# POST /api/v2/drive-items/{drive_item}/files

Attach an uploaded file to a drive item

- MCP id: drive-items.files.store
- Scope: api:write:project_drive
- Scope: api:write:customer_drive
- Scope: api:write:organization_drive
- Scope: api:write:user_drive
- Permission: project_drive::create
- Rate cost: 1 unit, write bucket. A write costs the same whatever `view` you ask for.
- Cache-Control: private, no-store

Step 3 of 3.

Turns bytes you have already uploaded into a file on the drive item named in the path, and returns it in the detail view. `upload_id` is the only key this accepts: create a ticket with `POST drive-items/{drive_item}/uploads`, PUT the raw bytes to its `upload_url`, then send its id here. Everything about the file (its name, size, media type, collection and storage location) is read off the ticket and off the bytes that actually arrived, so `file_name`, `mime_type`, `byte_size`, collection and disk are all a `422`. The file lands in the document's `attachments` collection; `content` belongs to the editor and `file` is the document's own payload, so neither can be written here. The ticket must have been created for this drive item, by this API token, and must not have expired or been registered already. The declared permission is `project_drive::create`; `customer_drive`, `organization_drive` and `user_drive` apply by owner type, and the record rule requires edit access: read access to a document is not enough to attach to it, which is deliberately stricter than plnnrly. Attaching additionally requires `project_management::manage_work_items` for the file itself. An archived document is `404`. `Idempotency-Key` is required: a lost 201 retried without one would report a failure for a create that succeeded. There is no `Location` header (a file has no item URL of its own), and no PATCH or DELETE on a file; remove one in plnnrly.

## Parameters
- drive_item (integer, path): The DriveItem's numeric id. Accepts a soft-deleted record.
- view (string, optional): Which field set to render.
- X-Request-Id (header, optional): A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.
- Idempotency-Key (header, required): A caller-chosen key that makes this POST safe to retry. Required on this operation: omitting it is 400 idempotency-key-required.

## Request body
- upload_id (integer → Upload.id, required): The id of the upload ticket whose bytes become this file. Create one with `POST work-items/{work_item}/uploads` or `POST drive-items/{drive_item}/uploads`, PUT the bytes to its `upload_url`, then send its id here. Write-only: it is never rendered on a media row, and it is the only key either attachment store accepts.

Unknown keys are refused with `422` validation-failed, naming the key.

## Response 201
- id (integer, required): Unique identifier.
- name (string ≤ 255, required): File name as uploaded.
- mime_type (string or null ≤ 255, required): IANA media type.
- size (integer, required): Size in bytes.
- disk (string ≤ 255, required): Name of the storage location the file is kept in.
- collection (string ≤ 255, required): Media collection the file belongs to.
- created_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Upload timestamp.
- updated_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Last-write timestamp; use for incremental sync.
- url (string or null, optional, on request): Signed download URL, requiring your bearer token. Request with `?include=url`. Null only where your organisation's file storage cannot sign URLs, in which case the response carries a `signed_url_unavailable` warning and downloads are not available through the API.
- url_expires_at (timestamp (YYYY-MM-DDThh:mm:ssZ) or null, optional, on request): When `url` stops working. Always `null` in v2.0: the signed route the URL points at does not expire. Declared so a future bounded-TTL download path is an additive change.

## Errors
- 403 forbidden-by-policy | insufficient-permission | insufficient-token-scope: Forbidden.
- 409 idempotency-key-in-flight | idempotency-key-reused | state-conflict: Conflict.
- 415 unsupported-media-type: Unsupported media type.
- 422 unprocessable-relationship | validation-failed: Unprocessable content.
- 400 idempotency-key-required | invalid-cursor | invalid-query-parameter | malformed-request | unsupported-parameter: Bad request.
- 401 token-expired | unauthenticated: Unauthenticated.
- 404 endpoint-not-found | resource-not-found: Not found.
- 406 not-acceptable: Not acceptable.
- 429 rate-limit-exceeded: Too many requests.
- 500 internal-error: Server error.
- 503 tenant-unavailable: Service unavailable.

## Example
```bash
curl -X POST \
  'https://<your-url>/api/v2/drive-items/1/files' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: <key>' \
  -d '{
    "upload_id": 1
  }'
```