> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://tieback.io/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://tieback.io/docs/_mcp/server.

# API: Attachments

> Manage file attachments on products programmatically, covering upload, listing, metadata updates, removal and access rules for each attachment.

> **Programmatic access — early access**
>
> The
>
> **tie*back***
>
> API is available to selected workspaces during early access. Endpoints in production today are
> authenticated with an authenticated session. Standalone API-key access is being onboarded per
> workspace. Contact
>
> **tie*back***
>
> to enable API credentials for your workspace.

## What It Does

The Attachments API lets you create metadata records for product attachments, list attachments for a product, and soft-delete attachments. Attachment metadata is managed through RPCs; actual file upload and download use the storage layer separately.

## Authentication & Permissions

All RPCs require an authenticated session. Mutations require a role with sufficient permissions for the target brand.

## RPCs

### create\_product\_attachment\_record

Creates a metadata record for a new product attachment.

**Request**

```json
{
  "_brand_id": "uuid",
  "_product_id": "uuid",
  "_filename": "test-report.pdf",
  "_mime_type": "application/pdf",
  "_size_bytes": 204800
}
```

**Response**

```json
{
  "id": "uuid",
  "product_id": "uuid",
  "filename": "test-report.pdf",
  "mime_type": "application/pdf",
  "size_bytes": 204800,
  "storage_path": "brand-uuid/product-uuid/attachment-uuid",
  "created_at": "2026-01-15T12:00:00Z"
}
```

**Errors**

* Not authenticated, request has no valid JWT.
* Forbidden, caller does not have sufficient access.
* Invalid input, request is malformed or cannot be processed.

**Notes**

* This RPC creates the metadata record only. File upload is handled separately via the storage layer.

---

### list\_product\_attachments

Returns all active (non-deleted) attachments for a product.

**Request**

```json
{
  "_brand_id": "uuid",
  "_product_id": "uuid"
}
```

**Response**

```json
[
  {
    "id": "uuid",
    "filename": "test-report.pdf",
    "mime_type": "application/pdf",
    "size_bytes": 204800,
    "storage_path": "brand-uuid/product-uuid/attachment-uuid",
    "created_at": "2026-01-15T12:00:00Z"
  }
]
```

**Errors**

* Not authenticated, request has no valid JWT.
* Forbidden, caller does not have sufficient access.
* Invalid input, request is malformed or cannot be processed.

---

### soft\_delete\_product\_attachment

Marks an attachment as deleted without permanently removing it.

**Request**

```json
{
  "_brand_id": "uuid",
  "_attachment_id": "uuid"
}
```

**Response**

```json
{
  "id": "uuid",
  "is_deleted": true,
  "deleted_at": "2026-01-15T13:00:00Z"
}
```

**Errors**

* Not authenticated, request has no valid JWT.
* Forbidden, caller does not have sufficient access.
* Invalid input, request is malformed or cannot be processed.

**Notes**

* Soft-deleted attachments are excluded from `list_product_attachments` results.

## Related Docs

* [API: Products](/api-reference/api-products)
* [Products](/product-module/products)
* [API: Credentials](/api-reference/api-credentials)
* [Architecture](/getting-started/architecture)