---
title: "Upload a file for an attachment field"
description: "Upload file bytes as `multipart/form-data` under `file` and return `{ id, name, size, mime, key, uploadedAt }`."
canonical: "https://grid82.com/docs/app-api/files/upload"
updated: "2026-11-13"
---

# Upload a file for an attachment field

`POST https://your-suite.grid82.app/your-app/v1/tables/{tableId}/files`

Upload file bytes as `multipart/form-data` under `file` and return `{ id, name, size, mime, key, uploadedAt }`.

> **Note: Generic contract**
>
> Your own version of this operation, with your tables and the fields you can read, is in
> your app's document: `https://{suite}.grid82.app/{app}/v1/openapi.json`, behind your credential.
> [Why each person gets their own](/docs/start/studio-and-runtime#why-an-app-has-an-api-of-its-own).

Set `recordId` to identify the record the file will belong to; unused uploads can be swept. Write the descriptor to an attachment field in a separate ordinary record write, with the same permission check, op log, and undo as any other value. Reject descriptors not returned by this operation: `key` identifies an R2 object, and inventing one could name someone else's bytes.

Requires the `records:write` scope. Operation `files.upload`. Not an MCP tool. A model cannot send bytes: a tool call is JSON, and an upload is a multipart file. Upload with the CLI (`--file ./path`) or from the grid, then attach the returned descriptor with an ordinary record write, which is a tool. CLI: `grid82 files upload` (`npx grid82`).

## Path parameters

| Name      | Type   | Required | Description |
| --------- | ------ | -------- | ----------- |
| `tableId` | string | yes      |             |

## Headers

| Name              | Type   | Required | Description                                                                                                                                                                                                                                                        |
| ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Idempotency-Key` | string | no       | Any unique string. Sending the same key with the same request again returns the first response (marked `Idempotency-Replayed: true`) instead of running it twice. Reusing it for a different request is refused with 409. Kept for 24 hours. Up to 255 characters. |

## Request body

Sent as `multipart/form-data`.

| Field      | Type   | Required | Description                                                                        |
| ---------- | ------ | -------- | ---------------------------------------------------------------------------------- |
| `file`     | string | yes      | The bytes.                                                                         |
| `recordId` | string | yes      | The record the file will be attached to, so an upload never attached can be swept. |

**Authorizations**

- `Authorization` (bearer, in header, required)

## Response

**201**: Success

- `data` (`object`, required)
- `data.id` (`string`, required)
- `data.name` (`string`, required)
- `data.size` (`number`, required)
- `data.mime` (`string`, required)
- `data.key` (`string`, required)
- `data.uploadedAt` (`string`, required)
- `data.width` (`number`)
- `data.height` (`number`)

```json
{
  "data": {
    "id": "<string>",
    "name": "<string>",
    "size": 123.45,
    "mime": "<string>",
    "key": "<string>",
    "uploadedAt": "<string>",
    "width": 123.45,
    "height": 123.45
  }
}
```

**4XX**: Refused

- `error` (`object`, required)
- `error.code` (`enum<string>`, required, one of: `not_found, forbidden, unauthenticated, validation_failed, conflict, rate_limited, payment_required, not_implemented, internal`)
- `error.message` (`string`, required)
- `error.details` (`Record<string, unknown>`)

```json
{
  "error": {
    "code": "not_found",
    "message": "<string>",
    "details": {}
  }
}
```

**Example request**

```bash
curl --request POST \
  --url 'https://your-suite.grid82.app/your-app/v1/tables/<tableId>/files' \
  --header 'Authorization: Bearer <token>'
```