---
title: "Upload task evidence"
method: POST
path: "/v1/tasks/{taskId}/attachments"
tags: ["Tasks"]
---

# Upload task evidence

`POST /v1/tasks/{taskId}/attachments`

Upload an evidence attachment to a task so auditors and reviewers can trace completion back to source documentation.

## Path parameters

- `taskId` string, required

## Request body

- UploadAttachmentDto
  - `fileName` string, required — Name of the file
  - `fileType` string, required — MIME type of the file
  - `fileData` string — Base64-encoded file contents. For the web UI / direct callers. AI/MCP clients should instead upload via /v1/uploads/presign (purpose=attachment) and pass `s3Key` — base64 through an LLM is impractically slow and times out. Provide exactly one of fileData or s3Key.
  - `s3Key` string — Key of a file already uploaded via /v1/uploads/presign (purpose=attachment). The server fetches the bytes from storage — no base64 needed. Provide exactly one of fileData or s3Key.
  - `description` string — Description of the attachment
  - `userId` string — User ID of the user uploading the attachment (required for API key auth, ignored for JWT auth)

## Response `201`

Attachment uploaded successfully

- AttachmentResponseDto
  - `id` string, required — Unique identifier for the attachment
  - `name` string, required — Original filename
  - `type` string, required — File type/MIME type
  - `size` number, required — File size in bytes
  - `downloadUrl` string, required — Signed URL for downloading the file (temporary)
  - `createdAt` string, date-time, required — Upload timestamp

## Other responses

- `400` — Invalid file data or file too large
- `401` — Unauthorized - Invalid authentication
- `404` — Task not found

---

[API](https://skmtc.net/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.net/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/726b9523fb22/schema)