QuickBooks: Upload attachments

← attachable operations · Get started · OpenAPI downloads

Contract 2026-10-20 · Operation quickbooks.attachable.upload_attachments

Provider route: POST /v3/company/{realmID}/upload. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/quickbooks with npm, or alter-sdk-quickbooks with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { QuickBooksIntegration } from "@alter-ai/quickbooks";

async function execute(input: Parameters<QuickBooksIntegration["attachable"]["upload"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new QuickBooksIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.attachable.upload(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_quickbooks import QuickBooksIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = QuickBooksIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.attachable.upload(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
query	object	Optional	Additional keys: not allowed
query.minorversion	integer	Optional	Must equal: 75
query.requestid	string	Optional	Minimum length: 1
body	object	Required within parent	Additional keys: not allowed
body.files	array	Required within parent	Minimum items: 1
body.files[]	object	Each item	Additional keys: not allowed
body.files[].filename	string	Required within parent	Minimum length: 1
body.files[].content_type	string	Required within parent	Minimum length: 1
body.files[].content_base64	string	Required within parent	Encoding: base64
body.files[].metadata	object	Optional	Additional keys: not allowed
body.files[].metadata.AttachableRef	array	Optional	Specifies the transaction object to which this attachable file is to be linked.
body.files[].metadata.AttachableRef[]	Model	Each item	Expand Delete an attachable — request body — body Attachable Ref item
body.files[].metadata.Category	string	Optional	Category of the attachment. Valid values include (case sensitive): Contact Photo , Document , Image , Receipt , Signature , Sound , Other .
body.files[].metadata.ContentType	string	Optional	ContentType of the attachment. Returned for file attachments.
body.files[].metadata.FileAccessUri	string	Optional	FullPath FileAccess URI of the attachment. Returned for file attachments. Read only: true
body.files[].metadata.FileName	string	Optional	FileName of the attachment. Required for file attachments. Conditionally required
body.files[].metadata.Id	string	Optional	Unique Identifier for an Intuit entity (object). Required for the update operation. Read only: true
body.files[].metadata.Lat	string	Optional	Latitude from where the attachment was requested.
body.files[].metadata.Long	string	Optional	Longitude from where the attachment was requested.
body.files[].metadata.MetaData	Model	Optional	Expand Read a bill — response body — Bill Meta Data Descriptive information about the entity. The MetaData values are set by Data Services and are read only for all applications.
body.files[].metadata.Note	string	Optional	The note is either related to the attachment specified with the FileName attribute, or as a standalone note. Required for note attachments. Conditionally required
body.files[].metadata.PlaceName	string	Optional	PlaceName from where the attachment was requested.
body.files[].metadata.Size	JSON	Optional	Size of the attachment. Returned for file attachments. Decimal string Read only: true
body.files[].metadata.Size (anyOf 1)	number	Alternative
body.files[].metadata.Size (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:.[0-9]+)?$
body.files[].metadata.SyncToken	string	Optional	Version number of the object. It is used to lock an object for use by one app at a time. As soon as an application modifies an object, its SyncToken is incremented. Attempts to modify an object specifying an older SyncToken fails. Only the latest version of the object is maintained by QuickBooks Online. Read only: true
body.files[].metadata.Tag	string	Optional	Tag name for the requested attachment.
body.files[].metadata.TempDownloadUri	string	Optional	TempDownload URI which can be directly downloaded by clients. Returned for file attachments. Read only: true
body.files[].metadata.ThumbnailFileAccessUri	string	Optional	FullPath FileAccess URI of the attachment thumbnail if the attachment file is of a content type with thumbnail support. Returned for file attachments. Read only: true
body.files[].metadata.ThumbnailTempDownloadUri	string	Optional	Thumbnail TempDownload URI which can be directly downloaded by clients. This is only available if the attachment file is of a content type with thumbnail support. Returned for file attachments. Read only: true
body.files[].metadata.domain	string	Optional
body.files[].metadata.sparse	boolean	Optional

Referenced models: Read a bill — response body — Bill Meta Data, Delete an attachable — request body — body Attachable Ref item

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: allowed
time	string	Optional
AttachableResponse	array	Optional
AttachableResponse[]	object	Each item	Additional keys: allowed
AttachableResponse[].Attachable	Model	Optional	Expand Read an attachable — response body — Attachable
AttachableResponse[].Fault	object	Optional	Additional keys: allowed

Referenced models: Read an attachable — response body — Attachable

Policy, approvals and errors

SDK function policy ID: quickbooks.attachable.upload_attachments. Catalog operation: attachable/upload_attachments. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Official provider source