Update the display filename or numeric order of an existing attachment.
The method does not replace the uploaded file. It updates only attachment metadata and publishes the updated attachment data to the account WebSocket channel.
The number in the URL path (/1/) is the organization identifier — referred to as account_id.
This value must match the account associated with the provided session_id, token, or project_token.
This endpoint supports both:
POST is recommended because the method changes an existing object.
POST https://api.doboard.com/42/attachment_update
Content-Type: application/x-www-form-urlencoded
attachment_id=301&filename=updated-screenshot.png&attachment_order=2&session_id=abc123xyz
In this example:
42 is the organization/account ID.attachment_id=301 identifies the attachment to update.filename sets a new display filename.attachment_order=2 changes the attachment’s order.session_id=abc123xyz is used for authentication.
attachment_idis required.
At least one offilenameorattachment_ordermust be supplied.
Required
Provide one of:
session_id – for an authenticated usertoken – for public task guest accessproject_token – for public project guest accessAuthorization also depends on attachment ownership and the editing state of the related comment.
The user who uploaded the attachment can update it without an additional comment-editing check.
This includes guest users who own the attachment.
An active editing session belonging to another user does not block the attachment owner in this method.
A user who did not upload the attachment can update it only when all of the following conditions are met:
editing_user_id matches the current user.A guest can update an attachment owned by that guest.
A guest cannot update an attachment uploaded by another user.
A non-owner cannot update an attachment from a track-only comment because the non-owner editing exception requires a related task.
The attachment owner can update a track-comment attachment.
No separate administrator bypass is applied.
An administrator who does not own the attachment must satisfy the same comment and editing-state requirements as another authenticated non-owner.
No additional project-membership check is performed after authentication.
Update permission is based on attachment ownership or the related comment’s editing state.
If the account ID in the URL does not match the account tied to the session or token, the request will be rejected.
For a non-owner update, the method selects one active comment associated with the attachment’s task.
Access is allowed only if:
editing_user_id matches the current user.The current source does not define an explicit sorting order when selecting this active comment. Therefore, when a task contains multiple active comments, the selected comment is not guaranteed to be the oldest or newest one.
The method checks editing_user_id but does not validate editing_time. No 15-minute expiration or 60-second recent-editor window is applied by attachment_update.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
session_id |
string | Yes* | – | Authenticated user session ID. |
token |
string | Yes* | – | Public task guest-access token. |
project_token |
string | Yes* | – | Public project guest-access token. |
attachment_id |
int | Yes | – | ID of the attachment to update. |
filename |
string | Yes** | unchanged | New attachment display filename. Maximum 255 characters; longer values are truncated. An empty string is accepted. |
attachment_order |
int | Yes** | unchanged | New numeric order value. Allowed range: 0 to 4294967295. |
* One of session_id, token, or project_token is required.
** At least one of filename or attachment_order is required.
When filename is supplied:
URL is not changed.URL_thumbnail is not changed.Changing filename affects attachment metadata only.
When attachment_order is supplied:
0.4294967295.5417.The method does not automatically reorder other attachments. It updates only the selected attachment’s order value.
The following fields can be updated:
| Field | Type | Update behavior |
|---|---|---|
filename |
string | Replaced with the supplied value, limited to 255 characters. |
attachment_order |
int | Replaced with the supplied integer value from 0 to 4294967295. |
The method does not change:
URLURL_thumbnailcomment_idtask_idtrack_idproject_iduser_idmime_content_typefile_sizeThe attachment’s updated timestamp is not explicitly refreshed by this method.
Supplying the existing filename or order still produces a successful update, activity entry, and WebSocket event.
{
"data": {
"operation_status": "SUCCESS",
"attachment_id": 301
}
}
attachment_id contains the ID of the updated attachment.
The HTTP response does not include the complete updated attachment object.
{
"data": {
"operation_status": "FAILED",
"operation_message": "filename or attachment_order required"
},
"error_message": "filename or attachment_order required",
"error_no": 5403
}
Validation, access, and update errors are returned with HTTP status 200.
Authentication failure uses HTTP status 401.
After a successful attachment update, the method:
UPDATE event to the account WebSocket channel.Example WebSocket event:
{
"action": "UPDATE",
"object": "attachments",
"data": {
"attachment_id": 301,
"filename": "updated-screenshot.png",
"attachment_order": 2,
"...": "other attachment and related object fields"
}
}
The method does not:
| HTTP Code | error_no |
Message | Description |
|---|---|---|---|
401 |
– | Unauthorized |
Missing or invalid session_id, token, or project_token. |
200 |
7 |
limit reached |
Too many failed session-validation attempts from the same IP address. |
200 |
5401 |
attachment_id is required |
attachment_id was not provided or was empty. |
200 |
5402 |
Attachment Not Found |
The specified attachment does not exist. |
200 |
5403 |
filename or attachment_order required |
Neither filename nor attachment_order was supplied. |
200 |
5404 |
Access denied |
The current user does not own the attachment and does not satisfy the related comment-editing requirements. |
200 |
5417 |
Out of range value in attachment_order |
attachment_order is below 0 or above 4294967295. |
200 |
0 |
Internal API Error |
The attachment record could not be updated. |
attachment_id is required.filename or attachment_order must be supplied.editing_time is not checked by this method.filename can be set to an empty string.filename does not rename or replace the physical file.attachment_order is limited to the unsigned 32-bit range.updated timestamp is not explicitly changed.attachment_id.