---
title: "Add attachment to application"
method: POST
path: "/ats/applications/{application_id}/attachments"
tags: ["Unified ATS API"]
---

# Add attachment to application

`POST /ats/applications/{application_id}/attachments`

Uploads an attachment file for the specified applicant.

<Warning>
  If adding an attachment to an application is not supported by the integration, the attachment will be [added to the candidate](/ats/v1/post-candidates-candidate-id-attachments) instead. 
</Warning>

<Note>
  This endpoint requires the permission **Add attachments** to be enabled in [your scope config](/scopes).
</Note>

### Example Request Body

```json
{
  "application_id": "GRKdd9dibYKKCrmGRSMJf3wu",
  "attachment": {
    "name": "Frank Doe CV.txt",
    "data": "SGkgdGhlcmUsIEtvbWJvIGlzIGN1cnJlbnRseSBoaXJpbmcgZW5naW5lZXJzIHRoYXQgbG92ZSB0byB3b3JrIG9uIGRldmVsb3BlciBwcm9kdWN0cy4=",
    "type": "CV",
    "content_type": "text/plain"
  },
  "remote_fields": {}
}
```

## Path parameters

- `application_id` string, required

## Headers

- `X-Integration-Id` string, required

## Request body

- PostAtsApplicationsApplicationIdAttachmentsRequestBody
  - `attachment` object, required
    - `name` string, required — File name of the file you want to upload. We recommend providing something human-readable with a valid file extension (like `Resume.pdf`), as this might be shown in your customer's system.
    - `content_type` string — Content/MIME type of the file (e.g., `application/pdf`). If you provide `data`, this is required. If you provide `data_url`, this is optional and we'll attempt to use the `Content-Type` header of the response. **Note:** Please validate that the content type you provide is actually meaningful (and not something generic like [`application/octet-stream`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/MIME_types#applicationoctet-stream)). Especially when using object storage (like AWS S3), it's easy to accidentally discard the content types of user-provided files, so make sure to explicitly persist them when processing uploads from your users (see guides for [AWS](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingMetadata.html#SysMetadata), [Google Cloud](https://cloud.google.com/storage/docs/metadata#content-type), and [Azure](https://learn.microsoft.com/en-us/rest/api/storageservices/put-blob#request-headers-all-blob-types)).
    - `data_url` string, uri — URL to the file you want to upload that can be accessed without authentication headers. We will download the content immediately when receiving the request, so the URL can be short-lived. If you're using an object storage provider (like AWS S3), we strongly recommend providing a signed URL for secure access (see guides for [AWS](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html), [Google Cloud](https://cloud.google.com/storage/docs/access-control/signed-urls), and [Azure](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview)). **Note:** You must provide either this or `data_url`. We recommend `data_url` over `data` for most cases.
    - `data` string — Base64-encoded contents of the file you want to upload. **Note:** You must provide either this or `data_url`. We recommend `data_url` over `data` for most cases.
    - `type` 'CV' | 'COVER_LETTER' | 'OTHER', required — Type of the attachment in the ATS. This may affect where the uploaded file will be shown in your customer's system.
  - `remote_fields` object — Additional fields that we will pass through to specific ATS systems.
    - `oracle` object — Oracle specific remote fields for the attachment.
      - `override_document_category` 'IRC_CANDIDATE_RESUME' | 'IRC_CANDIDATE_COVERLETTER' | 'MISC' | 'IRC_INTERNAL' — Allows you to override the document category for the attachment.
      - `multi_post_to_all_current_applications` boolean — If true, the attachment will be posted to all current applications for the candidate.
    - `greenhouse` object — Fields specific to Greenhouse.
      - `post_headers` object — Headers we will pass with `POST` requests to Greenhouse.
        - `On-Behalf-Of` string, nullable — ID of the the user that will show up as having performed the action in Greenhouse. We already pass a value by default, but you can use this to override it.
    - `workable` object — Workable specific remote fields for ATS actions.
      - `on_behalf_of_user_remote_id` string — The remote ID of the user that will be displayed in the UI as the one that performed the action.

## Response `200`

POST /ats/applications/:application_id/attachments Positive response

- PostAtsApplicationsApplicationIdAttachmentsPositiveResponse
  - `status` 'success', required
  - `data` object, required
  - `warnings` object[], required — These are the interaction warnings that are shown in the dashboard. They are meant to provide debug information to you. We recommend logging them to the console.
    - `message` string, required

## Other responses

- `default` — The standard error response with the error codes for the ATS use case.

---

[API](https://skmtc.net/kombo/apis/kombo-api.md) · [All operations](https://skmtc.net/kombo/apis/kombo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kombo/kombo-api/versions/1e45035b96d3/schema)