Upload Attachment

Upload Attachments

curl --request POST \
  --url https://connect.penbox.io/v1/attachments \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "data": "aSDinaTvuI8gbWludGxpZnk=",
  "type": "<string>"
}
'

import requests

url = "https://connect.penbox.io/v1/attachments"

payload = {
    "name": "<string>",
    "data": "aSDinaTvuI8gbWludGxpZnk=",
    "type": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({name: '<string>', data: 'aSDinaTvuI8gbWludGxpZnk=', type: '<string>'})
};

fetch('https://connect.penbox.io/v1/attachments', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://connect.penbox.io/v1/attachments",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'data' => 'aSDinaTvuI8gbWludGxpZnk=',
    'type' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://connect.penbox.io/v1/attachments"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://connect.penbox.io/v1/attachments")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://connect.penbox.io/v1/attachments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "<string>",
  "type": "<string>",
  "scope": "<string>",
  "data": "<string>",
  "metadata": {
    "size": 123,
    "width": 123,
    "height": 123
  },
  "uri": "<string>"
}

POST

attachments

Upload Attachments

curl --request POST \
  --url https://connect.penbox.io/v1/attachments \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "data": "aSDinaTvuI8gbWludGxpZnk=",
  "type": "<string>"
}
'

import requests

url = "https://connect.penbox.io/v1/attachments"

payload = {
    "name": "<string>",
    "data": "aSDinaTvuI8gbWludGxpZnk=",
    "type": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({name: '<string>', data: 'aSDinaTvuI8gbWludGxpZnk=', type: '<string>'})
};

fetch('https://connect.penbox.io/v1/attachments', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://connect.penbox.io/v1/attachments",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'data' => 'aSDinaTvuI8gbWludGxpZnk=',
    'type' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://connect.penbox.io/v1/attachments"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://connect.penbox.io/v1/attachments")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://connect.penbox.io/v1/attachments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "<string>",
  "type": "<string>",
  "scope": "<string>",
  "data": "<string>",
  "metadata": {
    "size": 123,
    "width": 123,
    "height": 123
  },
  "uri": "<string>"
}

Upload a single attachment to Penbox. Supports both JSON (base64) and multipart/form-data formats.

Size limits. Multipart uploads accept up to 10GB per file. JSON uploads accept a body of 20MB. That limit applies to the transmitted, base64-inflated payload, so roughly 15MB of file. Downloads are limited to 50MB.

To store an uploaded document on a case field, follow Add a Document to a Case for the full sequence.

Query Parameters

string

Workspace UUID. Optional for a token scoped to a single workspace. A token scoped to several workspaces should name the target one — the first workspace of the token is used otherwise. Note the bracket syntax: ?workspace[id]=<uuid>.

Request Body (JSON)

For JSON uploads, send base64-encoded file data:

string

required

File name

string

required

Base64-encoded file content

string

MIME type (e.g., “application/pdf”, “image/jpeg”). Optional - will be detected if not provided.

string

Not applied. Every upload is created with the same access rules: the workspace API token and workspace admins can download the attachment. Use a step attachment if a contact or another member needs access to the file.

Request Body (Multipart)

For multipart uploads, use multipart/form-data with a file field.

Response Structure

Returns a single attachment object:

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "document.pdf",
  "type": "application/pdf",
  "uri": "https://connect.penbox.io/v1/attachments/550e8400-e29b-41d4-a716-446655440000",
  "metadata": {
    "size": 1024
  }
}

Response Codes

Code	Description
`201`	Created - File uploaded successfully
`400`	Bad Request - Invalid file data
`401`	Unauthorized - Invalid access token
`403`	Forbidden - No company scope in token
`413`	Payload Too Large - JSON body over 20MB, or multipart file over 10GB
`429`	Too Many Requests - Rate limit exceeded
`500`	Server Error - Internal error

Use multipart/form-data for large files. It is the only form that goes past 20MB, and it is faster because nothing is base64-encoded. Keep the JSON form for small files.

Authorizations

Authorization

string

header

required

API token (starts with pnbx_). Create at https://app.penbox.io/workspace/settings/api. Include as: Authorization: Bearer {token}

Query Parameters

workspace[id]

string<uuid>

Workspace UUID. Optional for a token scoped to a single workspace; a token scoped to several workspaces should name the target one, otherwise the first workspace of the token is used.

Body

name

string

required

File name

data

string<byte>

required

Base64-encoded file content

type

string

MIME type (optional, will be detected if not provided)

scope

enum<string>

Not applied. Every upload is created with the same access rules: the workspace API token and workspace admins can download the attachment.

Available options:

public,

restricted

Response

201 - application/json

File uploaded successfully

string<uuid>

Attachment UUID

name

string

Original filename

type

string

MIME type

scope

string | null

Attachment scope

data

string | null

Base64-encoded file content

metadata

object

Show child attributes

uri

string<uri>

Direct download URL

API Reference

Workspaces

Cases

Tasks

Case Templates

Forms

Form Templates

Attachments

Document Intelligence

Signatures

Previous API version

Query Parameters

Request Body (JSON)

Request Body (Multipart)

Response Structure

Response Codes

Authorizations

Query Parameters

Body

Response

​Query Parameters

​Request Body (JSON)

​Request Body (Multipart)

​Response Structure

​Response Codes

Authorizations

Query Parameters

Body

Response

Query Parameters

Request Body (JSON)

Request Body (Multipart)

Response Structure

Response Codes