# Accounting API — Attachments

> Canonical URL: https://developers.apideck.com/apis/accounting/reference#tag/Attachments

This document contains every operation on the `Attachments` resource.

---

# List Attachments

> **Accounting API** · `GET /accounting/attachments/{reference_type}/{reference_id}`
> Canonical URL: https://developers.apideck.com/apis/accounting/reference#tag/Attachments/operation/attachmentsAll
> MCP tool: `accounting-attachments-all`

## Authentication

- Send `Authorization: Bearer $API_KEY` using your Apideck secret API key. Keep the key server-side; never put it in a URL or client-side code.

Use the application, consumer and connector headers listed in Parameters below for this operation.

## Learn more

- [Attachment explained](https://developers.apideck.com/glossary#attachment)
- [How does cursor pagination work?](https://developers.apideck.com/glossary#cursor)

List Attachments

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `reference_type` | path | `string` | Yes | The reference type of the document. |
| `reference_id` | path | `string` | Yes | The reference id of the object to retrieve. |
| `raw` | query | `boolean` | No | Include raw response. Mostly used for debugging purposes |
| `x-apideck-consumer-id` | header | `string` | Yes | ID of the consumer which you want to get or push data from |
| `x-apideck-app-id` | header | `string` | Yes | The ID of your Unify application |
| `x-apideck-service-id` | header | `string` | No | Provide the service id you want to call (e.g., pipedrive). Only needed when a consumer has activated multiple integrations for a Unified API. |
| `x-apideck-company-id` | header | `string` | No | The ID of the company to scope requests to. For connectors that support multi-company, this overrides the default company configured in connection settings. |
| `cursor` | query | `string` | No | Cursor to start from. You can find cursors for next/previous pages in the meta.cursors property of the response. |
| `limit` | query | `integer` | No | Number of results to return. Minimum 1, Maximum 200, Default 20 |
| `fields` | query | `string` | No | The 'fields' parameter allows API users to specify the fields they want to include in the API response. If this parameter is not present, the API will return all available fields. If this parameter is present, only the fields specified in the comma-separated string will be included in the response. Nested properties can also be requested by using a dot notation. <br /><br />Example: `fields=name,email,addresses.city`<br /><br />In the example above, the response will only include the fields "name", "email" and "addresses.city". If any other fields are available, they will be excluded. |
| `pass_through` | query | `object` | No | Optional unmapped key/values that will be passed through to downstream as query parameters. Ie: ?pass_through[search]=leads becomes ?search=leads |

### Responses

#### 200 — Attachments

- `status_code` `integer` **required** — HTTP Response Status Code — example: `200`
- `status` `string` **required** — HTTP Response Status — example: `OK`
- `service` `string` **required** — Apideck ID of service provider — example: `quickbooks`
- `resource` `string` **required** — Unified API resource name — example: `PurchaseOrders`
- `operation` `string` **required** — Operation performed — example: `all`
- `data` `array of object` **required**
  - `id` `string` — A unique identifier for an object. — example: `12345`
  - `display_id` `string` — The display id of the file — example: `sample ID`
  - `name` `string` — The name of the file — example: `sample.jpg`
  - `mime_type` `string` — The MIME type of the file. — example: `image/jpeg`
  - `size` `integer` — The size of the file in bytes — example: `1810673`
  - `reference` `object`
    - `type` `string` — enum: `invoice`, `bill`, `bill-credit-note`, `credit-note`, `expense`, `expense-report`, `quote`, `journal-entry`
    - `id` `string` — A unique identifier for an object. — example: `12345`
  - `description` `string` — Optional description of the file — example: `A sample image`
  - `file_url` `string` — The URL to download or preview the file — example: `https://example.com/files/sample.jpg`
  - `parent_folder_id` `string` — The folder id where this attachment belong to — example: `123`
  - `updated_by` `string` — The user who last updated the object. — example: `12345`
  - `created_by` `string` — The user who created the object. — example: `12345`
  - `updated_at` `string` — The date and time when the object was last updated. — format: `date-time` — example: `2020-09-30T07:43:32.000Z`
  - `created_at` `string` — The date and time when the object was created. — format: `date-time` — example: `2020-09-30T07:43:32.000Z`
  - `pass_through` `array of object` — The pass_through property allows passing service-specific, custom data or structured modifications in request body when creating or updating resources.
    - `service_id` `string` **required** — Identifier for the service to which this pass_through should be applied.
    - `operation_id` `string` — Optional identifier for a workflow operation to which this pass_through should be applied. This is useful for Unify calls that are making more than one downstream request.
    - `extend_object` `object` — Simple object allowing any properties for direct extension.
    - `extend_paths` `array of object` — Array of objects for structured data modifications via paths.
      - `path` `string` **required** — JSONPath string specifying where to apply the value. — example: `$.nested.property`
      - `value` `any` **required** — The value to set at the specified path, can be any type.
- `meta` `object` — Response metadata
  - `items_on_page` `integer` — Number of items returned in the data property of the response — example: `50`
  - `cursors` `object` — Cursors to navigate to previous or next pages through the API
    - `previous` `string` — Cursor to navigate to the previous page of results through the API — example: `em9oby1jcm06OnBhZ2U6OjE=`
    - `current` `string` — Cursor to navigate to the current page of results through the API — example: `em9oby1jcm06OnBhZ2U6OjI=`
    - `next` `string` — Cursor to navigate to the next page of results through the API — example: `em9oby1jcm06OnBhZ2U6OjM=`
  - `total_count` `integer` — Number of records available in total for this resource — example: `1`
  - `warnings` `array of object` — Non-fatal warnings emitted when optional workflow steps failed. Present only when at least one step degraded; the response status remains 200.
    - `type` `string` — Discriminator for the warning kind. — example: `downstream_request_failed`
    - `status_code` `integer` — HTTP status code returned by the failed downstream request, when available. — example: `429`
    - `error` `string` — Short error description from the downstream provider, when available.
    - `operation` `string` — Identifier of the workflow step that failed. — example: `getManager`
    - `message` `string` — Detailed message from the downstream provider, when available.
- `links` `object` — Links to navigate to previous or next pages through the API
  - `previous` `string` — Link to navigate to the previous page through the API — example: `https://unify.apideck.com/crm/companies?cursor=em9oby1jcm06OnBhZ2U6OjE%3D`
  - `current` `string` — Link to navigate to the current page through the API — example: `https://unify.apideck.com/crm/companies`
  - `next` `string` — Link to navigate to the previous page through the API — example: `https://unify.apideck.com/crm/companies?cursor=em9oby1jcm06OnBhZ2U6OjM`
- `_raw` `object` — Raw response from the integration when raw=true query param is provided

#### 400 — Bad Request

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 401 — Unauthorized

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 402 — Payment Required

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 404 — The specified resource was not found

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 422 — Unprocessable

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### default — Unexpected error

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

---

# Upload attachment

> **Accounting API** · `POST /accounting/attachments/{reference_type}/{reference_id}`
> Canonical URL: https://developers.apideck.com/apis/accounting/reference#tag/Attachments/operation/attachmentsUpload
> MCP tool: `accounting-attachments-upload`

## Authentication

- Send `Authorization: Bearer $API_KEY` using your Apideck secret API key. Keep the key server-side; never put it in a URL or client-side code.

Use the application, consumer and connector headers listed in Parameters below for this operation.

## Learn more

- [Attachment explained](https://developers.apideck.com/glossary#attachment)
- [Coverage explained](https://developers.apideck.com/glossary#coverage)
- [How to upload an attachment](https://developers.apideck.com/guides/file-upload)

Upload attachment

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `reference_type` | path | `string` | Yes | The reference type of the document. |
| `reference_id` | path | `string` | Yes | The reference id of the object to retrieve. |
| `raw` | query | `boolean` | No | Include raw response. Mostly used for debugging purposes |
| `x-apideck-metadata` | header | `string` | Yes | Metadata to attach to the attachment file (JSON string) |
| `x-apideck-consumer-id` | header | `string` | Yes | ID of the consumer which you want to get or push data from |
| `x-apideck-app-id` | header | `string` | Yes | The ID of your Unify application |
| `x-apideck-service-id` | header | `string` | No | Provide the service id you want to call (e.g., pipedrive). Only needed when a consumer has activated multiple integrations for a Unified API. |
| `content-type` | header | `string` | Yes | The content-type of the file being uploaded |

### Responses

#### 201 — Attachments

- `status_code` `integer` **required** — HTTP Response Status Code — example: `201`
- `status` `string` **required** — HTTP Response Status — example: `Created`
- `service` `string` **required** — Apideck ID of service provider — example: `google-drive`
- `resource` `string` **required** — Unified API resource name — example: `files`
- `operation` `string` **required** — Operation performed — example: `add`
- `data` `object` **required** — A object containing a unique identifier for the resource that was created, updated, or deleted.
  - `id` `string` **required** — The unique identifier of the resource — example: `12345`
- `_raw` `object` — Raw response from the integration when raw=true query param is provided

#### 400 — Bad Request

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 401 — Unauthorized

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 402 — Payment Required

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 404 — The specified resource was not found

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 422 — Unprocessable

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### default — Unexpected error

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

---

# Get Attachment

> **Accounting API** · `GET /accounting/attachments/{reference_type}/{reference_id}/{id}`
> Canonical URL: https://developers.apideck.com/apis/accounting/reference#tag/Attachments/operation/attachmentsOne
> MCP tool: `accounting-attachments-one`

## Authentication

- Send `Authorization: Bearer $API_KEY` using your Apideck secret API key. Keep the key server-side; never put it in a URL or client-side code.

Use the application, consumer and connector headers listed in Parameters below for this operation.

## Learn more

- [Attachment explained](https://developers.apideck.com/glossary#attachment)
- [Coverage explained](https://developers.apideck.com/glossary#coverage)

Get Attachment

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `reference_type` | path | `string` | Yes | The reference type of the document. |
| `reference_id` | path | `string` | Yes | The reference id of the object to retrieve. |
| `id` | path | `string` | Yes | ID of the record you are acting upon. |
| `x-apideck-consumer-id` | header | `string` | Yes | ID of the consumer which you want to get or push data from |
| `x-apideck-app-id` | header | `string` | Yes | The ID of your Unify application |
| `x-apideck-service-id` | header | `string` | No | Provide the service id you want to call (e.g., pipedrive). Only needed when a consumer has activated multiple integrations for a Unified API. |
| `x-apideck-company-id` | header | `string` | No | The ID of the company to scope requests to. For connectors that support multi-company, this overrides the default company configured in connection settings. |
| `raw` | query | `boolean` | No | Include raw response. Mostly used for debugging purposes |
| `fields` | query | `string` | No | The 'fields' parameter allows API users to specify the fields they want to include in the API response. If this parameter is not present, the API will return all available fields. If this parameter is present, only the fields specified in the comma-separated string will be included in the response. Nested properties can also be requested by using a dot notation. <br /><br />Example: `fields=name,email,addresses.city`<br /><br />In the example above, the response will only include the fields "name", "email" and "addresses.city". If any other fields are available, they will be excluded. |

### Responses

#### 200 — Attachments

- `status_code` `integer` **required** — HTTP Response Status Code — example: `200`
- `status` `string` **required** — HTTP Response Status — example: `OK`
- `service` `string` **required** — Apideck ID of service provider — example: `xero`
- `resource` `string` **required** — Unified API resource name — example: `payments`
- `operation` `string` **required** — Operation performed — example: `one`
- `data` `object` **required**
  - `id` `string` — A unique identifier for an object. — example: `12345`
  - `display_id` `string` — The display id of the file — example: `sample ID`
  - `name` `string` — The name of the file — example: `sample.jpg`
  - `mime_type` `string` — The MIME type of the file. — example: `image/jpeg`
  - `size` `integer` — The size of the file in bytes — example: `1810673`
  - `reference` `object`
    - `type` `string` — enum: `invoice`, `bill`, `bill-credit-note`, `credit-note`, `expense`, `expense-report`, `quote`, `journal-entry`
    - `id` `string` — A unique identifier for an object. — example: `12345`
  - `description` `string` — Optional description of the file — example: `A sample image`
  - `file_url` `string` — The URL to download or preview the file — example: `https://example.com/files/sample.jpg`
  - `parent_folder_id` `string` — The folder id where this attachment belong to — example: `123`
  - `updated_by` `string` — The user who last updated the object. — example: `12345`
  - `created_by` `string` — The user who created the object. — example: `12345`
  - `updated_at` `string` — The date and time when the object was last updated. — format: `date-time` — example: `2020-09-30T07:43:32.000Z`
  - `created_at` `string` — The date and time when the object was created. — format: `date-time` — example: `2020-09-30T07:43:32.000Z`
  - `pass_through` `array of object` — The pass_through property allows passing service-specific, custom data or structured modifications in request body when creating or updating resources.
    - `service_id` `string` **required** — Identifier for the service to which this pass_through should be applied.
    - `operation_id` `string` — Optional identifier for a workflow operation to which this pass_through should be applied. This is useful for Unify calls that are making more than one downstream request.
    - `extend_object` `object` — Simple object allowing any properties for direct extension.
    - `extend_paths` `array of object` — Array of objects for structured data modifications via paths.
      - `path` `string` **required** — JSONPath string specifying where to apply the value. — example: `$.nested.property`
      - `value` `any` **required** — The value to set at the specified path, can be any type.
- `meta` `object` — Response metadata
  - `items_on_page` `integer` — Number of items returned in the data property of the response — example: `50`
  - `cursors` `object` — Cursors to navigate to previous or next pages through the API
    - `previous` `string` — Cursor to navigate to the previous page of results through the API — example: `em9oby1jcm06OnBhZ2U6OjE=`
    - `current` `string` — Cursor to navigate to the current page of results through the API — example: `em9oby1jcm06OnBhZ2U6OjI=`
    - `next` `string` — Cursor to navigate to the next page of results through the API — example: `em9oby1jcm06OnBhZ2U6OjM=`
  - `total_count` `integer` — Number of records available in total for this resource — example: `1`
  - `warnings` `array of object` — Non-fatal warnings emitted when optional workflow steps failed. Present only when at least one step degraded; the response status remains 200.
    - `type` `string` — Discriminator for the warning kind. — example: `downstream_request_failed`
    - `status_code` `integer` — HTTP status code returned by the failed downstream request, when available. — example: `429`
    - `error` `string` — Short error description from the downstream provider, when available.
    - `operation` `string` — Identifier of the workflow step that failed. — example: `getManager`
    - `message` `string` — Detailed message from the downstream provider, when available.
- `_raw` `object` — Raw response from the integration when raw=true query param is provided

#### 400 — Bad Request

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 401 — Unauthorized

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 402 — Payment Required

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 404 — The specified resource was not found

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 422 — Unprocessable

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### default — Unexpected error

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

---

# Delete Attachment

> **Accounting API** · `DELETE /accounting/attachments/{reference_type}/{reference_id}/{id}`
> Canonical URL: https://developers.apideck.com/apis/accounting/reference#tag/Attachments/operation/attachmentsDelete
> MCP tool: `accounting-attachments-delete`

## Authentication

- Send `Authorization: Bearer $API_KEY` using your Apideck secret API key. Keep the key server-side; never put it in a URL or client-side code.

Use the application, consumer and connector headers listed in Parameters below for this operation.

## Learn more

- [Attachment explained](https://developers.apideck.com/glossary#attachment)
- [Coverage explained](https://developers.apideck.com/glossary#coverage)

Delete Attachment

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `reference_type` | path | `string` | Yes | The reference type of the document. |
| `reference_id` | path | `string` | Yes | The reference id of the object to retrieve. |
| `id` | path | `string` | Yes | ID of the record you are acting upon. |
| `x-apideck-consumer-id` | header | `string` | Yes | ID of the consumer which you want to get or push data from |
| `x-apideck-app-id` | header | `string` | Yes | The ID of your Unify application |
| `x-apideck-service-id` | header | `string` | No | Provide the service id you want to call (e.g., pipedrive). Only needed when a consumer has activated multiple integrations for a Unified API. |
| `raw` | query | `boolean` | No | Include raw response. Mostly used for debugging purposes |

### Responses

#### 200 — Attachments

- `status_code` `integer` **required** — HTTP Response Status Code — example: `200`
- `status` `string` **required** — HTTP Response Status — example: `OK`
- `service` `string` **required** — Apideck ID of service provider — example: `google-drive`
- `resource` `string` **required** — Unified API resource name — example: `files`
- `operation` `string` **required** — Operation performed — example: `delete`
- `data` `object` **required** — A object containing a unique identifier for the resource that was created, updated, or deleted.
  - `id` `string` **required** — The unique identifier of the resource — example: `12345`
- `_raw` `object` — Raw response from the integration when raw=true query param is provided

#### 400 — Bad Request

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 401 — Unauthorized

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 402 — Payment Required

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 404 — The specified resource was not found

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 422 — Unprocessable

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### default — Unexpected error

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

---

# Download Attachment

> **Accounting API** · `GET /accounting/attachments/{reference_type}/{reference_id}/{id}/download`
> Canonical URL: https://developers.apideck.com/apis/accounting/reference#tag/Attachments/operation/attachmentsDownload
> MCP tool: `accounting-attachments-download`

## Authentication

- Send `Authorization: Bearer $API_KEY` using your Apideck secret API key. Keep the key server-side; never put it in a URL or client-side code.

Use the application, consumer and connector headers listed in Parameters below for this operation.

## Learn more

- [Attachment explained](https://developers.apideck.com/glossary#attachment)
- [Coverage explained](https://developers.apideck.com/glossary#coverage)

Download Attachment

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `reference_type` | path | `string` | Yes | The reference type of the document. |
| `reference_id` | path | `string` | Yes | The reference id of the object to retrieve. |
| `id` | path | `string` | Yes | ID of the record you are acting upon. |
| `x-apideck-consumer-id` | header | `string` | Yes | ID of the consumer which you want to get or push data from |
| `x-apideck-app-id` | header | `string` | Yes | The ID of your Unify application |
| `x-apideck-service-id` | header | `string` | No | Provide the service id you want to call (e.g., pipedrive). Only needed when a consumer has activated multiple integrations for a Unified API. |
| `x-apideck-company-id` | header | `string` | No | The ID of the company to scope requests to. For connectors that support multi-company, this overrides the default company configured in connection settings. |
| `fields` | query | `string` | No | The 'fields' parameter allows API users to specify the fields they want to include in the API response. If this parameter is not present, the API will return all available fields. If this parameter is present, only the fields specified in the comma-separated string will be included in the response. Nested properties can also be requested by using a dot notation. <br /><br />Example: `fields=name,email,addresses.city`<br /><br />In the example above, the response will only include the fields "name", "email" and "addresses.city". If any other fields are available, they will be excluded. |
| `x-apideck-follow-redirects` | header | `boolean` | No | Set to `false` to opt out of the redirect to the presigned download URL. Instead of a `30x` response, you receive a `200` JSON body `{ url, expires_at }` containing the URL and its expiry, which you can fetch explicitly. Use this if your client automatically forwards the `Authorization` header onto redirects, since the downstream storage provider will reject that request. Any value other than `false` (or omitting the header) preserves the default redirect behavior. |

### Responses

#### 200 — Attachment Download. When the request includes `x-apideck-follow-redirects: false` and the download would otherwise redirect to a presigned URL, the response body is instead an `application/json` object `{ url, expires_at }` — fetch `url` explicitly (without the Authorization header) to retrieve the attachment.

#### 400 — Bad Request

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 401 — Unauthorized

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 402 — Payment Required

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 404 — The specified resource was not found

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### 422 — Unprocessable

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

#### default — Unexpected error

> Standard error response — see [Error Responses](https://developers.apideck.com/errors)

---