Attachments API

Use the attachments API for supporting files such as scan results and engagement documents. For screenshots embedded in report content, use the images API.

Upload a report attachment

Send a multipart request with a file and the destination reportId. The key needs rw:reports and access to that report.

curl --fail-with-body "$VULNOTES_URL/api/attachments/upload" \
  -H "X-API-Key: $VULNOTES_API_KEY" \
  -F "file=@assessment-notes.txt" \
  -F "reportId=$REPORT_ID"

The response includes attachment.id, the original filename, size, and MIME type. Keep the returned ID for later downloads.

The backend limit is 50 MB per file. A reverse proxy may impose a lower limit. Files are checked against allowed formats; changing the extension does not make an unsupported file acceptable.

List and download

A report read scope is enough to list and download attachments from an accessible report.

curl --fail-with-body "$VULNOTES_URL/api/attachments/report/$REPORT_ID" \
  -H "X-API-Key: $VULNOTES_API_KEY"

curl --fail-with-body "$VULNOTES_URL/api/attachments/$ATTACHMENT_ID/download" \
  -H "X-API-Key: $VULNOTES_API_KEY" \
  --output assessment-notes.txt

Use the authenticated download endpoint instead of treating a stored upload path as a public link. Deletion uses DELETE /api/attachments/{id} and requires write access to the associated resource.

Other file types

• Upload an image through POST /api/images/upload, using the multipart field image and a report or template association.
• Template files require the matching template scopes, such as rw:templates to upload a template image.
• Planning event files use the planning endpoints and planning permissions.

The Python SDK handles multipart encoding and binary downloads for you.