Upload visitor file attachments

POST 
/api/widget/attachments

PUBLIC endpoint (anonymous visitors, NO staff auth). Uploads one or more files as PENDING attachments against the visitor's OWN conversation (taken EXCLUSIVELY from the verified session token, never the client). Send the returned attachment ids as attachment_ids in a subsequent sendWidgetMessage call to bind them to a message in the SAME conversation.

Each file is validated by its DETECTED mime type (a renamed binary cannot pose as an allowed type). The mime allowlist is the platform attachment policy; the per-file size and file-count caps are TIGHTER than the staff inbox for this untrusted public surface (default 10 MB / 5 files). Use either the file field for a single upload or files[] for several. Only a short-lived signed url is returned — the storage disk/path are NEVER exposed.

Request

Responses

201

The stored (pending) visitor attachments.

403

Missing / invalid / cross-tenant session token.

404

Unknown or missing widget_key, or the conversation is gone.

422

The request failed validation.

429

Rate limit exceeded.

Response Headers

X-RateLimit-Limit

Request quota for the current window.

X-RateLimit-Remaining

Remaining requests in the current window.

Retry-After

Seconds to wait before retrying.