Skip to main content
POST
Reserve an attachment upload
Write access: a member/administrator with a write-enabled credential, or an authorized signed-in user. Reserve an image/PDF attachment and obtain a short-lived private PUT URL. Upload file bytes directly to uploadUrl using the returned headers, then call complete_attachment. Treat URLs as temporary credentials; do not log them. The signed PUT URL lasts five minutes. Upload directly using the returned headers; never forward a Mill cookie or bearer token to storage. Browsers set Content-Type and derive Content-Length from the file body. MCP clients can use create_attachment_upload for this operation. Request conventions · API keys · MCP connections

Authorizations

Authorization
string
header
required

Personal or team Mill REST API key

Headers

Origin
string<uri>

The exact configured Mill UI origin. Required for browser mutations carrying session cookies.

Idempotency-Key
string

Reuse the same key and exact request bytes for retries of one logical mutation; different content conflicts.

Required string length: 8 - 128
Pattern: ^[A-Za-z0-9._:-]+$

Path Parameters

taskId
string<uuid>
required

The taskId from the corresponding list, record or authorization response.

Body

application/json
fileName
string
required
Required string length: 1 - 255
contentType
enum<string>
required
Available options:
image/png,
image/jpeg,
image/webp,
image/gif,
application/pdf
sizeBytes
integer
required
Required range: 1 <= x <= 20971520
sha256
string
Pattern: ^[A-Fa-f0-9]{64}$

Response

Successful response. Examples are illustrative; field values vary by record.

Illustrative response shape. Fields can be absent in alternate successful flows; see the operation description and example.

attachmentId
string
uploadUrl
string
headers
object
expiresAt
string