AttachmentsLink Receipt or Invoice

Link Receipt or Invoice

Creates an attachment record linked to a transaction and returns a presigned S3 URL for direct file upload.

2-step flow:

  1. Call this endpoint with file metadata and the transaction ID — returns the attachment id and the uploadUrl.
  2. PUT the file binary to uploadUrl directly to S3 (not through the API), sending the Content-Type header for the file format.

The returned id can be used in Download attachment once the upload completes.

File format: file.name must end with an extension accepted for file.contentType, case-insensitive. If it doesn't, the response is 400. On the PUT, send the Content-Type listed for the format; with any other value, S3 rejects the upload with 403 (SignatureDoesNotMatch).

  • PDF: extension .pdf, Content-Type: application/pdf
  • PNG: extension .png, Content-Type: image/png
  • JPEG or JPG: extension .jpeg or .jpg, Content-Type: image/jpeg
  • XLS: extension .xls, Content-Type: application/vnd.ms-excel
  • XLSX: extension .xlsx, Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
  • ODF: extension .odf or .odt, Content-Type: application/vnd.oasis.opendocument.text
  • OFX: extension .ofx, Content-Type: application/x-ofx

Idempotency: this endpoint does not support the Idempotency-Key header. Each call creates a new attachment record — a transaction can have multiple linked attachments.

curl -X POST "https://api-sandbox.contasimples.com/attachments/v1/attachments" \
  -H "Content-Type: application/json" \
  -H "Signature-Input: example_string" \
  -H "Signature: example_string" \
  -H "Content-Digest: example_string" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
  "transactionId": "111304",
  "file": {
    "name": "invoice.pdf",
    "contentType": "PDF"
  },
  "description": "Invoice for the purchase"
}'
{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "status": "PROCESSING",
  "referenceId": "111304",
  "file": {
    "name": "invoice.pdf",
    "contentType": "PDF"
  },
  "description": "Invoice for purchase",
  "createdAt": "2026-06-25T22:54:52.000Z",
  "uploadUrl": "https://s3.amazonaws.com/bucket/key?X-Amz-Signature=..."
}
POST
/attachments/v1/attachments
POST
Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token
Bearer Tokenstring
Required

Bearer token from OAuth 2.0 client credentials. Format: Bearer TOKEN

Bearer token from OAuth 2.0 client credentials. Format: Bearer TOKEN
Content-Typestring
Required

The media type of the request body

Options: application/json
header
Signature-Inputstring

What was signed and the signature parameters, in the RFC 9421 format. A credential with a public key must send it on every call, reads included, or the request is refused with 401. The signature covers the @method, @path, and @query components, and also content-digest when there is a body. created and alg are required, and created is valid for 300 seconds. The full format, with examples, is in Request Signing.

header
Signaturestring

The signature of the base defined by RFC 9421, in base64, between : and under the same label used in Signature-Input, for example sig=:SGVsbG8gd29ybGQ=:. It always goes together with Signature-Input.

header
Content-Digeststring

Hash of the request body in the RFC 9530 format, with sha-256 or sha-512, for example sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:. It is required when the request has a body and the credential has a public key, and in that case Signature-Input must include the content-digest component.

transactionIdstring
Required

ID of the transaction to link the document to. Corresponds to the id field returned by Banking statement (numeric — send its value as a string) or by Credit card statement (ULID).

descriptionstring

Document description (optional).

Request Preview
Response

Response will appear here after sending the request

Authentication

header
Authorizationstring
Required

Bearer token. Bearer token from OAuth 2.0 client credentials. Format: Bearer TOKEN

Headers

Signature-Inputstring

What was signed and the signature parameters, in the RFC 9421 format. A credential with a public key must send it on every call, reads included, or the request is refused with 401. The signature covers the @method, @path, and @query components, and also content-digest when there is a body. created and alg are required, and created is valid for 300 seconds. The full format, with examples, is in Request Signing.

Signaturestring

The signature of the base defined by RFC 9421, in base64, between : and under the same label used in Signature-Input, for example sig=:SGVsbG8gd29ybGQ=:. It always goes together with Signature-Input.

Content-Digeststring

Hash of the request body in the RFC 9530 format, with sha-256 or sha-512, for example sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:. It is required when the request has a body and the credential has a public key, and in that case Signature-Input must include the content-digest component.

Body

application/json
transactionIdstring
Required

ID of the transaction to link the document to. Corresponds to the id field returned by Banking statement (numeric — send its value as a string) or by Credit card statement (ULID).

Example:
111304
fileobject
Required
descriptionstring

Document description (optional).

Example:
Invoice for the purchase

Responses