Attachments
Upload, list, download, and delete files linked to a patient record.
Files (PDFs, images, analysis documents) are stored against a patient's file number
(MRN), and optionally a specific lab result. Bytes are stored on disk under the backend's
UPLOAD_DIR (a persistent volume in Docker); the database holds only metadata.
| Method | Path | Permission |
|---|---|---|
POST | /api/attachments | patient:write or lab:write |
GET | /api/attachments?fileNumber={mrn} | patient:read or lab:read |
GET | /api/attachments/{id} | patient:read or lab:read |
DELETE | /api/attachments/{id} | patient:write or lab:write |
Limits
One file per request, 15 MB max. Allowed types: PDF, common images (PNG/JPEG/GIF/WebP/TIFF/HEIC), DICOM, plain text/CSV, and Word/Excel documents.
Endpoints
Upload a file
multipart/form-data with a file part plus a fileNumber field (and an optional
labKey when the file documents a specific result).
curl -b cookies.txt -X POST http://localhost:4000/api/attachments \
-F "file=@cbc-report.pdf" \
-F "fileNumber=10293" \
-F "labKey=Hemoglobin · Jun 18, 2026"Returns the created attachment:
{
"id": "8f2c…",
"fileNumber": "10293",
"labKey": "Hemoglobin · Jun 18, 2026",
"filename": "cbc-report.pdf",
"mimeType": "application/pdf",
"sizeBytes": 48213,
"uploadedByName": "Dr. Adaobi Okafor",
"createdAt": "2026-06-18T10:12:00.000Z"
}List a patient's files
curl -b cookies.txt "http://localhost:4000/api/attachments?fileNumber=10293"Download / preview a file
Streams the bytes. Images and PDFs are sent inline (so the app can preview them in a
dialog); other types are sent as an attachment download.
curl -b cookies.txt http://localhost:4000/api/attachments/8f2c… -o report.pdfDelete a file
Removes the row and the file from disk.
curl -b cookies.txt -X DELETE http://localhost:4000/api/attachments/8f2c…