# Upload a task attachment

`POST /v1/uploads`

Uploads bytes for a later task or message. The returned upload id is opaque, expires after 24 hours, and creates no durable file until referenced.

Required OAuth scopes: `files:write`

## Request body

- `file` (string (binary), required)

## Responses

- `201`
  - `upload` (object, required)
    - `id` (string, required)
    - `name` (string, required)
    - `mediaType` (string, required)
    - `size` (number, required)
    - `expiresAt` (string, required)
- `400`: Invalid request
- `401`: Missing or invalid Bearer credential
- `402`: Payment or subscription required
- `403`: Credential is missing a required scope
- `404`: Resource not found
- `409`: Request conflict
- `429`: Rate limit exceeded
- `500`: Internal API error