoint: it takes a file upload.
- Permissions checked: `support:access`

## Body (multipart/form-data)

Multipart form upload.

## Responses

### 200

Success

### 401

Authentication required

### 403

Not permitted

## Example request

```bash
# Token from `vigilbase login`. API keys can't call this.
curl --request POST \
  --url 'https://one.vigilbase.com/api/support/attachments' \
  --header "Authorization: Bearer $VIGILBASE_TOKEN" \
  --form '<field>=@./path/to/file'
```