> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fetchski-attract.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Upload media file

> Upload a media file to create an attachment.

```php Laravel wrap theme={"dark"}
use Fetchski\AttractCmsLaravel\Facades\Attract;

$attachment = Attract::attachments()->uploadAttachment(file: storage_path('app/photo.jpg'));
```

```json 200 wrap theme={"dark"}
{
  "_id": "ckj0akbxa003vp39kfbxgb8zg",
  "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
  "_urls": {
    "key": "Example value"
  },
  "name": "blue-box",
  "title": "blue box",
  "extension": "png",
  "type": "attachment",
  "group": "images",
  "length": 10497,
  "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
  "width": 600,
  "height": 106,
  "landscape": true,
  "portrait": true,
  "docIds": [
    "clx8m2k4p0000a1b2c3d4e5f6"
  ],
  "archivedDocIds": [
    "clx8m2k4p0000a1b2c3d4e5f6"
  ],
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "_isCroppable": true,
  "crop": {},
  "used": true,
  "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
  "folderPath": "Example folder path"
}
```

## In your app

A controller answers a route on your app: it calls `uploadAttachment()` and returns the answer.

**1. Add the controller**

```php app/Http/Controllers/UploadAttachmentController.php theme={"dark"}
<?php

declare(strict_types=1);

namespace App\Http\Controllers;

use Fetchski\AttractCmsLaravel\Data\Attachment;
use Fetchski\AttractCmsLaravel\Facades\Attract;

final class UploadAttachmentController
{
    public function __invoke(): Attachment
    {
        return Attract::attachments()->uploadAttachment(file: storage_path('app/photo.jpg'));
    }
}
```

The other values are the example’s: take yours from the request, a form or your database.

**2. Add the route**

```php routes/web.php theme={"dark"}
use App\Http\Controllers\UploadAttachmentController;
use Illuminate\Support\Facades\Route;

Route::post('/attachment/upload', UploadAttachmentController::class)->middleware('auth');
```

It acts with your key’s access, so `auth` lets only your signed-in users reach it.

**3. Call it**

Your own page’s form or script sends `POST /attachment/upload` (a form adds `@csrf`, as every web route checks it), and gets back its answer as JSON. Test it, below, calls it.

> [!TIP]
>
> To keep the call in an Action instead, this writes `app/Actions/Attract/UploadAttachment.php` (an invokable Action that calls `uploadAttachment()`) and its test under `tests/Feature/Actions/Attract/` (Pest when your app has it):
>
> ```bash Terminal theme={"dark"}
> php artisan make:attract-action attachments.uploadAttachment
> ```

## Call it from the terminal

```bash Terminal theme={"dark"}
php artisan attract:call attachments.uploadAttachment file=storage/app/photo.jpg
```

It calls `uploadAttachment()` on your default site and prints its answer as JSON. It writes, so it asks first: add `--force` to skip the question in a script. See [Call any method from the terminal](https://docs.fetchski-attract.com/call-command.md) for every argument type.

The uploaded file can then be used
to create image or file documents. Uses multipart/form-data encoding with the
file uploaded under the name 'file'.

**Signing:** a key whose signing mode covers writes signs this upload by its SHA-256: send the hex digest of the exact body bytes in `X-Fetchski-Content-SHA256` and sign that digest in the body’s place (`<timestamp>.POST.<path+query>.<digest>`). The site checks the signature before it reads the upload, then the bytes against the digest. The SDKs do this for you. [Signing requests](https://docs.fetchski-attract.com/signing.md) shows how, from the API and both SDKs.

> [accordion] Required parameters
>
> Named arguments, e.g. `uploadAttachment(file: …)`; leave out the optional ones.
>
> **file** `UploadedFile|\\SplFileInfo|string` *required*
>
> **Required.** The file to upload. Format: a file’s bytes. Pass a form’s `UploadedFile`, an `SplFileInfo` or a path: it is sent under its own name.

> [accordion] Optional parameters
>
> **aposMode** `Enums\\AposMode|string|null`
>
> **Optional.** Leave it out and the site uses `"published"`. `published` (the default) or `draft`. Drafts need a credential that may see them: an API key with the type’s write scope (`content:<type>:write`), or a signed-in editor. The public and a key with only the read scope get 403. One of `draft`, `published`.
>
> **aposLocale** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The locale to read or write, e.g. `en` (default: the site’s default locale).

> [accordion] Returns
>
> An `Attachment` (`Fetchski\AttractCmsLaravel\Data\Attachment`). File attachment information from upload endpoint. Read its properties (`$attachment->id`): each says whether the site always sends it. The example answer is the site’s wire JSON: some keys differ from the property names (`_id` → `id`, `_url` → `url`, `_urls` → `urls` …).
>
> **id** `string`
>
> **Always sent.** Unique attachment identifier.
>
> **name** `string`
>
> **Always sent.** Slugified filename.
>
> **title** `string`
>
> **Always sent.** Sortified filename.
>
> **extension** `string`
>
> **Always sent.** File extension.
>
> **type** `string`
>
> **Always sent.** Always `attachment`.
>
> **group** `string`
>
> **Always sent.** File group type.
>
> **length** `int`
>
> **Always sent.** File size in bytes.
>
> **md5** `string`
>
> **Always sent.** MD5 checksum.
>
> **docIds** `Collection\<int, string\>`
>
> **Always sent.** IDs of documents using this attachment.
>
> **archivedDocIds** `Collection\<int, string\>`
>
> **Always sent.** IDs of archived documents using this attachment.
>
> **createdAt** `CarbonImmutable`
>
> **Always sent.** When it was uploaded (ISO 8601). Format: an ISO 8601 date and time.
>
> **url** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The file’s URL: set for a file that is not an image. An image’s URLs are in `_urls`, by size (`original` is the file as uploaded).
>
> **urls** `array\<string, string\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. An image’s URLs by size (`original`, `max`, `full`, `two-thirds`, `one-half`, `one-third`, `one-sixth`); unset for other files.
>
> **width** `?int`
>
> **Sometimes sent:** `null` when the site leaves it out. Image width in pixels (images only)
>
> **height** `?int`
>
> **Sometimes sent:** `null` when the site leaves it out. Image height in pixels (images only)
>
> **landscape** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. Whether image is landscape orientation (images only)
>
> **portrait** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. Whether image is portrait orientation (images only)
>
> **updatedAt** `?CarbonImmutable`
>
> **Sometimes sent:** `null` when the site leaves it out. When it last changed (ISO 8601). Format: an ISO 8601 date and time.
>
> **isCroppable** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. Whether the image can be cropped.
>
> **crop** `array\<string, mixed\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. The crop applied, if any (`top`, `left`, `width`, `height`).
>
> **used** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. Whether any document uses the file.
>
> **folderId** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The media folder holding the file, by its `aposDocId`.
>
> **folderPath** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. That folder’s path, e.g. `events/summer`.

> [accordion] Errors
>
> Nothing to catch: the SDK retries what is safe, and Laravel logs and renders the rest (see [Errors and testing](https://docs.fetchski-attract.com/laravel/errors.md)).
>
> **ValidationFailed** `400`
>
> The site refused what was sent: `errors()` lists each field’s problem, `siteMessage()` the first.
>
> **Retried first:** No. **Read:** `errors()` (field → messages), `siteMessage()`.
>
> **AuthenticationFailed** `401`
>
> The API key is missing or refused (malformed, revoked, expired), or a signature its signing mode needs is missing or stale.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **SiteRequestFailed** `413`
>
> File too large.
>
> **Retried first:** No. **Read:** `reason()`, `status()`.
>
> **SiteRequestFailed** `415`
>
> Unsupported file type.
>
> **Retried first:** No. **Read:** `reason()`, `status()`.
>
> **SiteError** `500`
>
> The site failed. Its logs say why.
>
> **Retried first:** No: a write may have landed. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **SiteUnreachable** `no answer`
>
> No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).
>
> **Retried first:** Only when nothing reached the site (`neverConnected()`); never after a timeout, when it may have landed. **Read:** `reason()`, `neverConnected()`.
>
> **RequestNotSent** `not sent`
>
> The client refused to send it (e.g. a path segment of `..`); the site never saw it.
>
> **Retried first:** No. **Read:** `reason()` (what to change).
>
> **SiteRequestFailed** `any other`
>
> Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).
>
> **Retried first:** No. **Read:** `reason()`, `status()`.
>
> **UnknownSite** `setup`
>
> `Attract::site('acme')` named a slug that isn’t under `sites` in `config/fetchski-attract.php`.
>
> **Retried first:** No: nothing was sent. **Read:** `getMessage()`, `$e->slug`.
>
> **SiteConfigurationError** `setup`
>
> The site’s config entry is wrong: no `url`, a malformed `api_key`, a key filed under another slug, or no default site.
>
> **Retried first:** No: nothing was sent. **Read:** `getMessage()` (what to fix).

## Behavior

* **Access:** an API key with any one of `content:images:write`, `content:files:write` or `content:videos:write` (or a master above one). A signed-in person may call it as far as their own permissions allow; anyone else gets 403.
* **Rate limit:** the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with `Retry-After`. The client waits and retries for you; you see `RateLimited` only if that runs out.
* **Retries:** a write is sent again only after a 429 (refused before it acted) or when it never reached the site. After a timeout or a 5xx it may have landed: check before you send it again.
* **Timeout:** 15 s per attempt by default; raise `timeout` in `config/fetchski-attract.php` for longer.

## Test it

It calls the route above with the SDK faked: the fake answers every call with a valid example, so nothing leaves your machine and no config or key is needed. Save it as `tests/Feature/UploadAttachmentTest.php`, then run your tests:

```php tests/Feature/UploadAttachmentTest.php theme={"dark"}
<?php

declare(strict_types=1);

namespace Tests\Feature;

use App\Models\User;
use Fetchski\AttractCmsLaravel\Facades\Attract;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

final class UploadAttachmentTest extends TestCase
{
    use RefreshDatabase;

    public function test_upload_attachment(): void
    {
        Attract::fake();

        $this->actingAs(User::factory()->create())
            ->postJson('/attachment/upload')
            ->assertOk();

        Attract::assertCalled('attachments.uploadAttachment');
    }
}
```

```bash Terminal theme={"dark"}
php artisan test
```

**Answer with your own values:** fake `attachments.uploadAttachment` with `Attachment::factory()->make([...])`, the fields you give over a valid example.

```php tests/Feature/UploadAttachmentAnswerTest.php theme={"dark"}
<?php

declare(strict_types=1);

namespace Tests\Feature;

use Fetchski\AttractCmsLaravel\Data\Attachment;
use Fetchski\AttractCmsLaravel\Facades\Attract;
use Tests\TestCase;

final class UploadAttachmentAnswerTest extends TestCase
{
    public function test_upload_attachment_answers_your_values(): void
    {
        Attract::fake([
            'attachments.uploadAttachment' => Attachment::factory()->make(['id' => 'Your value']),
        ]);

        $attachment = Attract::attachments()->uploadAttachment(file: storage_path('app/photo.jpg'));

        $this->assertSame('Your value', $attachment->id);
    }
}
```

## Related

> [card] [Crop image attachment](https://docs.fetchski-attract.com/laravel/reference/attachments/crop-attachment.md)
>
> `Attract::attachments()->cropAttachment()`

> [card] [POST /@apostrophecms/attachment/upload](https://docs.fetchski-attract.com/api-reference/attachments/upload-media-file.md)
>
> The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.