# flow2act · Attach external document link

Disabled: authenticated accounts assigned to the active approval or reviewer group are required.

This compatibility endpoint denies content access and decisions. Existing guest links cannot authorize access. Assign an internal group and upload files to private storage instead.

## POST /v1/documents/links

Authentication: restricted integration key (scope: runs:start) or flow2act sign-in access token
Required tenant header: X-Organization-Id.
Required user permissions: Requester role required. The API checks current membership, roles, key scopes and resource permissions on every request. Documentation visibility grants no access.

## Input parameters
- flowVersionId (string, required): uuid
- fieldKey (string, required): 
- fileName (string, required): min length 1 · max length 180
- url (string, required): uri · max length 2048
- version (string, required): min length 1 · max length 180
- contentType (string, required): application/pdf | image/png | image/jpeg | application/vnd.openxmlformats-officedocument.wordprocessingml.document

## Request example (replace example IDs)

```sh
curl -X POST "https://api.flow2act.com/v1/documents/links" \
  -H "authorization: Bearer $FLOW2ACT_API_KEY" \
  -H "x-organization-id: 10000000-0000-4000-8000-000000000001" \
  -H "idempotency-key: example-document-link-001" \
  -H "content-type: application/json" \
  --data-raw '{
  "flowVersionId": "10000000-0000-4000-8000-000000000003",
  "fieldKey": "contract",
  "fileName": "contract.pdf",
  "contentType": "application/pdf",
  "url": "https://documents.example.com/contracts/123/versions/1",
  "version": "1"
}'
```

## Response excerpt

```json
{
  "error": "PRIVATE_UPLOAD_REQUIRED"
}
```

Source: /docs/document-link
Full schemas: /docs/openapi.json