Upload media file

import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const attachment = await site.attachments().uploadAttachment({ file: new File(['…'], 'photo.jpg', { type: 'image/jpeg' }) })

{
  "_id": "ckj0akbxa003vp39kfbxgb8zg",
  "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
  "_urls": {
    "key": "Example value"
  },
  "name": "blue-box",
  "title": "blue box",
  "extension": "png",
  "type": "attachment",
  "group": "images",
  "length": 10497,
  "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
  "width": 600,
  "height": 106,
  "landscape": true,
  "portrait": true,
  "docIds": [
    "clx8m2k4p0000a1b2c3d4e5f6"
  ],
  "archivedDocIds": [
    "clx8m2k4p0000a1b2c3d4e5f6"
  ],
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "_isCroppable": true,
  "crop": {},
  "used": true,
  "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
  "folderPath": "Example folder path"
}

import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const attachment = await site.attachments().uploadAttachment({ file: new File(['…'], 'photo.jpg', { type: 'image/jpeg' }) })

{
  "_id": "ckj0akbxa003vp39kfbxgb8zg",
  "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
  "_urls": {
    "key": "Example value"
  },
  "name": "blue-box",
  "title": "blue box",
  "extension": "png",
  "type": "attachment",
  "group": "images",
  "length": 10497,
  "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
  "width": 600,
  "height": 106,
  "landscape": true,
  "portrait": true,
  "docIds": [
    "clx8m2k4p0000a1b2c3d4e5f6"
  ],
  "archivedDocIds": [
    "clx8m2k4p0000a1b2c3d4e5f6"
  ],
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "_isCroppable": true,
  "crop": {},
  "used": true,
  "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
  "folderPath": "Example folder path"
}

In your app

A controller answers a route on your app: it calls uploadAttachment() and returns the answer.

Add the controller

app/controllers/upload_attachment_controller.ts

import { inject } from '@adonisjs/core'
import { SiteClient } from '@fetchski/attract-cms-sdk'

@inject()
export default class UploadAttachmentController {
  constructor(protected site: SiteClient) {}

  async handle() {
    return this.site.attachments().uploadAttachment({ file: new File(['…'], 'photo.jpg', { type: 'image/jpeg' }) })
  }
}

The other values are the example’s: take yours from the request, a form or your database.

Add the route

start/routes.ts

import router from '@adonisjs/core/services/router'

const UploadAttachmentController = () => import('#controllers/upload_attachment_controller')

router.post('/attachment/upload', [UploadAttachmentController])

Put it behind your auth middleware (.use(middleware.auth())): it acts with your key’s access.

Call it

Your own page’s form or script sends POST /attachment/upload and gets back its answer as JSON. Test it, below, calls it.

The uploaded file can then be used to create image or file documents. Uses multipart/form-data encoding with the file uploaded under the name ‘file’. Signing: a key whose signing mode covers writes signs this upload by its SHA-256: send the hex digest of the exact body bytes in X-Fetchski-Content-SHA256 and sign that digest in the body’s place (<timestamp>.POST.<path+query>.<digest>). The site checks the signature before it reads the upload, then the bytes against the digest. The SDKs do this for you. Signing requests shows how, from the API and both SDKs.

Required parameters

One object, e.g. uploadAttachment({ file }); leave out the optional fields.

Blob

required

Required. The file to upload. Format: a file’s bytes. Pass a File named with its extension, e.g. new File([bytes], 'photo.jpg', { type: 'image/jpeg' }): the site reads the file’s type from its name, so a bare Blob is refused.

Optional parameters

AposMode | null | undefined

Optional. Leave it out and the site uses "published". published (the default) or draft. Drafts need a credential that may see them: an API key with the type’s write scope (content:<type>:write), or a signed-in editor. The public and a key with only the read scope get 403. One of draft, published.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The locale to read or write, e.g. en (default: the site’s default locale).

Returns

An Attachment. File attachment information from upload endpoint. Read its properties (attachment.id): each says whether the site always sends it. The example answer is the site’s wire JSON: some keys differ from the property names (_id → id, _url → url, _urls → urls …).

string

Always sent. Unique attachment identifier.

string

Always sent. Slugified filename.

string

Always sent. Sortified filename.

string

Always sent. File extension.

string

Always sent. Always attachment.

string

Always sent. File group type.

number

Always sent. File size in bytes.

string

Always sent. MD5 checksum.

readonly string[]

Always sent. IDs of documents using this attachment.

readonly string[]

Always sent. IDs of archived documents using this attachment.

Date

Always sent. When it was uploaded (ISO 8601). Format: an ISO 8601 date and time.

string

Sometimes sent: undefined when the site leaves it out. The file’s URL: set for a file that is not an image. An image’s URLs are in _urls, by size (original is the file as uploaded).

Readonly<Record<string, string>>

Sometimes sent: undefined when the site leaves it out. An image’s URLs by size (original, max, full, two-thirds, one-half, one-third, one-sixth); unset for other files.

number

Sometimes sent: undefined when the site leaves it out. Image width in pixels (images only)

number

Sometimes sent: undefined when the site leaves it out. Image height in pixels (images only)

boolean

Sometimes sent: undefined when the site leaves it out. Whether image is landscape orientation (images only)

boolean

Sometimes sent: undefined when the site leaves it out. Whether image is portrait orientation (images only)

Date

Sometimes sent: undefined when the site leaves it out. When it last changed (ISO 8601). Format: an ISO 8601 date and time.

boolean

Sometimes sent: undefined when the site leaves it out. Whether the image can be cropped.

Readonly<Record<string, unknown>> | null

Sometimes sent: undefined when the site leaves it out, and it can be null. The crop applied, if any (top, left, width, height).

boolean

Sometimes sent: undefined when the site leaves it out. Whether any document uses the file.

string | null

Sometimes sent: undefined when the site leaves it out, and it can be null. The media folder holding the file, by its aposDocId.

string

Sometimes sent: undefined when the site leaves it out. That folder’s path, e.g. events/summer.

Errors

Nothing to catch: the SDK retries what is safe, and throws the rest as the classes below. Your exception handler turns them into your app’s own answers, once for every call (see Map SDK errors to responses); catch only what you want to react to here.

400

The site refused what was sent: errors lists each field’s problem, siteMessage the first.Retried first: No. Read: errors (field → messages), siteMessage.

401

The API key is missing or refused (malformed, revoked, expired), or a signature its signing mode needs is missing or stale.Retried first: No. Read: siteMessage, errorName, data.

413

File too large.Retried first: No. Read: reason, status.

415

Unsupported file type.Retried first: No. Read: reason, status.

500

The site failed. Its logs say why.Retried first: No: a write may have landed. Read: siteMessage, errorName, data.

no answer

No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).Retried first: Only when nothing reached the site (neverConnected()); never after a timeout, when it may have landed. Read: reason, neverConnected.

not sent

The client refused to send it (e.g. a path segment of ..); the site never saw it.Retried first: No. Read: reason (what to change).

any other

Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).Retried first: No. Read: reason, status.

setup

sites.forSite('acme') named a slug config/attract.ts doesn’t list (with the keys in the database: no row in attract_api_keys).Retried first: No: nothing was sent. Read: message, slug.

setup

The site’s entry is wrong: a malformed baseUrl or key, a key filed under another slug, or no default site. node ace attract:check names the fix.Retried first: No: nothing was sent. Read: message (what to fix).

Behavior

Access: an API key with any one of content:images:write, content:files:write or content:videos:write (or a master above one). A signed-in person may call it as far as their own permissions allow; anyone else gets 403.
Rate limit: the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with Retry-After. The client waits and retries for you; you see RateLimited only if that runs out.
Retries: a write is sent again only after a 429 (refused before it acted) or when it never reached the site. After a timeout or a 5xx it may have landed: check before you send it again.
Timeout: 15 s per attempt by default; raise timeout (milliseconds) in config/attract.ts for longer.

Test it

It calls the controller above with the SDK faked: fakeAttract() puts the fake in the container for this one test, and it answers every call with a valid example, so nothing leaves your machine and no key is read. Save it as tests/unit/attachments_upload_attachment.spec.ts, then run your tests:

tests/unit/attachments_upload_attachment.spec.ts

import { test } from '@japa/runner'
import app from '@adonisjs/core/services/app'
import { fakeAttract } from '@fetchski/attract-cms-adonis/testing'
import UploadAttachmentController from '#controllers/upload_attachment_controller'

test('attachments.uploadAttachment', async () => {
  const site = fakeAttract()

  const controller = await app.container.make(UploadAttachmentController)
  await controller.handle()

  site.assertCalled('attachments.uploadAttachment')
})

Terminal

node ace test

Answer with your own values: fake attachments.uploadAttachment with factories.Attachment({...}), the fields you give over a valid example.

tests/unit/attachments_upload_attachment_answers.spec.ts

import { test } from '@japa/runner'
import { factories, fakeAttract } from '@fetchski/attract-cms-adonis/testing'

test('attachments.uploadAttachment answers your values', async ({ assert }) => {
  const site = fakeAttract({
    'attachments.uploadAttachment': factories.Attachment({ id: 'Your value' }),
  })

  const attachment = await site.attachments().uploadAttachment({ file: new File(['…'], 'photo.jpg', { type: 'image/jpeg' }) })
  assert.containSubset(attachment, { id: 'Your value' })
})

Crop image attachment

site.attachments().cropAttachment()

POST /@apostrophecms/attachment/upload

The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.

import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const attachment = await site.attachments().uploadAttachment({ file: new File(['…'], 'photo.jpg', { type: 'image/jpeg' }) })

{
  "_id": "ckj0akbxa003vp39kfbxgb8zg",
  "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
  "_urls": {
    "key": "Example value"
  },
  "name": "blue-box",
  "title": "blue box",
  "extension": "png",
  "type": "attachment",
  "group": "images",
  "length": 10497,
  "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
  "width": 600,
  "height": 106,
  "landscape": true,
  "portrait": true,
  "docIds": [
    "clx8m2k4p0000a1b2c3d4e5f6"
  ],
  "archivedDocIds": [
    "clx8m2k4p0000a1b2c3d4e5f6"
  ],
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "_isCroppable": true,
  "crop": {},
  "used": true,
  "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
  "folderPath": "Example folder path"
}

Get started

Using the SDK

Going further

Pages & Site

Content

Media

Forms

Ads & Conversions

Analytics

In your app

Behavior

Test it

Crop image attachment

POST /@apostrophecms/attachment/upload

In your app

Behavior

Test it

Related

Crop image attachment

POST /@apostrophecms/attachment/upload