Upload a task attachment

Upload a file to a task as multipart/form-data (file).

Maximum 10 MB per file; the type is checked by content (magic bytes), not by extension: images (PNG, JPEG, GIF, WebP, HEIC, AVIF), PDF, Word/Excel/PowerPoint (OOXML), OpenDocument text and spreadsheet, plain text, CSV, Markdown and ZIP.
target places it in a new comment (default) or at the end of the description, and the optional note (up to 1,000 characters) becomes the comment text; a longer note returns 422 parameter_invalid_value.
The file counts towards the storage quota of your plan (402 storage_quota_exceeded when it is full).
Requires an Idempotency-Key.

Client-generated opaque key (up to 255 characters; UUID v7 recommended) that makes retries safe: the first response is cached and replayed for repeats without re-executing the mutation. Reusing a key with a different body returns 409 idempotency_key_reused. See the Idempotency guide. Required on this operation: repeating it delivers an effect that cannot be taken back (an email sent, a file generated, a third-party call, a charge), so a request without this header is rejected with 422 idempotency_key_required before any business logic runs.

Length1 <= length <= 255

Factuarea-Version?string

Pin the API version (YYYY-MM-DD, Stripe-style date versioning) for this request; omit to use the key's pinned version, or the latest if none. Unsupported version → 400 unsupported_api_version; malformed → 400 parameter_invalid_format. The effective version is echoed in the Factuarea-Version response header. See the Versioning guide.

Formatdate

X-Active-Profile?string

Operate on behalf of a child company (gestoría master key): pass its public id (UUID v7) and the request runs against that child's data without changing the key's scope, tier or environment (omit to use the key's own company). Invalid UUID → 400 parameter_invalid_uuid; unknown or non-owned id → 404 profile_not_found. See the Acting on behalf guide.

Formatuuid

Request Body

multipart/form-data

TypeScript Definitions

Use the request body type in TypeScript.

file*file

Attachment file (multipart). The type is detected from the content, never from the extension.

Formatbinary

target?string

Target: comment (default, creates a comment with the note and the attachment) or description.

Value in"description" | "comment"

note?|

Note of the comment that accompanies the attachment; only used with target=comment.

Lengthlength <= 1000

Response Body

`application/json`

Request example

const apiKey = process.env.FACTUAREA_API_KEY;if (!apiKey) throw new Error("Set FACTUAREA_API_KEY");const form = new FormData();form.append("file", new Blob([await (await import("node:fs/promises")).readFile("./documento.pdf")]), "documento.pdf");const response = await fetch("https://api.factuarea.com/v1/tasks/01931b3e-7c4a-7f2e-9a8b-3c5d6e7f8a01/attachments", {  method: "POST",  headers: { Authorization: `Bearer ${apiKey}`, ...{"Accept":"application/json","Idempotency-Key":"erp-2026-public-api-v1-tasks-attachments-create"} },  body: form,});if (!response.ok) throw new Error(await response.text());if (response.status !== 204) console.log(await response.json());

Response example

{
  "data": {
    "id": "0193a4f2-efb9-7daa-8e4b-3a5b7c9d1f02",
    "object": "task_attachment",
    "task_id": "0193a4f2-8f53-7d44-8e85-7a9b1c3d5f12",
    "comment_id": "0193a4f2-ab75-7f66-8a07-9c1d3e5f7b01",
    "surface": "comment",
    "file_name": "especificacion-pasarela.pdf",
    "mime_type": "application/pdf",
    "size_bytes": 1048576,
    "kind": "file",
    "uploaded_by_id": "0193a4f2-6b1c-7d3e-8a41-2c5e7f9a1b01",
    "created_at": "2026-09-24T12:31:09+02:00"
  }
}

{
  "error": {
    "type": "authentication_error",
    "code": "missing_api_key",
    "message": "Falta header Authorization o X-API-Key.",
    "doc_url": "https://docs.factuarea.com/guides/errors#missing_api_key",
    "request_id": "req_4f3124617b5bff7df54598c964"
  }
}

{
  "error": {
    "type": "payment_required_error",
    "code": "storage_quota_exceeded",
    "message": "No queda espacio de almacenamiento en tu empresa: estás usando 4995 MB de los 5000 MB de tu plan y este archivo ocupa 8 MB. Elimina archivos que ya no necesites o amplía tu plan desde Facturación, y vuelve a subirlo.",
    "doc_url": "https://docs.factuarea.com/guides/errors#storage_quota_exceeded",
    "request_id": "req_2cd106bfd5de0e110cc9f6165d"
  }
}

{
  "error": {
    "type": "authorization_error",
    "code": "insufficient_scope",
    "message": "Esta operación requiere el scope 'tasks:write'. Tu API key solo tiene los scopes: tasks:read.",
    "doc_url": "https://docs.factuarea.com/guides/errors#insufficient_scope",
    "request_id": "req_330f0b670aed848bac6662f4e9"
  }
}

{
  "error": {
    "type": "not_found_error",
    "code": "task_not_found",
    "message": "Tarea no encontrada.",
    "doc_url": "https://docs.factuarea.com/guides/errors#task_not_found",
    "request_id": "req_5c58349548d2534717af6874dd"
  }
}

{
  "error": {
    "type": "idempotency_error",
    "code": "idempotency_key_reused",
    "message": "Esa `Idempotency-Key` ya se usó con un payload distinto. La clave identifica una operación concreta, así que reutilizarla para otra vaciaría de sentido el replay.",
    "doc_url": "https://docs.factuarea.com/guides/errors#idempotency_key_reused",
    "request_id": "req_8e4c395af1acdc9ff95ef53010"
  }
}

{
  "error": {
    "type": "invalid_request_error",
    "code": "payload_too_large",
    "message": "El payload excede el límite de 1 MB.",
    "doc_url": "https://docs.factuarea.com/guides/errors#payload_too_large",
    "request_id": "req_daebbbfee6c4b693a2bbb79432"
  }
}

POST /v1/tasks/{task}/attachments · 422 task_attachment_rejected

{
  "error": {
    "type": "invalid_request_error",
    "code": "task_attachment_rejected",
    "message": "El tipo de fichero «application/x-msdownload» no está permitido.",
    "param": "file",
    "doc_url": "https://docs.factuarea.com/guides/errors#task_attachment_rejected",
    "request_id": "req_f4ab6a1237cb1feb30c673b38e"
  }
}

POST /v1/tasks/{task}/attachments · 422 invalid_upload_link_note

{
  "error": {
    "type": "invalid_request_error",
    "code": "parameter_invalid_value",
    "subcode": "invalid_upload_link_note",
    "message": "La nota no puede superar 1.000 caracteres.",
    "param": "note",
    "doc_url": "https://docs.factuarea.com/guides/errors#parameter_invalid_value",
    "request_id": "req_61dd7ccd5f903aaf96da6e743a"
  }
}

POST /v1/tasks/{task}/attachments · 422 invalid_param_value

{
  "error": {
    "type": "invalid_request_error",
    "code": "invalid_param_value",
    "message": "Adjunta un fichero en el campo file.",
    "param": "file",
    "doc_url": "https://docs.factuarea.com/guides/errors#invalid_param_value",
    "request_id": "req_1564da43ed9b63392ddc304301"
  }
}

POST /v1/tasks/{task}/attachments · 422 idempotency_key_required

{
  "error": {
    "type": "invalid_request_error",
    "code": "idempotency_key_required",
    "message": "La operación «public-api.v1.tasks.attachments.create» exige la cabecera Idempotency-Key desde el 2026-11-02. Envía una clave única por operación (un UUID sirve) y, si reintenta, repite exactamente la misma clave para que la operación no se ejecute dos veces.",
    "param": "Idempotency-Key",
    "doc_url": "https://docs.factuarea.com/guides/errors#idempotency_key_required",
    "request_id": "req_ec65c9274ae7eabd9b9c66656b"
  }
}

{
  "error": {
    "type": "rate_limit_error",
    "code": "rate_limit_exceeded",
    "message": "Has excedido el límite de requests permitido. Reintenta más tarde.",
    "doc_url": "https://docs.factuarea.com/guides/errors#rate_limit_exceeded",
    "request_id": "req_31508eb118fd99a64e74c9cfd8"
  }
}

{
  "error": {
    "type": "api_error",
    "code": "internal_error",
    "message": "Algo se rompió en nuestro lado al procesar la petición. La condición no la provoca tu payload.",
    "doc_url": "https://docs.factuarea.com/guides/errors#internal_error",
    "request_id": "req_d7ca9f7669df611370c1b726b0"
  }
}

Upload a task attachment

Authorization

Path Parameters

Headers

Request Body

Response Body

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

Upload a task attachment

Authorization

Path Parameters

Headers

Request Body

Response Body

201application/json

401application/json

402application/json

403application/json

404application/json

409application/json

413application/json

422application/json

429application/json

500application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`