kb_attachments_begin_upload
Begin a short-lived direct attachment upload for a client that can transfer local file bytes. Provide document_id and the original filename; optionally provide expected_sha256. The result contains an HTTPS upload_url ending in #token=. The fragment is local to the client and is never sent to the server: extract its token and POST the raw file bytes with Content-Type: application/octet-stream and Authorization: Bearer . Send no multipart envelope; upload_url is the endpoint, not a file field, not the fragment. The capability expires in five minutes and succeeds once. The returned size limit is authoritative. Never put the token in a path, query, tool argument, or log.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filename | Yes | Original filename including extension | |
| document_id | Yes | Document to attach the file to | |
| tenant_slug | No | Tenant slug to target. Required when your token grants several workspaces; omit when it grants one. If you omit it with several, the refusal names your default workspace; call kb_tenants_list to see every workspace the token grants. | |
| expected_sha256 | No | Optional SHA-256 hex digest of the exact file bytes (64 hexadecimal characters). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| expires_at | Yes | ||
| upload_url | Yes | ||
| max_size_bytes | Yes |