# Files

The files library keeps images and documents you reuse. Upload a file once under **Templates, Files** (or with the API), then use its link in a template or a broadcast, or attach it to an email by its id.

## What is accepted

PDF, Office (`doc`, `docx`, `xls`, `xlsx`, `ppt`, `pptx`, `odt`, `ods`, `odp`), `csv`, `tsv`, `ics`, and `png`, `jpg`, `gif`, `webp` images. A file is at most **10 MB**, and a workspace stores up to 1 GB. Archives, executables, HTML and SVG are refused, and the content must match the file type: a renamed program is not accepted.

## Links

Every file has an unguessable link, `/api/public/files/{token}/{name}`. Images show inline, everything else downloads. A link can expire (`PATCH /api/practices/{id}/files/{fileID}` with `expires_at`) and stops working when the file is deleted. An unknown, expired and deleted link all answer 404. Files are served with `nosniff` and a sandboxing content security policy.

Prefer a link over an attachment, especially for broadcasts. Many mailboxes refuse messages over 10 to 25 MB, large attachments hurt your reputation, and an attachment cannot be withdrawn after it was sent, a link can.

## Attach a library file

In a send request, name the file instead of carrying its content:

```json
{ "to": ["you@example.com"], "subject": "Your offer", "text": "See the attachment.",
  "attachments": [ { "file_id": "your-file-uuid" } ] }
```

The usual attachment rules apply: at most 5 attachments and 30 MB together.

## Storage

The bytes live in an S3-compatible bucket in the region you choose; a local directory is available for development. Uploads are checked for type and size but are not scanned for malware.