---
title: "Add attachment to candidate"
method: POST
path: "/ats/candidates/{candidate_id}/attachments"
tags: ["Unified ATS API"]
---

# Add attachment to candidate

`POST /ats/candidates/{candidate_id}/attachments`

Uploads an attachment file for the specified candidate.

<Warning>
  **We recommend using the [add attachment to application](/ats/v1/post-applications-application-id-attachments) endpoint instead.**

  We realized that in practice it was always more about adding attachments to _applications_ instead of _candidates_, so we created a new, more aptly named one that you should use instead: [add attachment to application](/ats/v1/post-applications-application-id-attachments)
  </Warning>

<Note>
  This endpoint requires the permission **Add attachments** to be enabled in [your scope config](/scopes).
</Note>

### Example Request Body

```json
{
  "candidate_id": "GRKdd9dibYKKCrmGRSMJf3wu",
  "attachment": {
    "name": "Frank Doe CV.txt",
    "data": "SGkgdGhlcmUsIEtvbWJvIGlzIGN1cnJlbnRseSBoaXJpbmcgZW5naW5lZXJzIHRoYXQgbG92ZSB0byB3b3JrIG9uIGRldmVsb3BlciBwcm9kdWN0cy4=",
    "type": "CV",
    "content_type": "text/plain"
  }
}
```

## Path parameters

- `candidate_id` string, required — The Kombo ID of the candidate you want to add the attachment to.

## Headers

- `X-Integration-Id` string, required

## Request body

- PostAtsCandidatesCandidateIdAttachmentsRequestBody
  - `attachment` object, required
    - `name` string, required — File name of the file you want to upload. We recommend providing something human-readable with a valid file extension (like `Resume.pdf`), as this might be shown in your customer's system.
    - `content_type` string — Content/MIME type of the file (e.g., `application/pdf`). If you provide `data`, this is required. If you provide `data_url`, this is optional and we'll attempt to use the `Content-Type` header of the response. **Note:** Please validate that the content type you provide is actually meaningful (and not something generic like [`application/octet-stream`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/MIME_types#applicationoctet-stream)). Especially when using object storage (like AWS S3), it's easy to accidentally discard the content types of user-provided files, so make sure to explicitly persist them when processing uploads from your users (see guides for [AWS](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingMetadata.html#SysMetadata), [Google Cloud](https://cloud.google.com/storage/docs/metadata#content-type), and [Azure](https://learn.microsoft.com/en-us/rest/api/storageservices/put-blob#request-headers-all-blob-types)).
    - `data_url` string, uri — URL to the file you want to upload that can be accessed without authentication headers. We will download the content immediately when receiving the request, so the URL can be short-lived. If you're using an object storage provider (like AWS S3), we strongly recommend providing a signed URL for secure access (see guides for [AWS](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html), [Google Cloud](https://cloud.google.com/storage/docs/access-control/signed-urls), and [Azure](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview)). **Note:** You must provide either this or `data_url`. We recommend `data_url` over `data` for most cases.
    - `data` string — Base64-encoded contents of the file you want to upload. **Note:** You must provide either this or `data_url`. We recommend `data_url` over `data` for most cases.
    - `type` 'CV' | 'COVER_LETTER' | 'OTHER', required — Type of the attachment in the ATS. This may affect where the uploaded file will be shown in your customer's system.
  - `remote_fields` object — Additional fields that we will pass through to specific ATS systems.
    - `greenhouse` object — Fields specific to Greenhouse.
      - `post_headers` object — Headers we will pass with `POST` requests to Greenhouse.
        - `On-Behalf-Of` string, nullable — ID of the the user that will show up as having performed the action in Greenhouse. We already pass a value by default, but you can use this to override it.
    - `workable` object — Workable specific remote fields for ATS actions.
      - `on_behalf_of_user_remote_id` string — The remote ID of the user that will be displayed in the UI as the one that performed the action.

## Response `200`

POST /ats/candidates/:candidate_id/attachments Positive response

- PostAtsCandidatesCandidateIdAttachmentsPositiveResponse
  - `status` 'success', required
  - `data` object, required
  - `warnings` object[], required — These are the interaction warnings that are shown in the dashboard. They are meant to provide debug information to you. We recommend logging them to the console.
    - `message` string, required

## Other responses

- `default` — The standard error response with the error codes for the ATS use case.

---

[API](https://skmtc.net/kombo/apis/kombo-api.md) · [All operations](https://skmtc.net/kombo/apis/kombo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kombo/kombo-api/versions/1e45035b96d3/schema)