# Add an attachment to a template

```http
POST https://secure.yoprint.com/v2/api/store/{team_slug}/setting/message_template/{hash_id}/internal_attachment
```

- API version: v2
- Operation ID: `v2_public_message_template_internal_attachment_store`
- Section: Team settings › [Message template attachments](https://developer.yoprint.com/reference/message-template-attachments.md)
- Web page: https://developer.yoprint.com/reference/message-template-attachments/v2-message-template-internal-attachment-store/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Adds an attachment to a message template. Document attachments, such as `order`, are made fresh from the record each time the template is sent; without a `name` they get a default such as `Details {{order_number}}.pdf`. A `media` attachment is a file you uploaded, by its `media_id`.

Attachment `type` values: `order` (the sales order or quote PDF), `order_compact` (its compact PDF), `so_jobs_with_mockup` and `so_jobs_without_mockup` (job sheets), `so_invoices` and `so_compact_invoices` (its invoices), `purchase_order` (the purchase order PDF), and `media` or `reference_media` (a file, by `media_id`). A template accepts only the values in its `supported_attachments`: purchase order templates take `purchase_order`, `media` and `reference_media`.

## Permission

Needs the Manage Settings permission. The team owner always has it.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The message template. Its hash id from an earlier answer; there is no unique key for it. Example `DVubREua5aJkwh`.

## Request body

Content type `application/json`, required.

Fields:

- `type` (string, required): What to attach. Must be in the template's `supported_attachments`. One of: `"order"`, `"order_compact"`, `"so_jobs_with_mockup"`, `"so_jobs_without_mockup"`, `"so_invoices"`, `"so_compact_invoices"`, `"purchase_order"`, `"media"`, `"reference_media"`.
- `detail` (string, optional)
- `media_id` (string, optional): Required for `media`: the id of a file you uploaded. `reference_media` also needs an existing file.
- `name` (string, optional): A name for the attachment.
- `options` (object, optional)
  - `show_mockup` (boolean, optional): For `so_jobs_with_mockup` and `so_jobs_without_mockup`: `true` puts each job's mockup pages in the job sheets, `false` leaves them out. It overrides the type's own choice. Text such as `"true"` or `"off"` is accepted too; any other value is refused with 422 `validation_failed`. Other types ignore it.

### Example request

```bash
curl -X POST 'https://secure.yoprint.com/v2/api/store/your-team/setting/message_template/DVubREua5aJkwh/internal_attachment' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Sales order PDF",
    "type": "order"
  }'
```

Another example: An uploaded file:

```bash
curl -X POST 'https://secure.yoprint.com/v2/api/store/your-team/setting/message_template/DVubREua5aJkwh/internal_attachment' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "media_id": "ckQVnRGLx1GTIn",
    "name": "Care instructions",
    "type": "media"
  }'
```

## Response

`200` Successful response.

Fields:

- `data` (object, required)
  - `created_at` (string (date-time), required)
  - `detail` (string | null, required): For a document attachment, defaults to its kind, such as `Sales Order/Quote (PDF)`.
  - `id` (string, required)
  - `media` (object | null, required): For a `media` or `reference_media` attachment, the file: `id`, `name`, `file_name`, `mime_type`, `size`, a download `url`, a signed `view_url` and more. Null for document attachments.
  - `media_id` (string | null, required)
  - `name` (string | null, required)
  - `options` (string | null, required): The attachment's options as a JSON-encoded string, not an object: `"[]"`, or for job sheets `"{\"show_mockup\":true}"`. `"null"` for a `media` or `reference_media` file. Decode it before use.
  - `order_id` (string | null, required)
  - `order_scoped_id` (string | integer | null, required)
  - `purchase_order_id` (string | null, required)
  - `purchase_order_scoped_id` (string | integer | null, required)
  - `type` (string, required)
  - `updated_at` (string (date-time), required)
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": {
    "created_at": "2026-10-01T09:00:00+00:00",
    "detail": "Sales Order/Quote (PDF)",
    "id": "80qLp4P9l2ftvL",
    "media": null,
    "media_id": null,
    "name": "Sales order PDF",
    "options": "[]",
    "order_id": null,
    "order_scoped_id": "",
    "purchase_order_id": null,
    "purchase_order_scoped_id": "",
    "type": "order",
    "updated_at": "2026-10-01T09:00:00+00:00"
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
  - When: Your role lacks Manage Settings. The body is `{"message": "Insufficient Permission"}`, without the error envelope. Fix: Use the key of a member whose role has Manage Settings, or the owner's.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
  - When: No template of your team has this id. `error.code` is null; `error.message` names the record type. Fix: Use a template id from the list.
- `422` The request was refused and changed nothing. `validation_failed` lists what to fix in `error.fields`; other codes name a business rule, explained in `error.message`. A few checks answer with only `{"message": "..."}`. An operation that calls another service (a payment provider, a carrier, an accounting app) can answer `connect_timeout` ("Please retry again") when that service does not answer in time: the change may or may not have happened there, so read the record back before you retry.
  - When: `type` is missing, or `media_id` is missing for `media` (`validation_failed`); the template doesn't support this `type` (`type_not_supported`); or the file is not found (`media_not_found`). Fix: Use a type from the template's `supported_attachments` and an uploaded file's id.

## Related

- [List a template's attachments](https://developer.yoprint.com/reference/message-template-attachments/v2-message-template-internal-attachment-index.md): `GET /v2/api/store/{team_slug}/setting/message_template/{hash_id}/internal_attachment`