Attachments

By the end of this page you will have pinned a wireframe on a story and a signed specification on a requirement, opened them from the flyout, known who sees them and how a file reaches a browser, and removed one; you will also know which kinds of file are accepted and how big one may be.

An attachment is a file pinned on one artefact: a wireframe on a story, a signed specification on a requirement, a sample export on a data entity, a vendor quote on a decision. Files live in the Files panel at the foot of the artefact's flyout, between its links and its discussion, on every page that has one: epics, work items, requirements, business rules, use cases, RAID items, decisions, data entities and glossary terms. The record keeps the file's name, size and kind and who uploaded it; the bytes live on a private disk and leave it only through the application, to a person who may see the artefact, never through a URL anyone can guess. An attachment is not versioned: it is added or removed, and both are announced.

Before you beginCopy Anchor Link

Open the files of an artefactCopy Anchor Link

1. Open the artefact's page and open the artefact: its flyout opens from the row's menu, from View, or from a ?show= link someone sent you.
2. Scroll to Files, under the artefact's links.

Each row is one file, newest first: a picture shows as a small preview, any other file as a badge with its kind; then the name, which opens or saves the file, the size, who uploaded it and when (the full date on hover), and a remove button when you may remove it.

Attach filesCopy Anchor Link

1. Under Add Files, pick up to ten files at once. Images, PDFs, Office documents, text, CSV, JSON and ZIP files are accepted, up to 25 MB each unless the operator raised the ceiling.
2. Press Attach.

The files appear at the top of the list, a toast counts them and attachment.created goes out for each. A pick with a file the panel refuses is dropped whole, with the reason under the field, so a refused file never lingers at the front of the next pick.

Open or save a fileCopy Anchor Link

The name of each row hands the file to the browser through the application, with the file's own name and type; a picture's preview opens it where it stands. Nothing is served from a public folder: a link to a file works only for a signed-in person who may see the artefact, which is why a file sent to a colleague is a link to the artefact, not to the file.

Remove a fileCopy Anchor Link

Press the remove button at the end of a row, then Remove to confirm, or Keep to back out. The file is gone from the record and from the disk, and attachment.deleted goes out. You remove the files you uploaded; attachment:delete lets a moderator remove anyone's.

All the fieldsCopy Anchor Link

What is acceptedCopy Anchor Link

Executables, scripts and SVG files are refused on purpose: a file that can run is not a file a client's record should carry. The status reference lists the kinds with their codes.

What happens nextCopy Anchor Link

• attachment.created and attachment.deleted go out with the artefact, the file's name, size and kind and who uploaded it, never the bytes; see the attachment.* events.
• A file is not a version of the artefact: attaching and removing change nothing on the record itself, and the activity log keeps the file's own entry.
• Heimdall and an agent connected over MCP read the files' names and kinds with list_attachments and fetch the bytes over the REST API with a token that may read them.

ManagingCopy Anchor Link

• A moderator with attachment:delete removes anyone's file.
• A client guest sees and opens the files on the agreed record, and uploads nothing.
• An artefact deleted takes its files with it.
• A deleted account leaves its files in place, with the uploader shown as someone.
• The ceiling and the kinds are the operator's to raise or narrow; this page describes the defaults.

Heimdall on this pageCopy Anchor Link

Heimdall and an agent connected over MCP read what is pinned on an artefact so a specification or a wireframe named in a story is found rather than guessed; the agent fetches the bytes over REST. Neither uploads or removes a file: what a record carries is a person's call.

From the API and MCPCopy Anchor Link

PermissionsCopy Anchor Link

Frequently askedCopy Anchor Link

RelatedCopy Anchor Link

• Comments and mentions — the discussion under the files
• Traceability — the links above them
• Design references — links to Figma files, prototypes and contracts, as opposed to files pinned on a record
• Status reference — every kind with its code
• attachment.* webhook events