Upload API

File uploads for records. All endpoints require authentication.

Method	Endpoint	Description
POST	/upload/avatar/:entityType/:entityId	Upload a picture (contacts, accounts, users)
POST	/upload/document/:entityType/:entityId	Attach a document to a record
DELETE	/upload/document/:entityType/:entityId/:documentId	Remove a document from a record
POST	/upload/logo	Company logo (admin only, stored publicly)

Document entityType values: leads, opportunities, accounts, contacts, projects, tasks, work_requests, products.

Attach a Document

POST /upload/document/:entityType/:entityId as multipart/form-data with a file part and an optional visibility (all default, owner_team, restricted). Needs edit access to the record. Maximum 25 MB. The type is checked by extension, declared MIME type and file content; PDFs are stored to display inline and every other type as a download.

Delete a Document

DELETE /upload/document/:entityType/:entityId/:documentId → { "success": true }

• Allowed for admins, the uploader, and anyone with edit access to the record.
• A document that does not belong to that record, is already deleted, or is hidden from the caller by its visibility tag returns 404.
• It is a soft delete (deleted_at): the stored file is kept, and the removal is written to the audit log (documents / delete).
• Work requests keep their own endpoint, DELETE /work-requests/:id/documents/:documentId, which also allows the assignee, the requester and the team lead.