Agent chats

Upload and verify one private chat document

Last updated 30 October 2026

post/v1/agent-chat-attachments

Upload and verify one private chat document. Send multipart/form-data with exactly one file field, or application/json with fileName, optional mediaType and complete file data as canonical padded base64. Do not include a data URL prefix. The shared byte validator chooses the canonical file type. Unknown fields and noncanonical encoding are rejected. Validation and private storage verification finish synchronously; the response is ready for use in ordered attachmentIds on chat start or send. There is no finalize call. Supports PDF, DOCX, UTF-8 text/source/config, Markdown, CSV, JSON and supported images. Maximum 20 MiB of decoded bytes per file, ten pending files and 40 MiB total per person and organization. Pending uploads expire after 24 hours. Upload retries create another ID; recover lost responses with the pending list. Requires agents.write and a user OAuth token. Organization API keys cannot use this operation. Requires rollout-agent-access-writes and allow-public-agent-writes. New upload and message binding also require allow-document-processing.

Authentication

bearerAuth

bearerAuth: http / bearer — Use an Inth API key or OAuth access token in the Authorization header. Product operations need a capability. Feedback intake only requires authentication. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (`organizations.read`, `projects.read`, `projects.write`, `api-keys.read`, `inbox.read`, `billing.read`), so writes that name the person who made them, such as `inbox.write` and `vendors.write`, need a user token. A credential without the capability an operation needs is answered with `403 INSUFFICIENT_SCOPE`. `GET /v1/me` reports the capabilities of the calling credential. OAuth scopes: - `organizations.read`: List the organizations you belong to. - `organizations.write`: Create organizations you will own. - `projects.read`: Read projects, their consent configuration, and the vendors seen on them. - `projects.write`: Create, update, and delete projects and their consent configuration. - `members.read`: Read member names, email addresses, profile images, roles, and pending invitation email addresses. - `members.write`: Invite members, change member roles, remove members, and cancel invitations. - `api-keys.read`: List organization API keys. - `api-keys.write`: Create, roll, and delete organization API keys. - `code-audit.read`: Read Code Audit scans, their findings, and connected repositories. - `code-audit.write`: Start Code Audit scans and unlock their reports. - `inbox.read`: Read Inbox findings. - `inbox.write`: Change Inbox status or assignment and open GitHub issues for findings. - `vendors.write`: Approve or ignore vendors detected on your projects, which resolves their Inbox findings. - `billing.read`: Read the plan and credit balance of an organization. - `billing.details.read`: Read invoices, billing profiles, and payment method summaries for organizations you own. - `consent.read`: Read consent records, analytics, configuration, and runtime status. - `consent.write`: Update consent settings, translations, IAB configuration, and policies. - `consent.keys.read`: Read consent runtime key metadata. Secret values are never returned. - `website-audit.read`: Read website audit targets, scans, reports, cookies, and evidence. - `website-audit.write`: Manage website audit targets, verify domains, review findings, and start scans. - `account.read`: Read your account profile. - `notifications.read`: Read your notification preferences and organization routing. - `organization-retention.read`: Read organization provider data retention policy. - `support.read`: Read support conversations you own or can access through sharing. - `support.write`: Create support conversations, send messages, share or close them, and upload support attachments. - `consent.lifecycle.write`: Update, upgrade or delete Consent runtimes. - `consent.keys.write`: Create, rotate and revoke Consent runtime keys. - `billing.write`: Preview and change plans, buy credits, manage billing details and subscriptions, and open hosted payment flows. - `account.security.read`: Read your active browser sessions and connected device grants. - `account.security.write`: Revoke your browser sessions and connected device grants. - `integrations.read`: Read connected integration accounts, repositories, provider properties and project links. - `integrations.write`: Connect and sync providers, manage repository settings, project links and paid pull request monitoring. - `account.write`: Update your name, avatar and PII masking preference. - `account.delete`: Permanently delete your account after ownership checks and confirmation. - `notifications.write`: Update your notification preferences. - `notifications.routing.write`: Manage organization notification routing. - `organization-retention.write`: Change organization provider data retention policy. - `organizations.settings.write`: Update organization name, logo and slug. - `organizations.delete`: Permanently delete organizations you own after confirmation. - `agents.read`: Read your Inth Agent chats and chats shared with your organization. - `agents.write`: Start Inth Agent chats, send messages, share your chats with the organization, and delete your chats. Agent replies use organization credits.

Request

Query Parameters

Name	Type	Required	Description
`organizationId`	`string`	Optional	Creation and list organization. Omit for the saved organization. A known attachment resolves its organization directly; this parameter then asserts the expected tenant.

Required

Content type application/json

Property	Type	Required	Description
`fileName`	`string`	Required	—
`mediaType`	`string`	Optional	—
`data`	`string`	Required	—

View JSON schema

{
  "type": "object",
  "properties": {
    "fileName": {
      "type": "string"
    },
    "mediaType": {
      "type": "string",
      "minLength": 1,
      "maxLength": 255
    },
    "data": {
      "type": "string",
      "minLength": 4,
      "maxLength": 27962028,
      "pattern": "^[A-Za-z0-9+/]*={0,2}$"
    }
  },
  "required": [
    "fileName",
    "data"
  ],
  "additionalProperties": false
}

Content type multipart/form-data

Property	Type	Required	Description
`file`	`string (binary)`	Required	—

View JSON schema

{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "file"
  ],
  "properties": {
    "file": {
      "type": "string",
      "format": "binary",
      "maxLength": 20971520
    }
  }
}

Responses

`201`

Success

Content type application/json

Property	Type	Required	Description
`success`	`unknown`	Required	—
`data`	`object`	Required	—
`data.organizationId`	`string`	Required	—
`data.attachment`	`object`	Required	—
`data.attachment.id`	`string`	Required	—
`data.attachment.fileName`	`string`	Required	—
`data.attachment.mediaType`	`"application/json" \| "application/pdf" \| "application/vnd.openxmlformats-officedocument.wordprocessingml.document" \| "image/gif" \| "image/jpeg" \| "image/png" \| "image/webp" \| "text/csv" \| "text/markdown" \| "text/plain"`	Required	—
`data.attachment.sizeBytes`	`integer`	Required	—
`data.attachment.downloadUrl`	`string`	Required	—

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "data"
  ],
  "properties": {
    "success": {
      "const": true
    },
    "data": {
      "type": "object",
      "properties": {
        "organizationId": {
          "type": "string"
        },
        "attachment": {
          "type": "object",
          "properties": {
            "id": {
              "type": "string",
              "pattern": "^aga_[A-Za-z0-9_-]{1,60}$"
            },
            "fileName": {
              "type": "string",
              "minLength": 1,
              "maxLength": 255
            },
            "mediaType": {
              "type": "string",
              "enum": [
                "application/json",
                "application/pdf",
                "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
                "image/gif",
                "image/jpeg",
                "image/png",
                "image/webp",
                "text/csv",
                "text/markdown",
                "text/plain"
              ]
            },
            "sizeBytes": {
              "type": "integer",
              "minimum": 1,
              "maximum": 20971520
            },
            "downloadUrl": {
              "type": "string",
              "pattern": "^\\/v1\\/agent-chat-attachments\\/aga_[A-Za-z0-9_-]{1,60}\\/content$"
            }
          },
          "required": [
            "id",
            "fileName",
            "mediaType",
            "sizeBytes",
            "downloadUrl"
          ],
          "additionalProperties": false
        }
      },
      "required": [
        "organizationId",
        "attachment"
      ],
      "additionalProperties": false
    }
  }
}

`400`

The request payload or parameters are invalid.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`401`

Authentication is missing, invalid, or expired.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`403`

The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

Headers

Name	Type	Description
`WWW-Authenticate`	`string`	Present on `INSUFFICIENT_SCOPE`: `Bearer error="insufficient_scope", scope="<required scope>"`.

`404`

The requested resource was not found.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`409`

The request conflicts with the current resource state.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`413`

File exceeds 20 MiB or pending files exceed the shared 40 MiB limit.

`503`

New public writes or document processing are paused.

REST API overview: Every operation in this API.

Examples

const response = await fetch("https://api.inth.com/v1/agent-chat-attachments", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "fileName": "string",
    "mediaType": "string",
    "data": "string"
  }),
});
const data = await response.json();

Response · 201

{
  "success": {},
  "data": {
    "organizationId": "string",
    "attachment": {
      "id": "string",
      "fileName": "string",
      "mediaType": "application/json",
      "sizeBytes": 0,
      "downloadUrl": "string"
    }
  }
}

Response · 400

{
  "success": false,
  "error": {
    "code": "INVALID_PAYLOAD",
    "message": "Invalid request payload",
    "details": [
      {
        "code": "too_small",
        "message": "Too small: expected string to have >=1 characters",
        "path": [
          "name"
        ]
      }
    ]
  }
}

Response · 401

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}

Response · 403

{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "This token was not granted the projects.write scope",
    "details": {
      "requiredScope": "projects.write"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "Organization membership is required"
  }
}

Response · 404

{
  "success": true,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "details": {}
  }
}

Response · 409

{
  "success": true,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "details": {}
  }
}

Authentication

Request

Query Parameters

Responses

201

400

401

403

Headers

404

409

413

503

Related

`201`

`400`

`401`

`403`

`404`

`409`

`413`

`503`