Developers
Open ManaNotes
On this page
Attachments

Attachments API

List, upload, download and delete the files on a patient’s record — intake forms, consent PDFs, scans — exactly as the app’s Files tab.

Attachments are the files on a patient’s record: what the patient page’s Files tab shows. A file sits either directly on the patient record or under one of the patient’s injuries (ACC claims). These endpoints wrap the app’s own upload, download and delete, so clinic scoping, the size and type rules, the activity timeline and the access log all behave exactly as an in-app upload. Reading needs attachments:read; uploading and deleting need attachments:write.

The attachment object
idstring
Unique identifier (ObjectId).
fileNamestring
File name including its extension.
fileSizeinteger
Size in bytes.
fileTypestring
File extension, lower-case, no dot (e.g. pdf).
mimeTypestring
MIME type, e.g. application/pdf.
descriptionstring | null
Optional caption shown with the file.
uploadedAtstring
ISO 8601 upload timestamp.
patientIdstring | null
The patient the file is on, when filed on the patient record.
injuryIdstring | null
The injury the file is under, when filed under an injury.
PractitionerIdstring
The practitioner the file was uploaded as.
createdAtstring
ISO 8601 creation timestamp.
updatedAtstring
ISO 8601 last-update timestamp.
GET/api/v1/patients/{id}/attachments

List a patient’s files

Returns metadata for the patient’s files — those on the record and those under any of their injuries — newest first. Never the bytes: fetch those per file with Download a file. Requires attachments:read.

Path parameters
idstringrequired
The id of the patient.
Request
cURL
curl https://api.mananotes.co.nz/api/v1/patients/65f0c2a1b3d4e5f6a7b8c9d0/attachments \
  -H "Authorization: Bearer eyJhbGci..."
Response
200 OK · application/json
{
  "data": [
    {
      "id": "66b1c2d3e4f5a6b7c8d9e0f1",
      "fileName": "intake-form.pdf",
      "fileSize": 182344,
      "fileType": "pdf",
      "mimeType": "application/pdf",
      "description": "New patient intake form",
      "uploadedAt": "2026-06-20T01:12:40Z",
      "patientId": "65f0c2a1b3d4e5f6a7b8c9d0",
      "injuryId": null,
      "PractitionerId": "65f0a1...",
      "createdAt": "2026-06-20T01:12:40Z",
      "updatedAt": "2026-06-20T01:12:40Z"
    }
  ]
}
POST/api/v1/patients/{id}/attachments

Upload a file to a patient

Attaches a file to the patient’s record — or, with injuryId, under one of the patient’s injuries. Send the bytes base64-encoded in fileData. The decoded file may be at most 10MB and mimeType must be one of the allowed types; otherwise the request is rejected with 400 (File size exceeds maximum limit of 10MB for an oversize file). Unknown fields are rejected with 400. The upload shows in the patient’s Files tab in the app and is logged on the patient’s activity timeline. Returns 201 with the new attachment. Requires attachments:write.

Path parameters
idstringrequired
The id of the patient.
Body parameters
fileNamestringrequired
File name including its extension, at most 255 characters (e.g. intake-form.pdf).
mimeTypestringrequired
One of application/pdf, image/jpeg, image/jpg, image/png, image/gif, application/msword, application/vnd.openxmlformats-officedocument.wordprocessingml.document, text/plain, application/vnd.ms-excel, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.
fileDatastringrequired
The file bytes, base64-encoded — no data: prefix, no whitespace. Decoded size at most 10MB.
descriptionstringoptional
Caption shown with the file.
injuryIdstringoptional
File it under one of the patient’s injuries (ACC claims) instead of the patient record.
Request
cURL
curl https://api.mananotes.co.nz/api/v1/patients/65f0c2a1b3d4e5f6a7b8c9d0/attachments \
  -H "Authorization: Bearer eyJhbGci..." \
  -H "Content-Type: application/json" \
  -d "{
    \"fileName\": \"intake-form.pdf\",
    \"mimeType\": \"application/pdf\",
    \"description\": \"New patient intake form\",
    \"fileData\": \"$(base64 -i intake-form.pdf | tr -d '\\n')\"
  }"
Response
200 OK · application/json
{
  "data": {
    "id": "66b1c2d3e4f5a6b7c8d9e0f1",
    "fileName": "intake-form.pdf",
    "fileSize": 182344,
    "fileType": "pdf",
    "mimeType": "application/pdf",
    "description": "New patient intake form",
    "uploadedAt": "2026-06-20T01:12:40Z",
    "patientId": "65f0c2a1b3d4e5f6a7b8c9d0",
    "injuryId": null,
    "PractitionerId": "65f0a1...",
    "createdAt": "2026-06-20T01:12:40Z",
    "updatedAt": "2026-06-20T01:12:40Z"
  }
}
GET/api/v1/attachments/{id}

Retrieve a file’s metadata

Fetches one file’s metadata by id; 404 if it doesn’t exist (or isn’t in your clinic). Requires attachments:read.

Path parameters
idstringrequired
The id of the attachment.
Request
cURL
curl https://api.mananotes.co.nz/api/v1/attachments/66b1c2d3e4f5a6b7c8d9e0f1 \
  -H "Authorization: Bearer eyJhbGci..."
Response
200 OK · application/json
{
  "data": {
    "id": "66b1c2d3e4f5a6b7c8d9e0f1",
    "fileName": "intake-form.pdf",
    "fileSize": 182344,
    "fileType": "pdf",
    "mimeType": "application/pdf",
    "description": "New patient intake form",
    "uploadedAt": "2026-06-20T01:12:40Z",
    "patientId": "65f0c2a1b3d4e5f6a7b8c9d0",
    "injuryId": null,
    "PractitionerId": "65f0a1..."
  }
}
GET/api/v1/attachments/{id}/content

Download a file

Returns the raw file bytes — not JSON. Content-Type is the stored mimeType, Content-Length is the file size, and Content-Disposition: attachment; filename="…" carries the file name. 404 if the file doesn’t exist. Each download is recorded on the attachment’s access log, like an in-app open. Requires attachments:read.

Path parameters
idstringrequired
The id of the attachment.
Request
cURL
curl https://api.mananotes.co.nz/api/v1/attachments/66b1c2d3e4f5a6b7c8d9e0f1/content \
  -H "Authorization: Bearer eyJhbGci..." \
  -o intake-form.pdf
200 OK · raw file
HTTP/1.1 200 OK
Content-Type: application/pdf
Content-Length: 182344
Content-Disposition: attachment; filename="intake-form.pdf"

%PDF-1.7 …
DELETE/api/v1/attachments/{id}

Delete a file

Soft-deletes a file: it is hidden from the patient record in the app, but the bytes are kept. Requires attachments:write.

Path parameters
idstringrequired
The id of the attachment to delete.
Request
cURL
curl https://api.mananotes.co.nz/api/v1/attachments/66b1c2d3e4f5a6b7c8d9e0f1 \
  -X DELETE \
  -H "Authorization: Bearer eyJhbGci..."
Response
200 OK · application/json
{
  "data": {
    "id": "66b1c2d3e4f5a6b7c8d9e0f1",
    "isDeleted": true
  }
}