> ## Documentation Index
> Fetch the complete documentation index at: https://scorecard-d65b5e8a-docs-attachment-api-reference.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Commit Attachment Upload

> Finalizes an upload after the file bytes have been PUT to the signed upload URL. Verifies the object landed in storage before the attachment starts describing the new content. Committing an already-committed attachment is a no-op.



## OpenAPI

````yaml post /attachments/{attachmentId}/commit
openapi: 3.1.0
info:
  title: Scorecard API
  description: REST API for Scorecard
  version: 1.0.0
servers:
  - url: https://api2.scorecard.io/api/v2
security:
  - ApiKeyAuth: []
paths:
  /attachments/{attachmentId}/commit:
    post:
      summary: Commit Attachment Upload
      description: >-
        Finalizes an upload after the file bytes have been PUT to the signed
        upload URL. Verifies the object landed in storage before the attachment
        starts describing the new content. Committing an already-committed
        attachment is a no-op.
      operationId: commitAttachment
      parameters:
        - in: path
          name: attachmentId
          description: The ID of the Attachment to commit.
          schema:
            type: string
            format: uuid
            example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
          required: true
      responses:
        '200':
          description: The committed attachment.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Attachment'
              examples:
                Committed:
                  value:
                    id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
                    sessionId: c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7
                    filePath: /tmp/report.pdf
                    filename: report.pdf
                    contentType: application/pdf
                    sizeBytes: 482133
                    sha256: >-
                      9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
                    status: uploaded
                    uploadedAt: '2026-07-13T12:00:00.000Z'
                    metadata: null
                  summary: Committed
                  description: >-
                    The upload was verified and the attachment now describes the
                    new content.
        '401':
          $ref: '#/components/responses/UnauthenticatedError'
        '500':
          $ref: '#/components/responses/ServiceError'
components:
  schemas:
    Attachment:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The ID of the Attachment.
          example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
        sessionId:
          type: string
          minLength: 1
          maxLength: 256
          description: >-
            The session ID the attachment belongs to. Matches the `session.id`
            emitted on OTel spans, which is how attachments are joined to traces
            and records.
          example: c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7
        filePath:
          type: string
          minLength: 1
          maxLength: 1024
          description: >-
            The logical file path of the attachment (e.g. the path the agent
            wrote on disk). Together with the session ID it identifies the
            attachment: re-uploading the same path in the same session updates
            the existing attachment in place.
          example: /tmp/report.pdf
        filename:
          type:
            - string
            - 'null'
          description: Display filename, if provided.
        contentType:
          type:
            - string
            - 'null'
          description: >-
            MIME type of the last committed content. Null until the first
            commit.
        sizeBytes:
          type:
            - integer
            - 'null'
          description: >-
            Size in bytes of the last committed content. Null until the first
            commit.
        sha256:
          type:
            - string
            - 'null'
          pattern: ^[0-9a-f]{64}$
          description: SHA-256 of the last committed content. Null until the first commit.
          example: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
        status:
          type: string
          enum:
            - pending
            - uploaded
          description: >-
            `uploaded` once a commit has succeeded; `pending` while an initiated
            upload has not been committed yet.
        uploadedAt:
          type:
            - string
            - 'null'
          description: >-
            ISO 8601 timestamp of the last successful commit. Null until the
            first commit.
        metadata:
          type:
            - object
            - 'null'
          additionalProperties: true
          description: Arbitrary caller-supplied metadata.
          x-stainless-any: true
      required:
        - id
        - sessionId
        - filePath
        - filename
        - contentType
        - sizeBytes
        - sha256
        - status
        - uploadedAt
        - metadata
      description: >-
        A file attached to a session. Bytes live in object storage; this
        describes the last committed content.
    ApiError:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        details:
          type: object
          additionalProperties: true
          x-stainless-any: true
      required:
        - code
        - message
        - details
      description: An API error.
  responses:
    UnauthenticatedError:
      description: Error indicating that the request is not authenticated.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            Authentication failure:
              value:
                code: UNAUTHORIZED
                message: Invalid or missing authentication token
                details: {}
              summary: Authentication failure
              description: >-
                Error returned when authentication credentials are invalid or
                missing.
    ServiceError:
      description: >-
        An internal service error indicating an issue with the Scorecard
        service.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            Internal error:
              value:
                code: INTERNAL_ERROR
                message: An unexpected error occurred while processing your request.
                details: {}
              summary: Internal error
              description: Generic error when an unexpected internal issue occurs.
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: starts with ak_

````