---
title: "Upload an attachment to a Purchase Order"
method: POST
path: "/purchase_orders/{id}/attachments"
tags: ["Purchase Order"]
---

# Upload an attachment to a Purchase Order

`POST /purchase_orders/{id}/attachments`

Required permission: Purchase Orders - Edit

Accepts a single file via `multipart/form-data`. The file's actual content
(detected via magic-byte sniffing) must be one of the allowed types
(JPEG, PNG, GIF, PDF, CSV, XLS, XLSX) and the filename extension must match
the detected type. The declared `Content-Type` header is informational only
and is not trusted. Maximum file size is 10 MB. A PO may have at most
10 attachments.

## Path parameters

- `id` integer, required

## Response `201`

attachment created: application/vnd.openxmlformats (.xlsx)

## Other responses

- `401` — unauthorized without purchase_orders-update permission
- `404` — PO belongs to a different account
- `413` — file exceeds maximum size of 10 MB
- `415` — Windows PE binary spoofed as PDF
- `422` — duplicate MD5 for the same PO and user

---

[API](https://skmtc.net/syncromsp/apis/syncro.md) · [All operations](https://skmtc.net/syncromsp/apis/syncro/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/syncromsp/syncro/versions/3df3aed287cc/schema)