---
title: "Attachments"
description: "Upload, list, download and delete the files attached to invoices, bills, expenses and journals, with the size and type limits that apply."
url: "https://bareledger.app/guides/api-attachments"
category: "Developers & API"
updated: "2026-10-04"
publisher: "BareLedger (Syneria Technologies OPC)"
---

# Attachments

> Upload, list, download and delete the files attached to invoices, bills, expenses and journals, with the size and type limits that apply.

Attachments are uploaded through module-specific routes (see the API pages for [Sales](https://bareledger.app/guides/sales), [Purchases](https://bareledger.app/guides/purchases), [Expenses](https://bareledger.app/guides/expenses), [Compliance](https://bareledger.app/guides/compliance)) but downloaded/deleted through a single generic pair:

| Method & Path | Permission | Purpose |
|---|---|---|
| `GET attachments/{attachment}/download` | Derived from the parent record's module (`sales`/`purchase`/`expense`/`compliance`/`payment`) `.view` | Stream the file |
| `DELETE attachments/{attachment}` | Derived module `.manage` (or `compliance.generate`) | Delete attachment; audit |

Module-specific upload/list endpoints (all `POST`/`GET` on `{module}/{record}/attachments`): invoices, bills, expenses, WHT credits, payments. Max size 10MB, allowed MIME types: `pdf,png,jpg,jpeg,gif,webp,csv,xlsx,xls,doc,docx,txt,xml`. Files are stored on the default disk (`FILESYSTEM_DISK` — Cloudflare R2 in production) under a per-tenant/per-model path with a randomized filename component — never given a public URL. See [Attachments & File Storage](https://bareledger.app/guides/api-attachments) and [Security](https://bareledger.app/guides/security).