---
title: "Uploads a single file by giving the server a public https URL to fetch from. The server downloads the file (capped at 50 MB, SSRF-protected: blocks RFC1918, loopback, link-local, AWS metadata IPs, and IPv6 ULA).
When body.LinkTo is supplied (entityType in {Task, Expense, Estimate, Invoice}), the row is linked in the same transaction; otherwise it is inserted as AttachmentType=\"Draft\" for later linking."
method: POST
path: "/api/FileAttachment/FromUrl"
tags: ["FileAttachment"]
---

# Uploads a single file by giving the server a public https URL to fetch from. The server downloads the file (capped at 50 MB, SSRF-protected: blocks RFC1918, loopback, link-local, AWS metadata IPs, and IPv6 ULA).
When body.LinkTo is supplied (entityType in {Task, Expense, Estimate, Invoice}), the row is linked in the same transaction; otherwise it is inserted as AttachmentType="Draft" for later linking.

`POST /api/FileAttachment/FromUrl`

## Request body

- FileAttachmentSourceUrlRequest — JSON body for POST /api/FileAttachment/FromUrl. Server fetches the file from the supplied https URL.
  - `SourceUrl` string — Public https URL the server will fetch to obtain the file. Required.
  - `Filename` string — Optional original filename. If omitted, derived from Content-Disposition or the URL path.
  - `ContentType` string — Optional MIME type. Falls back to the response Content-Type header.
  - `LinkTo` FileAttachmentLinkTarget — Identifies an entity to inline-link an uploaded attachment to. Supported entityType values: "Task", "Expense", "Estimate", "Invoice".
    - `EntityType` string — Entity kind. One of: "Task", "Expense", "Estimate", "Invoice".
    - `EntityId` integer — The target entity's primary key.

## Response `200`

Returns the uploaded file attachment details.

- FileAttachmentUploadResult — Response from the /api/FileAttachment* endpoints. Mirrors the shape of /api/Expense/Attachment with an optional LinkedTo echo when an inline link was requested.
  - `FileAttachments` FileAttachmentDetails[] — List of uploaded file attachment details.
    - `FileAttachmentID` integer — Unique identifier for the file attachment.
    - `SizeBytes` integer — File size in bytes.
    - `OriginalFilename` string — Original filename as uploaded.
    - `PublicFileURL` string — Public URL to access the uploaded file.
    - `PreviewBaseURL` string — URL for a preview/thumbnail of the file.
  - `LinkedTo` FileAttachmentLinkTarget — Identifies an entity to inline-link an uploaded attachment to. Supported entityType values: "Task", "Expense", "Estimate", "Invoice".
    - `EntityType` string — Entity kind. One of: "Task", "Expense", "Estimate", "Invoice".
    - `EntityId` integer — The target entity's primary key.

## Other responses

- `400` — Bad request (missing/invalid URL, oversize, blocked source URL, unknown entity).
- `401` — Unauthorized.
- `403` — Caller lacks the required scope or right.
- `507` — Insufficient storage allowance on the account.

---

[API](https://skmtc.net/avaza/apis/avaza-api-documentation.md) · [All operations](https://skmtc.net/avaza/apis/avaza-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/avaza/avaza-api-documentation/versions/1eeadf750514/schema)