Upload Attachment

Upload Attachments

curl --request POST \
  --url https://connect.penbox.io/v1/attachments \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "data": "aSDinaTvuI8gbWludGxpZnk=",
  "type": "<string>",
  "scope": "restricted"
}
'

import requests

url = "https://connect.penbox.io/v1/attachments"

payload = {
    "name": "<string>",
    "data": "aSDinaTvuI8gbWludGxpZnk=",
    "type": "<string>",
    "scope": "restricted"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    data: 'aSDinaTvuI8gbWludGxpZnk=',
    type: '<string>',
    scope: 'restricted'
  })
};

fetch('https://connect.penbox.io/v1/attachments', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://connect.penbox.io/v1/attachments",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'data' => 'aSDinaTvuI8gbWludGxpZnk=',
    'type' => '<string>',
    'scope' => 'restricted'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://connect.penbox.io/v1/attachments"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\",\n  \"scope\": \"restricted\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://connect.penbox.io/v1/attachments")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\",\n  \"scope\": \"restricted\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://connect.penbox.io/v1/attachments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\",\n  \"scope\": \"restricted\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "<string>",
  "type": "<string>",
  "scope": "<string>",
  "data": "<string>",
  "metadata": {
    "size": 123,
    "width": 123,
    "height": 123
  },
  "uri": "<string>"
}

POST

attachments

Upload Attachments

curl --request POST \
  --url https://connect.penbox.io/v1/attachments \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "data": "aSDinaTvuI8gbWludGxpZnk=",
  "type": "<string>",
  "scope": "restricted"
}
'

import requests

url = "https://connect.penbox.io/v1/attachments"

payload = {
    "name": "<string>",
    "data": "aSDinaTvuI8gbWludGxpZnk=",
    "type": "<string>",
    "scope": "restricted"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    data: 'aSDinaTvuI8gbWludGxpZnk=',
    type: '<string>',
    scope: 'restricted'
  })
};

fetch('https://connect.penbox.io/v1/attachments', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://connect.penbox.io/v1/attachments",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'data' => 'aSDinaTvuI8gbWludGxpZnk=',
    'type' => '<string>',
    'scope' => 'restricted'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://connect.penbox.io/v1/attachments"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\",\n  \"scope\": \"restricted\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://connect.penbox.io/v1/attachments")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\",\n  \"scope\": \"restricted\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://connect.penbox.io/v1/attachments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"data\": \"aSDinaTvuI8gbWludGxpZnk=\",\n  \"type\": \"<string>\",\n  \"scope\": \"restricted\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "<string>",
  "type": "<string>",
  "scope": "<string>",
  "data": "<string>",
  "metadata": {
    "size": 123,
    "width": 123,
    "height": 123
  },
  "uri": "<string>"
}

Upload a single attachment to Penbox. Supports both JSON (base64) and multipart/form-data formats.

Size Limit: Maximum file size is 10GB per upload.

Query Parameters

string

Company UUID (optional if your token has company scope)

Request Body (JSON)

For JSON uploads, send base64-encoded file data:

string

required

File name

string

required

Base64-encoded file content

string

MIME type (e.g., “application/pdf”, “image/jpeg”). Optional - will be detected if not provided.

string

default:"restricted"

Attachment visibility scope: public or restricted

Request Body (Multipart)

For multipart uploads, use multipart/form-data with a file field.

Response Structure

Returns a single attachment object:

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "document.pdf",
  "type": "application/pdf",
  "uri": "https://connect.penbox.io/v1/attachments/550e8400-e29b-41d4-a716-446655440000",
  "metadata": {
    "size": 1024
  }
}

Response Codes

Code	Description
`201`	Created - File uploaded successfully
`400`	Bad Request - Invalid file data
`401`	Unauthorized - Invalid access token
`403`	Forbidden - No company scope in token
`413`	Payload Too Large - File exceeds 10GB limit
`429`	Too Many Requests - Rate limit exceeded
`500`	Server Error - Internal error

For large files, prefer multipart/form-data uploads as they’re more efficient. For small files or when embedding in JSON payloads, base64 encoding works well.

Authorizations

Authorization

string

header

required

API token (starts with pnbx_). Create at https://app.penbox.io/workspace/settings/api. Include as: Authorization: Bearer {token}

Query Parameters

workspace

string<uuid>

Workspace UUID (optional if token has workspace scope)

Body

name

string

required

File name

data

string<byte>

required

Base64-encoded file content

type

string

MIME type (optional, will be detected if not provided)

scope

enum<string>

default:restricted

Attachment visibility scope

Available options:

public,

restricted

Response

201 - application/json

File uploaded successfully

string<uuid>

Attachment UUID

name

string

Original filename

type

string

MIME type

scope

string | null

Attachment scope

data

string | null

Base64-encoded file content

metadata

object

Show child attributes

uri

string<uri>

Direct download URL

API Reference

Workspaces

Cases

Case Templates

Forms

Form Templates

Attachments

Document Intelligence

Signatures

Previous API version

Query Parameters

Request Body (JSON)

Request Body (Multipart)

Response Structure

Response Codes

Authorizations

Query Parameters

Body

Response

​Query Parameters

​Request Body (JSON)

​Request Body (Multipart)

​Response Structure

​Response Codes

Authorizations

Query Parameters

Body

Response

Query Parameters

Request Body (JSON)

Request Body (Multipart)

Response Structure

Response Codes