mintNoteAttachmentUpload

mutation · in the family Work and notes

What it does

Get a short-lived, pre-authorized upload slot for a note attachment.

Template class (hand-derived v29).

What happens

The file type and size are checked BEFORE any bytes move; risky types are refused unless scanning is enabled for your group.

Who may call it

Capability area: Work and notes — Tasks, notes, messages, dashboards and the everyday tools every staff member keeps.

Owner
System Administrator
Manager
Associate Manager
Warehouse Associate
Sales Associate
Cashier
An API key whose scope allows api:mintNoteAttachmentUpload

Arguments

Name	Type	Required	Notes
`input`	MintNoteAttachmentUploadInput `MintNoteAttachmentUploadInput!`	yes	No further notes.

Returns

NoteAttachmentUploadTicket NoteAttachmentUploadTicket! — The upload ticket: a short-TTL presigned PUT against the write-once blob key, PRE-TAGGED pending (the 7-day lifecycle reaps never-attached orphans). Bind the attachmentId via addNote before the TTL's practical window closes.

Example request

mutation ExampleMintNoteAttachmentUpload($input: MintNoteAttachmentUploadInput!) {
  mintNoteAttachmentUpload(input: $input) {
    attachmentId
    key
    uploadUrl
    expiresAt
  }
}

Variables:

{
  "input": {
    "targetConstructId": "01900000-0000-7000-8000-79e077380000",
    "targetType": "<target type>",
    "filename": "<filename>",
    "declaredContentType": "<declared content type>",
    "bytes": 1,
    "sha256": "<sha256>"
  }
}

Send it with the envelope naming the version: "extensions": {"at": {"version": {"name":"genesis","number":0}}}.

Example response

{
  "data": {
    "mintNoteAttachmentUpload": {
      "attachmentId": "01900000-0000-7000-8000-7bdf12b50000",
      "key": "<key>",
      "uploadUrl": "https://example.com/hook",
      "expiresAt": "2027-01-31T00:00:00.000Z"
    }
  },
  "extensions": {
    "at": {
      "callId": "01EXAMPLE-CALL-ID",
      "version": {
        "requested": {
          "name": "genesis",
          "number": 0
        },
        "serviced": {
          "name": "genesis",
          "number": 0
        }
      }
    }
  }
}

Errors this call can answer

VALIDATION/INVALID — Something in the request is not valid. (VALIDATION)
AUTHN/REQUIRED — Sign in to do this. (AUTHN)
AUTHZ/FORBIDDEN — Your role does not allow this action. (AUTHZ)
RATE_LIMIT/THROTTLED — Too many requests in a short time. (RATE_LIMIT)
NOT_FOUND/* — That record could not be found. (NOT_FOUND)
CONFLICT/* — The record’s state, or a change made in the meantime, does not allow this; the codes are on the CONFLICT page. (CONFLICT)
VALIDATION/VERSION_REQUIRED — The request did not say which app version it came from. (VALIDATION)

Used in

Give the team its work — tasks, labels, hand-offs