Attaching a file is a 3-step process. This service is step 3:

Request the upload credentials with Get file upload credentials (POST /api/s3_object), sending the file's name and size.
Upload the file directly to storage with a multipart/form-data POST request, using the credentials received and sending the file field last.
Call this service, sending in paths the key value received in step 1 (file) or the URL (link).

To attach links only, steps 1 and 2 are not needed.

Input parameters

Parameter	Type	Required	Description
`id_request`	integer	Yes	Work request code (`id_code` field) returned by `GET /api/work_requests`. Sent in the path; if sent in the body, it is ignored.
`id_status`	integer	Yes	Status recorded with the attachment. It must exist in the work request status catalog (you can query it with `GET /api/work_requests_status`).
`paths`	array of objects	Yes	List of attachments to associate. Each element is a file or a link. See the structure in the following tables.

Structure of each element in paths — File:

Parameter	Type	Required	Description
`name`	string	Yes	`key` value returned by Get file upload credentials for the already uploaded file.
`description`	string	No	Attachment description.

Structure of each element in paths — Link:

Parameter	Type	Required	Description
`url`	string	Yes	Link address. It must start with `http://` or `https://`. Maximum 2048 characters.
`label`	string	No	Visible text of the link. Maximum 500 characters. If not sent, the URL is used.

Rules for paths

Each element must include name (file) or url (link). If it includes url, it is treated as a link even if it also includes name.

The operation is atomic: if any element in paths is invalid, no attachment is created.

To attach a file, its upload credentials must have been requested first with its size (step 1).

Rules for the request

Attachments can only be associated with requests in Open (1), In progress (2) or Resolved without WO (4) status.

The request must belong to the company of the token used.

The token's user must have edit permission on Requests.

Output parameters

The response includes all the attachments of the request (those it already had and the new ones), not only the newly associated ones. The total field is returned as 0.

Parameter	Type	Description
`success`	boolean	Indicates whether the operation was successful.
`message`	string	Result code (`"ACTION_DONE"` if successful).
`data`	array of objects	Attachments of the request. See the structure in the following table.
`total`	integer	Returned as `0`.

Structure of each element in data:

Parameter	Type	Description
`id`	integer	Attachment identifier.
`id_company`	integer	Company identifier.
`id_request`	integer	Identifier of the request the attachment belongs to.
`id_status`	integer	Status recorded with the attachment.
`path`	string	For a file, the file `key`. For a link, the URL.
`description`	string	Description (file) or visible text (link).
`date`	string	Attachment creation date.
`size`	integer	File size in bytes. `0` for links.
`type`	integer	Attachment type: `1` = File, `2` = Link.
`name`	string	Attachment name.
`id_personnel_log` / `id_contacts_log`	integer	User or contact who created the attachment.
`id_action_account`	integer	Account from which the action was performed.

Errors

Code	Cause
`400` — `REQUEST_NOT_FOUND`	The request does not exist or belongs to another company.
`400` — `REQUEST_NOT_EDITABLE`	The current status of the request does not allow attachments.
`400` — `INVALID_STATUS`	The `id_status` sent does not exist in the work request status catalog.
`400` — `INVALID_URL`	The `url` of a link does not start with `http://` or `https://`.
`400` — `URL_TOO_LONG`	The `url` of a link exceeds 2048 characters.
`400` — `INVALID_PATH`	An element in `paths` includes neither `name` nor `url`.
`400` — `FILE_NOT_FOUND`	The `name` sent does not match a file whose upload credentials were requested by the company.
`400` — `body is required`	The request body was not sent.
`400` — `The request is poorly formed`	The `Authorization` header was not sent.
`401` — `INVALID_TOKEN`	The token is invalid.

Note on error codes
Validation errors are returned with success: false and the error code in the message field (for example, "REQUEST_NOT_EDITABLE"). Use that value to identify the cause.

Example

Request body

POST /api/work_requests_attachments_files/4010

{
  "id_status": 1,
  "paths": [
    {
      "name": "company_100/informe-mantenimiento.pdf",
      "description": "Inspection report"
    },
    {
      "url": "https://ejemplo.com/manual-equipo",
      "label": "Equipment manual"
    }
  ]
}

Response `200`

{
  "success": true,
  "message": "ACTION_DONE",
  "data": [
    {
      "id": 101,
      "id_company": 100,
      "id_request": 4010,
      "id_status": 1,
      "path": "company_100/informe-mantenimiento.pdf",
      "description": "Inspection report",
      "date": "2026-10-06",
      "size": 245760,
      "type": 1
    },
    {
      "id": 102,
      "id_company": 100,
      "id_request": 4010,
      "id_status": 1,
      "path": "https://ejemplo.com/manual-equipo",
      "description": "Equipment manual",
      "date": "2026-10-06",
      "size": 0,
      "type": 2
    }
  ],
  "total": 0
}

Response — Request in a status that does not allow attachments (`400`)

{
  "success": false,
  "message": "REQUEST_NOT_EDITABLE",
  "data": [],
  "total": 0
}

Response — File without prior upload credentials (`400`)

{
  "success": false,
  "message": "FILE_NOT_FOUND",
  "data": [],
  "total": 0
}

OpenAPI definition

{
  "openapi": "3.1.0",
  "info": {
    "title": "work_requests_attachments_files",
    "version": "2-En"
  },
  "servers": [
    {
      "url": "https://app.fracttal.com/api/work_requests_attachments_files"
    }
  ],
  "security": [
    {}
  ],
  "paths": {
    "/{id_request}": {
      "post": {
        "summary": "Attach files and links to a work request",
        "description": "",
        "operationId": "attach-files-and-links-to-a-work-request",
        "parameters": [
          {
            "name": "id_request",
            "in": "path",
            "required": true,
            "description": "Work request code (id_code field).",
            "schema": {
              "type": "integer"
            }
          }
        ],
        "deprecated": false,
        "security": []
      }
    }
  },
  "x-readme": {
    "headers": [],
    "explorer-enabled": false,
    "proxy-enabled": true
  },
  "x-readme-fauxas": true
}

Input parameters

Rules for paths

Rules for the request

Output parameters

Errors

Note on error codes

Example

Request body

Response 200

Response — Request in a status that does not allow attachments (400)

Response — File without prior upload credentials (400)

OpenAPI definition

Rules for `paths`

Response `200`

Response — Request in a status that does not allow attachments (`400`)

Response — File without prior upload credentials (`400`)