> ## Documentation Index
> Fetch the complete documentation index at: https://www.mill.fyi/llms.txt
> Use this file to discover all available pages before exploring further.

# Reserve an attachment upload

> Reserve an image/PDF attachment and obtain a short-lived private PUT URL. Upload file bytes directly to uploadUrl using the returned headers, then call complete_attachment. Treat URLs as temporary credentials; do not log them.

Write access: a member/administrator with a write-enabled credential, or an authorized signed-in user.

Reserve an image/PDF attachment and obtain a short-lived private PUT URL. Upload file bytes directly to uploadUrl using the returned headers, then call complete\_attachment. Treat URLs as temporary credentials; do not log them.

The signed PUT URL lasts five minutes. Upload directly using the returned headers; never forward a Mill cookie or bearer token to storage. Browsers set Content-Type and derive Content-Length from the file body.

MCP clients can use [`create_attachment_upload`](https://www.mill.fyi/mcp-reference/create_attachment_upload) for this operation.

[Request conventions](https://www.mill.fyi/api-reference/overview.md) · [API keys](https://www.mill.fyi/api-keys.md) · [MCP connections](https://www.mill.fyi/mcp-connections.md)


## OpenAPI

````yaml api-reference/openapi.json POST /api/tasks/{taskId}/attachments/uploads
openapi: 3.1.0
info:
  title: Mill HTTP API
  version: 1.0.6
  description: >-
    All registered task-board, account, OAuth, MCP transport and health
    operations. MCP tool schemas come from runtime validators; account
    operations follow their server handlers. Example data is fictional.
    Generation imports routes without issuing requests or connecting to a
    database.
servers:
  - url: https://mill-api.example.com
security: []
paths:
  /api/tasks/{taskId}/attachments/uploads:
    post:
      tags:
        - Attachments
      summary: Reserve an attachment upload
      description: >-
        Reserve an image/PDF attachment and obtain a short-lived private PUT
        URL. Upload file bytes directly to uploadUrl using the returned headers,
        then call complete_attachment. Treat URLs as temporary credentials; do
        not log them.


        The signed PUT URL lasts five minutes. Upload directly using the
        returned headers; never forward a Mill cookie or bearer token to
        storage. Browsers set Content-Type and derive Content-Length from the
        file body.


        Write access: a member/administrator with a write-enabled credential, or
        an authorized signed-in user.
      operationId: post_api_tasks_by_taskId_attachments_uploads
      parameters:
        - name: taskId
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: >-
            The taskId from the corresponding list, record or authorization
            response.
        - name: Origin
          in: header
          required: false
          schema:
            type: string
            format: uri
          description: >-
            The exact configured Mill UI origin. Required for browser mutations
            carrying session cookies.
        - name: Idempotency-Key
          in: header
          required: false
          schema:
            type: string
            minLength: 8
            maxLength: 128
            pattern: ^[A-Za-z0-9._:-]+$
          description: >-
            Reuse the same key and exact request bytes for retries of one
            logical mutation; different content conflicts.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                fileName:
                  type: string
                  minLength: 1
                  maxLength: 255
                contentType:
                  type: string
                  enum:
                    - image/png
                    - image/jpeg
                    - image/webp
                    - image/gif
                    - application/pdf
                sizeBytes:
                  type: integer
                  minimum: 1
                  maximum: 20971520
                sha256:
                  type: string
                  pattern: ^[A-Fa-f0-9]{64}$
              required:
                - fileName
                - contentType
                - sizeBytes
              additionalProperties: false
            example:
              fileName: restore-report.pdf
              contentType: application/pdf
              sizeBytes: 2048
      responses:
        '201':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  attachmentId:
                    type: string
                  uploadUrl:
                    type: string
                  headers:
                    type: object
                    properties:
                      Content-Type:
                        type: string
                      Content-Length:
                        type: string
                    additionalProperties: true
                  expiresAt:
                    type: string
                additionalProperties: true
                description: >-
                  Illustrative response shape. Fields can be absent in alternate
                  successful flows; see the operation description and example.
              example:
                attachmentId: 44444444-4444-4444-8444-444444444444
                uploadUrl: https://storage.example.test/private-upload?signature=example
                headers:
                  Content-Type: application/pdf
                  Content-Length: '2048'
                expiresAt: '2027-01-18T09:30:00.000Z'
        default:
          description: >-
            Request failure. Inspect code, message and requestId; respect
            Retry-After on HTTP 429.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - bearerAuth: []
        - sessionCookie: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Personal or team Mill REST API key
    sessionCookie:
      type: apiKey
      in: cookie
      name: mill_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.