Delete files from a project expense
Removes one or more attachments from a project expense and deletes the files from storage.
Every URL must be absolute and must belong to the expense, otherwise the call returns 400 and NOTHING is deleted. Duplicate URLs in one call are collapsed. Despite the name, this route also deletes images (same code as deleteimage).
Use it to:
- Accounts-payable integration replacing a wrong supplier-invoice PDF: delete the old URL, then attach the new file
Behaviour:
- Not idempotent.
- Repeating a successful call answers 400 (the URL no longer belongs to the expense); nothing changes.
- Safe to retry only under a condition. After a lost response, GET the expense: a URL that is gone was deleted. A retry of an already-applied call is harmless (400, nothing deleted).
- Duplicates: Duplicate URLs in one call are normalised and collapsed before deleting.
- On failure: A foreign or malformed URL: nothing is deleted (batch pre-check).
- Changes are visible to the next read immediately.
Call first: GET /v1/project-expense/{expenseID}
Next: POST /v1/project-expense/{expenseID}/file
See also: DELETE /v1/project-expense/{expenseID}/image, DELETE /v1/employee-expense/{employeeExpenseID}/file
Not yet documented: examples.
curl -X DELETE "https://app3.timelog.com/your-account/api/v1/project-expense/123/file?fileUrl=%5B%22example_string%22%5D" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://app3.timelog.com/your-account/api/v1/project-expense/123/file?fileUrl=%5B%22example_string%22%5D"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.delete(url, headers=headers)
print(response.json())
const response = await fetch("https://app3.timelog.com/your-account/api/v1/project-expense/123/file?fileUrl=%5B%22example_string%22%5D", {
method: "DELETE",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("DELETE", "https://app3.timelog.com/your-account/api/v1/project-expense/123/file?fileUrl=%5B%22example_string%22%5D", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://app3.timelog.com/your-account/api/v1/project-expense/123/file?fileUrl=%5B%22example_string%22%5D')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Delete.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
"null"
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Not Found",
"message": "The requested resource was not found",
"code": 404
}
{
"error": "Internal Server Error",
"message": "An unexpected error occurred on the server",
"code": 500,
"requestId": "req_1234567890"
}
/v1/project-expense/{expenseID}/fileTarget server for requests. Edit to use your own host.
OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.
Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.The project expense. Loaded AFTER the URL check, so an empty fileUrl list answers 400 even for an unknown ID.
An attachment URL of this expense (from FileUrls), absolute and URL-encoded. Repeat the parameter for several. Matched on scheme + host + path; the query string is ignored; duplicates are collapsed.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
Not yet documented: how to obtain a token.
Not yet documented: token lifetime.
Path Parameters
The project expense. Loaded AFTER the URL check, so an empty fileUrl list answers 400 even for an unknown ID.
Query Parameters
An attachment URL of this expense (from FileUrls), absolute and URL-encoded. Repeat the parameter for several. Matched on scheme + host + path; the query string is ignored; duplicates are collapsed.
Responses
*Success without content: HTTP 200 with the literal JSON body null. Body is the JSON literal null.
Order: none
Empty result: none*