Commit Attachment Upload

Finalizes an upload after the file bytes have been PUT to the signed upload URL. Verifies the object landed in storage before the attachment starts describing the new content. Committing an already-committed attachment is a no-op.

POST /attachments/{attachmentId}/commit

Commit Attachment Upload

JavaScript

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api2.scorecard.io/api/v2/attachments/{attachmentId}/commit', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

200

{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "sessionId": "c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7",
  "filePath": "/tmp/report.pdf",
  "filename": "report.pdf",
  "contentType": "application/pdf",
  "sizeBytes": 482133,
  "sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "status": "uploaded",
  "uploadedAt": "2026-07-13T12:00:00.000Z",
  "metadata": null
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

attachmentId · string<uuid> · required

The ID of the Attachment to commit.

Example:

"3fa85f64-5717-4562-b3fc-2c963f66afa6"

Response

200

application/json

The committed attachment.

A file attached to a session. Bytes live in object storage; this describes the last committed content.

id · string<uuid> · required

The ID of the Attachment.

Example:

"3fa85f64-5717-4562-b3fc-2c963f66afa6"

sessionId · string · required

The session ID the attachment belongs to. Matches the session.id emitted on OTel spans, which is how attachments are joined to traces and records.

Required string length: 1 - 256

Example:

"c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7"

filePath · string · required

The logical file path of the attachment (e.g. the path the agent wrote on disk). Together with the session ID it identifies the attachment: re-uploading the same path in the same session updates the existing attachment in place.

Required string length: 1 - 1024

Example:

"/tmp/report.pdf"

filename · string | null · required

Display filename, if provided.

contentType · string | null · required

MIME type of the last committed content. Null until the first commit.

sizeBytes · integer | null · required

Size in bytes of the last committed content. Null until the first commit.

sha256 · string | null · required

SHA-256 of the last committed content. Null until the first commit.

Pattern: ^[0-9a-f]{64}$

Example:

"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"

status · enum<string> · required

uploaded once a commit has succeeded; pending while an initiated upload has not been committed yet.

Available options: pending, uploaded

uploadedAt · string | null · required

ISO 8601 timestamp of the last successful commit. Null until the first commit.

metadata · object | null · required

Arbitrary caller-supplied metadata.