attachment: createUploadSession

Namespace: microsoft.graph

Create an upload session that allows an app to iteratively upload ranges of a file, so as to attach the file to the specified Outlook item. The item can be a message or event.

Use this approach to attach a file if the file size is between 3 MB and 150 MB. To attach a file that's smaller than 3 MB, do a POST operation on the attachments navigation property of the Outlook item; see how to do this for a message or for an event.

As part of the response, this action returns an upload URL that you can use in subsequent sequential PUT queries. Request headers for each PUT operation let you specify the exact range of bytes to be uploaded. This allows transfer to be resumed, in case the network connection is dropped during upload.

The following are the steps to attach a file to an Outlook item using an upload session:

  1. Create an upload session.
  2. Within that upload session, iteratively upload ranges of bytes (up to 4 MB each time) until all the bytes of the file have been uploaded, and the file is attached to the specified item.
  3. Save the ID for the attachment for future access.
  4. Optional: Delete the upload session.

See attach large files to Outlook messages or events for an example.


Exchange Online lets administrators customize the message size limit for Microsoft 365 mailboxes, including any message attachments. By default, this message size limit is 35 MB. Find out how to customize the maximum message size to support attachments larger than the default limit for your tenant.


Be aware of a known issue if you're attaching a large file to a message or event in a shared or delegated mailbox.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission type Permissions (from least to most privileged)
Delegated (work or school account) Calendars.ReadWrite, Mail.ReadWrite
Delegated (personal Microsoft account) Calendars.ReadWrite, Mail.ReadWrite
Application Calendars.ReadWrite, Mail.ReadWrite

HTTP request

To create an upload session for attaching a file to an event:

POST /me/events/{id}/attachments/createUploadSession
POST /users/{id | userPrincipalName}/events/{id}/attachments/createUploadSession

To create an upload session for attaching a file to a message:

POST /me/messages/{id}/attachments/createUploadSession
POST /users/{id | userPrincipalName}/messages/{id}/attachments/createUploadSession

Request headers

Name Description
Authorization Bearer {token}

Request body

In the request body, provide a JSON object with the following parameters.

Parameter Type Description
AttachmentItem attachmentItem Represents attributes of the item to be uploaded and attached. At minimum, specify the attachment type (file), a name, and the size of the file.


If successful, this method returns a 201 Created response code and a new uploadSession object in the response body.


The uploadUrl property returned as part of the uploadSession response object is an opaque URL for subsequent PUT queries to upload byte ranges of the file. It contains the appropriate auth token for subsequent PUT queries that expire by expirationDateTime. Do not customize this URL.

The nextExpectedRanges property specifies the next file byte location to upload from, for example, "NextExpectedRanges":["2097152"]. You must upload bytes in a file in order.


The following example shows how to create an upload session that you can use in subsequent file upload operations to the specified message.


Content-type: application/json

  "AttachmentItem": {
    "attachmentType": "file",
    "name": "flower", 
    "size": 3483322


Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-type: application/json

    "@odata.context": "$metadata#microsoft.graph.uploadSession",
    "uploadUrl": "'a8e8e219-4931-95c1-b73d-62626fd79c32@72aa88bf-76f0-494f-91ab-2d7cd730db47')/Messages('AAMkADI5MAAIT3drCAAA=')/AttachmentSessions('AAMkADI5MAAIT3k0uAAA=')?authtoken=eyJhbGciOiJSUzI1NiIsImtpZCI6IktmYUNIUlN6bllHMmNI",
    "expirationDateTime": "2019-09-25T01:09:30.7671707Z",
    "nextExpectedRanges": [