---
title: Upload and verify one private chat document
description: Upload and verify one private chat document. Send
  multipart/form-data with exactly one file field, or application/json with
  fileName, optional mediaType and complete file data as canonical padded
  base64. Do not include a data URL prefix. The shared b…
type: api-reference
source: ./openapi/inth-api.json
method: post
path: /v1/agent-chat-attachments
operationId: uploadAgentChatAttachment
server: https://api.inth.com
apiVersion: 1.0.0
tags:
  - Agent chats
canonicalUrl: https://inth.com/docs/rest-api/agent-chats/upload-agent-chat-attachment
lastModified: "2026-10-30T13:05:44.605Z"
---
```http
POST /v1/agent-chat-attachments
```

Server: `https://api.inth.com`

Operation ID: `uploadAgentChatAttachment`

Upload and verify one private chat document. Send multipart/form-data with exactly one file field, or application/json with fileName, optional mediaType and complete file data as canonical padded base64. Do not include a data URL prefix. The shared byte validator chooses the canonical file type. Unknown fields and noncanonical encoding are rejected. Validation and private storage verification finish synchronously; the response is ready for use in ordered attachmentIds on chat start or send. There is no finalize call. Supports PDF, DOCX, UTF-8 text/source/config, Markdown, CSV, JSON and supported images. Maximum 20 MiB of decoded bytes per file, ten pending files and 40 MiB total per person and organization. Pending uploads expire after 24 hours. Upload retries create another ID; recover lost responses with the pending list. Requires agents.write and a user OAuth token. Organization API keys cannot use this operation. Requires rollout-agent-access-writes and allow-public-agent-writes. New upload and message binding also require allow-document-processing.

## Authentication

* bearerAuth

### Schemes

* bearerAuth: http / bearer - Use an Inth API key or OAuth access token in the Authorization header.

  Product operations need a capability. Feedback intake only requires authentication. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (\`organizations.read\`, \`projects.read\`, \`projects.write\`, \`api-keys.read\`, \`inbox.read\`, \`billing.read\`), so writes that name the person who made them, such as \`inbox.write\` and \`vendors.write\`, need a user token. A credential without the capability an operation needs is answered with \`403 INSUFFICIENT\_SCOPE\`. \`GET /v1/me\` reports the capabilities of the calling credential.

  OAuth scopes:
  - \`organizations.read\`: List the organizations you belong to.
  - \`organizations.write\`: Create organizations you will own.
  - \`projects.read\`: Read projects, their consent configuration, and the vendors seen on them.
  - \`projects.write\`: Create, update, and delete projects and their consent configuration.
  - \`members.read\`: Read member names, email addresses, profile images, roles, and pending invitation email addresses.
  - \`members.write\`: Invite members, change member roles, remove members, and cancel invitations.
  - \`api-keys.read\`: List organization API keys.
  - \`api-keys.write\`: Create, roll, and delete organization API keys.
  - \`code-audit.read\`: Read Code Audit scans, their findings, and connected repositories.
  - \`code-audit.write\`: Start Code Audit scans and unlock their reports.
  - \`inbox.read\`: Read Inbox findings.
  - \`inbox.write\`: Change Inbox status or assignment and open GitHub issues for findings.
  - \`vendors.write\`: Approve or ignore vendors detected on your projects, which resolves their Inbox findings.
  - \`billing.read\`: Read the plan and credit balance of an organization.
  - \`billing.details.read\`: Read invoices, billing profiles, and payment method summaries for organizations you own.
  - \`consent.read\`: Read consent records, analytics, configuration, and runtime status.
  - \`consent.write\`: Update consent settings, translations, IAB configuration, and policies.
  - \`consent.keys.read\`: Read consent runtime key metadata. Secret values are never returned.
  - \`website-audit.read\`: Read website audit targets, scans, reports, cookies, and evidence.
  - \`website-audit.write\`: Manage website audit targets, verify domains, review findings, and start scans.
  - \`account.read\`: Read your account profile.
  - \`notifications.read\`: Read your notification preferences and organization routing.
  - \`organization-retention.read\`: Read organization provider data retention policy.
  - \`support.read\`: Read support conversations you own or can access through sharing.
  - \`support.write\`: Create support conversations, send messages, share or close them, and upload support attachments.
  - \`consent.lifecycle.write\`: Update, upgrade or delete Consent runtimes.
  - \`consent.keys.write\`: Create, rotate and revoke Consent runtime keys.
  - \`billing.write\`: Preview and change plans, buy credits, manage billing details and subscriptions, and open hosted payment flows.
  - \`account.security.read\`: Read your active browser sessions and connected device grants.
  - \`account.security.write\`: Revoke your browser sessions and connected device grants.
  - \`integrations.read\`: Read connected integration accounts, repositories, provider properties and project links.
  - \`integrations.write\`: Connect and sync providers, manage repository settings, project links and paid pull request monitoring.
  - \`account.write\`: Update your name, avatar and PII masking preference.
  - \`account.delete\`: Permanently delete your account after ownership checks and confirmation.
  - \`notifications.write\`: Update your notification preferences.
  - \`notifications.routing.write\`: Manage organization notification routing.
  - \`organization-retention.write\`: Change organization provider data retention policy.
  - \`organizations.settings.write\`: Update organization name, logo and slug.
  - \`organizations.delete\`: Permanently delete organizations you own after confirmation.
  - \`agents.read\`: Read your Inth Agent chats and chats shared with your organization.
  - \`agents.write\`: Start Inth Agent chats, send messages, share your chats with the organization, and delete your chats. Agent replies use organization credits.

## Request

### Query Parameters

|Name|Type|Required|Description|
|:--|:--|:--|:--|
|`organizationId`|string|optional|Creation and list organization. Omit for the saved organization. A known attachment resolves its organization directly; this parameter then asserts the expected tenant.|

### Request Body

required

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`fileName`|string|required||
|`mediaType`|string|optional||
|`data`|string|required||

JSON Schema:

```json
{
  "type": "object",
  "properties": {
    "fileName": {
      "type": "string"
    },
    "mediaType": {
      "type": "string",
      "minLength": 1,
      "maxLength": 255
    },
    "data": {
      "type": "string",
      "minLength": 4,
      "maxLength": 27962028,
      "pattern": "^[A-Za-z0-9+/]*={0,2}$"
    }
  },
  "required": [
    "fileName",
    "data"
  ],
  "additionalProperties": false
}
```

Content type: multipart/form-data

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`file`|string (binary)|required||

JSON Schema:

```json
{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "file"
  ],
  "properties": {
    "file": {
      "type": "string",
      "format": "binary",
      "maxLength": 20971520
    }
  }
}
```

## Code Examples

### cURL

```bash
curl -X POST "https://api.inth.com/v1/agent-chat-attachments" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
  "fileName": "string",
  "mediaType": "string",
  "data": "string"
}'
```

### JavaScript

```ts
const response = await fetch("https://api.inth.com/v1/agent-chat-attachments", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "fileName": "string",
    "mediaType": "string",
    "data": "string"
  }),
});
const data = await response.json();
```

## Responses

### 201

Success

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|unknown|required||
|`data`|object|required||
|`data.organizationId`|string|required||
|`data.attachment`|object|required||
|`data.attachment.id`|string|required||
|`data.attachment.fileName`|string|required||
|`data.attachment.mediaType`|"application/json" \|"application/pdf" \|"application/vnd.openxmlformats-officedocument.wordprocessingml.document" \|"image/gif" \|"image/jpeg" \|"image/png" \|"image/webp" \|"text/csv" \|"text/markdown" \|"text/plain"|required||
|`data.attachment.sizeBytes`|integer|required||
|`data.attachment.downloadUrl`|string|required||

Example:

```json
{
  "success": {},
  "data": {
    "organizationId": "string",
    "attachment": {
      "id": "string",
      "fileName": "string",
      "mediaType": "application/json",
      "sizeBytes": 0,
      "downloadUrl": "string"
    }
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "data"
  ],
  "properties": {
    "success": {
      "const": true
    },
    "data": {
      "type": "object",
      "properties": {
        "organizationId": {
          "type": "string"
        },
        "attachment": {
          "type": "object",
          "properties": {
            "id": {
              "type": "string",
              "pattern": "^aga_[A-Za-z0-9_-]{1,60}$"
            },
            "fileName": {
              "type": "string",
              "minLength": 1,
              "maxLength": 255
            },
            "mediaType": {
              "type": "string",
              "enum": [
                "application/json",
                "application/pdf",
                "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
                "image/gif",
                "image/jpeg",
                "image/png",
                "image/webp",
                "text/csv",
                "text/markdown",
                "text/plain"
              ]
            },
            "sizeBytes": {
              "type": "integer",
              "minimum": 1,
              "maximum": 20971520
            },
            "downloadUrl": {
              "type": "string",
              "pattern": "^\\/v1\\/agent-chat-attachments\\/aga_[A-Za-z0-9_-]{1,60}\\/content$"
            }
          },
          "required": [
            "id",
            "fileName",
            "mediaType",
            "sizeBytes",
            "downloadUrl"
          ],
          "additionalProperties": false
        }
      },
      "required": [
        "organizationId",
        "attachment"
      ],
      "additionalProperties": false
    }
  }
}
```

### 400

The request payload or parameters are invalid.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`error`|object|required||
|`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required||
|`error.message`|string|required||
|`error.details`|unknown|optional|Optional structured error details.|

Example: default

```json
{
  "success": false,
  "error": {
    "code": "INVALID_PAYLOAD",
    "message": "Invalid request payload",
    "details": [
      {
        "code": "too_small",
        "message": "Too small: expected string to have >=1 characters",
        "path": [
          "name"
        ]
      }
    ]
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}
```

### 401

Authentication is missing, invalid, or expired.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`error`|object|required||
|`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required||
|`error.message`|string|required||
|`error.details`|unknown|optional|Optional structured error details.|

Example: default

```json
{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}
```

### 403

The credential is valid but may not perform the operation.

\`INSUFFICIENT\_SCOPE\`: the credential was never granted the capability the operation needs. \`details.requiredScope\` names it, and the \`WWW-Authenticate\` header carries \`Bearer error="insufficient\_scope"\`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it.

\`FORBIDDEN\`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`error`|object|required||
|`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required||
|`error.message`|string|required||
|`error.details`|unknown|optional|Optional structured error details.|

Example: insufficientScope

```json
{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "This token was not granted the projects.write scope",
    "details": {
      "requiredScope": "projects.write"
    }
  }
}
```

Example: forbidden

```json
{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "Organization membership is required"
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}
```

#### Headers

|Name|Type|Required|Description|
|:--|:--|:--|:--|
|`WWW-Authenticate`|string|optional|Present on \`INSUFFICIENT\_SCOPE\`: \`Bearer error="insufficient\_scope", scope="\<required scope>"\`.|

### 404

The requested resource was not found.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`error`|object|required||
|`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required||
|`error.message`|string|required||
|`error.details`|unknown|optional|Optional structured error details.|

Example:

```json
{
  "success": true,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "details": {}
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}
```

### 409

The request conflicts with the current resource state.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`error`|object|required||
|`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required||
|`error.message`|string|required||
|`error.details`|unknown|optional|Optional structured error details.|

Example:

```json
{
  "success": true,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "details": {}
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}
```

### 413

File exceeds 20 MiB or pending files exceed the shared 40 MiB limit.

### 503

New public writes or document processing are paused.

## Related

* [REST API overview](/docs/rest-api): Every operation in this API.