# Attach uploaded files to a customer

```http
POST https://secure.yoprint.com/v1/api/store/{team_slug}/customer/{hash_id}/media/attach
```

- API version: v1
- Operation ID: `v1_public_customer_upload_multiple_files`
- Section: Customers › [Customer files](https://developer.yoprint.com/reference/customer-files.md)
- Web page: https://developer.yoprint.com/reference/customer-files/v1-customer-upload-multiple-files/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Attaches files you already uploaded to the customer, and returns them.

Upload each file first with Upload a file; then send its id here with the collection it belongs in. A file can be attached once: after that it belongs to the customer.

## Permission

Needs the Manage Customers permission (either level). Whether the customer is assigned to you is not checked.

## Business rules

- Each id must be a file uploaded with Upload a file and not attached to anything yet; an attached file fails the whole request.
- Customers synced from Shopify are read-only here: changes are refused with 422 `validation_error` "External customers are read-only. Manage changes from Shopify." System customers (`is_system: true`) are refused the same way ("System customer cannot be modified or deleted.").

## Side effects

- Moves each upload onto the customer and builds its previews.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The customer's id (`id` from List customers or Create a customer). A hash id from an earlier answer; unique keys and document numbers (such as `PO0042`) don't work here. Example `EDhVUaC6jbLbed`.

## Request body

Content type `application/json`, required.

Fields:

- `attachment` (array of objects, required): At least 1 item.
  - Each item:
    - `id` (string, required): The uploaded file's id.
    - `collection` (string | null, optional): Where the file goes. Defaults to `external_file`, which the customer can see. One of: `"tax_exemption"`, `"internal_file"`, `"external_file"`.
    - `file_name` (string | null, optional): A display name. Defaults to the uploaded file name. At most 255 characters.

### Example request

```bash
curl -X POST 'https://secure.yoprint.com/v1/api/store/your-team/customer/EDhVUaC6jbLbed/media/attach' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "attachment": [
      {
        "collection": "tax_exemption",
        "file_name": "Resale certificate 2026.pdf",
        "id": "4GR9C3ZTMYtda5"
      }
    ]
  }'
```

## Response

`200` Successful response.

Fields:

- `data` (array of objects, required)
  - Each item:
    - `collection` (string, required): Customer files: `tax_exemption`, `internal_file` or `external_file`. Vendor files: `default`, `mockup` or `production_file`.
    - `created_at` (string (date-time), required)
    - `file_name` (string, required)
    - `id` (string, required)
    - `mime_type` (string | null, required)
    - `name` (string | null, required): The display name.
    - `size` (integer, required): Bytes.
    - `custom_properties` (object | array, optional)
    - `customer_id` (string, optional): Customer files only.
    - `dimensions` (object | null, optional): Pixel size of an image, read from its header; null for other files and for images uploaded before the size was recorded.
      - `height` (integer, optional)
      - `width` (integer, optional)
    - `is_image` (boolean, optional)
    - `position` (integer | null, optional): Where the file sorts.
    - `preview` (object | null, optional): Preview image links `small`, `medium` and `large` (250, 800 and 1200 px), or null when there is no preview.
    - `preview_state` (string, optional): `ready`: the preview links work. `processing`: an image over 10 MB whose stored preview a worker is still making (seconds); read the file again, or in the web app wait for `media.preview_state_changed` on the team channel. `too_large`: an image over 120 megapixels; it never gets a preview. `failed`: the worker gave up. `none`: not an image. One of: `"ready"`, `"processing"`, `"too_large"`, `"failed"`, `"none"`.
    - `show_in_pdf` (boolean | null, optional)
    - `source_media_id` (string | null, optional)
    - `url` (string | null, optional): Where to download the file.
    - `view_url` (string | null, optional): A signed link to view the file. It expires: read it fresh, and don't store it.
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": [
    {
      "collection": "tax_exemption",
      "created_at": "2026-11-01T09:00:00+00:00",
      "custom_properties": [],
      "customer_id": "V4keXwwxMQyXw7",
      "file_name": "resale-certificate.pdf",
      "id": "4GR9C3ZTMYtda5",
      "is_image": false,
      "mime_type": "application/pdf",
      "name": "Resale certificate 2026.pdf",
      "position": 0,
      "preview": null,
      "show_in_pdf": null,
      "size": 48211,
      "source_media_id": null,
      "url": "https://example.com/media/4GR9C3ZTMYtda5/download",
      "view_url": "https://example.com/media/4GR9C3ZTMYtda5/view"
    }
  ],
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
  - When: Your role has no Manage Customers permission. This 403 has a short body, `{"message": "Insufficient Permission"}`, with no `success` or `error`. Fix: Ask a team owner to give your role Manage Customers.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
  - When: An upload id does not exist, or no live customer has this id. `error.code` is null and `error.message` names the record type. Fix: Upload the file first, or check the customer id.
- `422` The request was refused and changed nothing. `validation_failed` lists what to fix in `error.fields`; other codes name a business rule, explained in `error.message`. A few checks answer with only `{"message": "..."}`. An operation that calls another service (a payment provider, a carrier, an accounting app) can answer `connect_timeout` ("Please retry again") when that service does not answer in time: the change may or may not have happened there, so read the record back before you retry.
  - When: `attachment` is empty, an `id` is missing or not a valid id, a `collection` is not allowed, or a `file_name` is over 255 characters. `error.code` is `validation_failed`. Fix: Send at least one file and a valid collection.
  - When: The customer comes from Shopify, or is a system customer (`error.code` `validation_error`, with the reason in `error.message`). Fix: Change Shopify customers in Shopify. System customers cannot be changed.
- `500` A business rule refused the request (see the operation's errors), or something failed inside YoPrint. Refusals use the error envelope with a code such as `action_not_allowed`; an unexpected failure answers `{"message": "Server Error"}`. Repeating a refusal gets the same answer; after an unexpected failure, read the record back before you retry a change.
  - When: An upload is already attached to something else. Nothing is attached. Fix: Upload the file again and send the new id.

## Related

- [Upload a file](https://developer.yoprint.com/reference/uploads/v1-async-upload-store.md): `POST /v1/api/store/{team_slug}/async_upload`
- [List a customer's files](https://developer.yoprint.com/reference/customer-files/v1-customer-media-index.md): `GET /v1/api/store/{team_slug}/customer/{hash_id}/media`