Upload Assistant Attachment
Attach a file for Oro (RO-323). Its type is detected from its content (PDF, Word .docx, Excel .xlsx, CSV, plain text or Markdown, PNG, JPEG, WebP; old .xls/.doc and other types: 415). PDF, Word and Excel are read by the AI service (nothing in the file runs: no macros, formulas or links); CSV and text here. An unreadable, encrypted or damaged file is stored as `failed` with a reason. Stored in Postgres, personal to the uploader, within `ASSISTANT_ATTACHMENT_MAX_BYTES` per file (413) and `ASSISTANT_ATTACHMENTS_WORKSPACE_MAX_BYTES` per workspace (409), deleted after `ASSISTANT_ATTACHMENT_RETENTION_DAYS`. Signed-in users only (API keys: 403).
API key access
/api/v1/assistant/attachmentsAccess token from /api/v1/auth/login, or an API key (ro_pat_..., RO-176) from /api/v1/workspaces/current/api-keys: the key implies its workspace and needs the route's scope. MCP connectors (/api/v1/mcp only) may use an OAuth access token (ro_oat_..., RO-284).
In: header
Header Parameters
Id of the workspace to act on (must be a member).
PDF, Word (.docx), Excel (.xlsx), CSV, text, Markdown, PNG, JPEG or WebP; at most
ASSISTANT_ATTACHMENT_MAX_BYTES (10 MB by default)
Response Body
curl -X POST "http://localhost:8000/api/v1/assistant/attachments" \ -H "X-Workspace-Id: string" \ -F file="string"{
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"filename": "string",
"kind": "pdf",
"media_type": "string",
"byte_size": 0,
"status": "ready",
"error": "string",
"text_chars": 0,
"meta": {
"property1": null,
"property2": null
},
"created_at": "2019-08-24T14:15:22Z"
}{
"detail": [
{
"loc": [
"string"
],
"msg": "string",
"type": "string",
"input": null,
"ctx": {}
}
]
}Update Assistant Thread
Rename, pin, archive or pick the model of a conversation (RO-319, RO-320). The model must be one the workspace offers (`GET /assistant/models`); null is Auto.
Change Password
Change the password (argon2id). Every access token issued before stops at once (the current session gets a new one from `/auth/refresh`). By default every other session and connected app (OAuth) is signed out; the current one (its refresh cookie) stays. A wrong current password is a 400 and counts against the login rate limit (429 with `Retry-After` past it).