Alert attachments

A screenshot of the dashboard, the tail of the log, the heap dump — the evidence that explains an alert usually exists as a file, and it usually lives somewhere else by the time someone else looks. Attachments pin those files to the alert itself, so the next responder sees what you saw.

1. Enable attachments (admin)

   Attachments are stored in your own S3 bucket — OpsPing never keeps the files itself. An admin sets the ATTACHMENTS_BUCKET environment variable on the backend to the bucket name, and the backend handles the rest: presigned PUT URLs for upload, presigned GET URLs for download. On AWS deployments the backend uses the instance's own IAM role, so there are no extra keys to manage — just make sure that role can read, write, and delete objects in the bucket.

   If ATTACHMENTS_BUCKET is unset, every attachment endpoint returns 503 ATTACHMENTS_DISABLED. Self-hosted deployments need to provide their own bucket — the feature is off until you do.

   Note

   Files live in S3 under a per-tenant, per-alert key prefix. Deleting an attachment deletes the object; nothing else is retained.

2. Upload from the alert detail page

   Open any alert in the admin console and use the Attach file action in the attachments section. Pick a file and it uploads straight to your S3 bucket via a presigned URL — the file never passes through the OpsPing API. Limits: 10 MB per file, 10 attachments per alert. Filenames are sanitized to a safe character set, so unusual names may come out slightly flattened.

   Every completed upload lands in the alert's activity timeline with the filename, size, and who uploaded it — which is often half the value: "the dashboard screenshot Sarah attached at 03:14" is a timeline entry you can navigate.

   Tip

   Compress before you attach. A 10 MB heap dump can't be uploaded, but a zipped half of it usually can — and a screenshot of the relevant graph beats a 4000-line raw log paste anyway.

3. Download on web and mobile

   Attachments appear on the alert detail page in the admin console and in the alert view on mobile. Both show the filename, size, and uploader; tapping opens a fresh presigned download link (links expire after an hour, and the apps fetch new ones on demand). Mobile is read-only — viewing is fully supported, but uploads happen from the admin console or the API.

   Note

   Download links are scoped to the alert's team and tenant like everything else — you only ever see attachments on alerts you can already read.

4. Delete attachments and how quota behaves

   Anyone who can see the alert can remove an attachment from the detail page; the row and the S3 object are both deleted. The 10-per-alert cap counts only live attachments: when you upload, OpsPing mints a presigned URL that's valid for 15 minutes, and a mint that never completes (closed tab, failed PUT) quietly stops counting against the quota once it expires. So an abandoned upload won't lock you out of attaching the real file.

5. Upload via the API

   Attachment upload is a three-step dance: mint a presigned URL, PUT the file to S3, then mark the attachment complete. The complete call verifies the object exists and enforces the size cap server-side.

   # 1. Mint a presigned upload URL (15 min lifetime)
   curl -X POST https://api.ops-ping.com/v2/alerts/ALERT_ID/attachments \
     -H "Authorization: OpsPingKey YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"fileName": "dashboard.png", "contentType": "image/png", "size": 245760}'
   
   # → { "data": { "id": "ATTACHMENT_ID", "uploadUrl": "https://…", "expiresIn": 900 } }
   
   # 2. PUT the file to the presigned URL (Content-Type must match)
   curl -X PUT "UPLOAD_URL" \
     -H "Content-Type: image/png" \
     --data-binary @dashboard.png
   
   # 3. Verify and mark complete — this is when it appears on the alert
   curl -X POST https://api.ops-ping.com/v2/alerts/ALERT_ID/attachments/ATTACHMENT_ID/complete \
     -H "Authorization: OpsPingKey YOUR_API_KEY"

   GET /v2/alerts/:id/attachments lists uploaded attachments with fresh download URLs; DELETE /v2/alerts/:id/attachments/:attachmentId removes one.