File Uploads

Carrot attachments use a two-step presigned URL flow.

Step 1: Request upload URL

Call:

PUT /documents/{documentId}/attachments/{fileName}

With:

• contentLength (bytes)
• contentType (MIME type)

Reference: Attachments API.

Step 2: Upload directly to storage

Use the returned URL and upload file bytes with the same MIME type.

• No bearer token is required on the presigned upload call.
• Keep upload request headers consistent with step 1 payload.

Recommended practices

• Enforce the 10 MB size limit client-side before upload — see Rate Limits.
• Use deterministic file names when possible.
• Persist uploaded file names to reference later in event metadata.

Download flow

Request a temporary download URL via:

GET /documents/{documentId}/attachments/{fileName}

Then fetch the returned URL.

Related guides:

• Submitting a MassID — file uploads in context of a full document lifecycle.