DELETE/api/v1/attachments/{id}
DELETE /api/attachments/{id} — author-gated (the uploader, or an org
owner/admin). The stored object is reclaimed only when no sibling row
still references the same content-addressed key.
Parameters
| Name | In | Type | Required | Description |
|---|
id | path | string | Yes | |
Responses
Security: bearer
GET/api/v1/attachments/{id}/download
GET /api/attachments/{id}/download — streams the stored bytes through the
API behind board-view authz, or answers with a presigned URL when the
caller asks for one (`?presign=true`) and the store can sign it.
The ticket is the optimisation and the stream is the contract: without the
flag the request gets the same bytes, headers and status it always did,
and on a deployment that cannot presign the ticket request answers
`mode: "stream"` rather than failing. [`AttachmentDownloadTicket`] carries
the filename the stream would have carried in `content-disposition`,
because a presigned GET names the object key — a digest — instead.
Parameters
| Name | In | Type | Required | Description |
|---|
id | path | string | Yes | |
presign | query | boolean | No | `true` asks for a download ticket instead of the bytes; the answer says whether a URL was minted |
Responses
| Status | Description |
|---|
200 | |
409 | the object is held by the scan gate: neither a URL nor the bytes are issued |
Security: bearer
POST/api/v1/attachments/{id}/transcribe
POST /api/v1/attachments/{id}/transcribe — transcribe one stored
audio attachment through the org's granted `transcription` surface.
Parameters
| Name | In | Type | Required | Description |
|---|
id | path | string | Yes | |
Responses
| Status | Description |
|---|
200 | |
403 | typed AI refusals (surface/grant/credential/cap) |
404 | |
422 | not_audio or size cap |
Security: bearer
GET/api/v1/tickets/{id}/attachments
GET /api/tickets/{id}/attachments — every attachment on one ticket that
the download door would also hand out.
Parameters
| Name | In | Type | Required | Description |
|---|
id | path | string | Yes | |
Responses
Security: bearer
POST/api/v1/tickets/{id}/attachments
POST /api/tickets/{id}/attachments — stores one file against a ticket
(linked to a comment later by the composer submit).
Headers: `x-filename` (required), `content-type` (declared; verified
against sniffed magic bytes). Body: raw bytes, capped by
`MARULA_MAX_UPLOAD_MB` (default 25 MB).
Parameters
| Name | In | Type | Required | Description |
|---|
id | path | string | Yes | |
Request body
array<integer>
Responses
Security: bearer