# Create upload URLs for pending reporting report attachments

Creates attachment metadata and returns presigned upload URLs for report artifacts (PDF/DICOM SR) for a pending reporting appointment. Upload the raw file bytes with an HTTP PUT to uploadUrl; if contentType was provided, include the same Content-Type header in the upload. Constraints: max 20 items per request, fileName length <= 255 characters, and contentType must be application/pdf or application/dicom when provided. Uploads use a single PUT (max object size 2 MB) and must complete before uploadUrlExpiresAtUtc (metadata is created immediately but content is available only after the PUT succeeds).

Idempotency: supports the Idempotency-Key header. Reuse the same key with the same payload to receive the original response; reuse with a different payload returns 409 Conflict. Keys are retained for 15 minutes (matches upload URL TTL). Without the header, retries can create duplicate attachment metadata and upload URLs.

Upload guidance: send a single PUT to the uploadUrl with Content-Length; if contentType was provided, include the same Content-Type header. Upload URLs are intended for a single successful PUT; request a new URL if an upload fails or expires. Storage locations are managed by QUBS and are not supplied by clients.

Returns 404 when the appointment is not found or is not in the PENDING REPORTING status.

Endpoint: POST /integrations/v1/{domain}/reporting/appointments/{appointmentId}/report/attachments
Version: v1
Security: Bearer

## Path parameters:

  - `domain` (string, required)
    Partner domain identifier. Your bearer token is scoped to one or more domains and requests outside that scope are rejected.
    Example: "acme"

  - `appointmentId` (string, required)
    Appointment identifier within the specified domain.
    Example: "A123456"

## Header parameters:

  - `X-Correlation-Id` (string)
    Request correlation identifier. Echoes the incoming X-Correlation-Id header when provided.
    Example: "4b7f0a91b4f54f2a"

  - `Idempotency-Key` (string)
    Idempotency key for safely retrying POST requests. Use a stable ASCII token (recommend a UUID) up to 128 characters. Reuse the same key with the same request payload to receive the original response; reuse with a different payload returns 409 Conflict. For timeouts or transient errors, retry with the same key and exponential backoff.
    Example: "cd4a859c7a1f4b44b765a8fe17bb44c1"

## Request fields (application/json):

  - `items` (array, required)
    Attachment upload request items. Each item creates a new attachment GUID and presigned upload URL. Up to 20 items per request. File names max 255 characters.

  - `items.fileName` (string, required)
    File name for the report attachment. Path segments are stripped; if empty, a fallback name is generated. Max 255 characters.
    Example: "Example Name"

  - `items.contentType` (null,string)
    Optional content type for upload; when provided it must be application/pdf or application/dicom, and the PUT upload must include the same Content-Type header. Supported report artifact content types: application/pdf, application/dicom (DICOM SR).
    Enum: "application/pdf", "application/dicom"

  - `items.category` (null,string)
    Optional attachment category. Defaults to report when omitted.
    Example: "report"

## Response 201 fields (application/json):

  - `items` (array, required)
    Attachment upload response items.

  - `items.guid` (string, required)
    Attachment GUID.
    Example: "123"

  - `items.fileName` (string)
    File name for the report attachment.
    Example: "Example Name"

  - `items.category` (string)
    Attachment category.
    Example: "Example category"

  - `items.uploadUrl` (string)
    Presigned URL to upload the attachment with an HTTP PUT request. Uploads use a single PUT request (max object size 2 MB). Include Content-Length with the byte size; if contentType is provided, send the same Content-Type header. Upload URLs are intended for a single successful PUT; request a new URL if an upload fails or expires.
    Example: "https://example.com"

  - `items.uploadUrlExpiresAtUtc` (string)
    UTC expiry timestamp for the presigned upload URL; the upload must complete before this time.
    Example: "2020-01-01T00:00:00Z"

## Response 400 fields (application/problem+json):

  - `type` (string)
    Stable error type identifier (urn:qubs:integrations:...). For each response, the type matches the HTTP status.
    Enum: "urn:qubs:integrations:bad-request"

  - `title` (null,string)
    Short, human-readable summary of the error.
    Example: "Example title"

  - `status` (integer)
    HTTP status code for this error response.
    Example: 400

  - `detail` (null,string)
    Detailed description of the error.
    Example: "Example detail"

  - `instance` (null,string)
    Request path for this error.
    Example: "Example instance"

  - `requestId` (string)
    Request correlation identifier for support. Also returned as the X-Correlation-Id response header.
    Example: "4b7f0a91b4f54f2a"

## Response 401 fields (application/problem+json):

  - `type` (string)
    Stable error type identifier (urn:qubs:integrations:...). For each response, the type matches the HTTP status.
    Enum: "urn:qubs:integrations:unauthorized"

  - `title` (null,string)
    Short, human-readable summary of the error.
    Example: "Example title"

  - `status` (integer)
    HTTP status code for this error response.
    Example: 401

  - `detail` (null,string)
    Detailed description of the error.
    Example: "Example detail"

  - `instance` (null,string)
    Request path for this error.
    Example: "Example instance"

  - `requestId` (string)
    Request correlation identifier for support. Also returned as the X-Correlation-Id response header.
    Example: "4b7f0a91b4f54f2a"

## Response 403 fields (application/problem+json):

  - `type` (string)
    Stable error type identifier (urn:qubs:integrations:...). For each response, the type matches the HTTP status.
    Enum: "urn:qubs:integrations:forbidden"

  - `title` (null,string)
    Short, human-readable summary of the error.
    Example: "Example title"

  - `status` (integer)
    HTTP status code for this error response.
    Example: 403

  - `detail` (null,string)
    Detailed description of the error.
    Example: "Example detail"

  - `instance` (null,string)
    Request path for this error.
    Example: "Example instance"

  - `requestId` (string)
    Request correlation identifier for support. Also returned as the X-Correlation-Id response header.
    Example: "4b7f0a91b4f54f2a"

## Response 404 fields (application/problem+json):

  - `type` (string)
    Stable error type identifier (urn:qubs:integrations:...). For each response, the type matches the HTTP status.
    Enum: "urn:qubs:integrations:not-found"

  - `title` (null,string)
    Short, human-readable summary of the error.
    Example: "Example title"

  - `status` (integer)
    HTTP status code for this error response.
    Example: 404

  - `detail` (null,string)
    Detailed description of the error.
    Example: "Example detail"

  - `instance` (null,string)
    Request path for this error.
    Example: "Example instance"

  - `requestId` (string)
    Request correlation identifier for support. Also returned as the X-Correlation-Id response header.
    Example: "4b7f0a91b4f54f2a"

## Response 409 fields (application/problem+json):

  - `type` (string)
    Stable error type identifier (urn:qubs:integrations:...). For each response, the type matches the HTTP status.
    Enum: "urn:qubs:integrations:conflict"

  - `title` (null,string)
    Short, human-readable summary of the error.
    Example: "Example title"

  - `status` (integer)
    HTTP status code for this error response.
    Example: 409

  - `detail` (null,string)
    Detailed description of the error.
    Example: "Example detail"

  - `instance` (null,string)
    Request path for this error.
    Example: "Example instance"

  - `requestId` (string)
    Request correlation identifier for support. Also returned as the X-Correlation-Id response header.
    Example: "4b7f0a91b4f54f2a"

## Response 429 fields (application/problem+json):

  - `type` (string)
    Stable error type identifier (urn:qubs:integrations:...). For each response, the type matches the HTTP status.
    Enum: "urn:qubs:integrations:too-many-requests"

  - `title` (null,string)
    Short, human-readable summary of the error.
    Example: "Example title"

  - `status` (integer)
    HTTP status code for this error response.
    Example: 429

  - `detail` (null,string)
    Detailed description of the error.
    Example: "Example detail"

  - `instance` (null,string)
    Request path for this error.
    Example: "Example instance"

  - `requestId` (string)
    Request correlation identifier for support. Also returned as the X-Correlation-Id response header.
    Example: "4b7f0a91b4f54f2a"

## Response 500 fields (application/problem+json):

  - `type` (string)
    Stable error type identifier (urn:qubs:integrations:...). For each response, the type matches the HTTP status.
    Enum: "urn:qubs:integrations:server-error"

  - `title` (null,string)
    Short, human-readable summary of the error.
    Example: "Example title"

  - `status` (integer)
    HTTP status code for this error response.
    Example: 500

  - `detail` (null,string)
    Detailed description of the error.
    Example: "Example detail"

  - `instance` (null,string)
    Request path for this error.
    Example: "Example instance"

  - `requestId` (string)
    Request correlation identifier for support. Also returned as the X-Correlation-Id response header.
    Example: "4b7f0a91b4f54f2a"