Delete receipt images from an employee expense (v2)
Removes one or more receipt attachments from an employee expense and deletes the files from storage (v2 route).
The v2 route of DELETE /v1/employee-expense/{employeeExpenseID}/image — identical behaviour: repeat imageUrl for each attachment to remove, processed one at a time so earlier deletions persist when a later one fails. Despite the name it also deletes PDFs.
Use it to:
- Expense app letting the employee remove a wrong receipt photo before submitting
- Receipt integration replacing a receipt: delete the old URL, then attach the new image
Not for:
- Deleting the whole expense —
DELETE /v2/employee-expense/{employeeExpenseID}(also removes every receipt)
Behaviour:
- Not idempotent.
- Repeating a successful call fails with 37684 (the URL is no longer on the expense).
- Safe to retry only under a condition. After a lost response, GET the expense: a URL that is gone was deleted.
- Duplicates: A URL repeated in one call fails on its second occurrence (37684) after the first was deleted.
- On failure: URLs before the failing one stay deleted (each is saved separately).
- Changes are visible to the next read immediately.
- Batch: partial
Call first: GET /v2/employee-expense/{employeeExpenseID}
Next: POST /v2/employee-expense/{employeeExpenseID}/image
See also: DELETE /v1/employee-expense/{employeeExpenseID}/image, DELETE /v2/employee-expense/{employeeExpenseID}/file
Not yet documented: examples.
curl -X DELETE "https://app3.timelog.com/your-account/api/v2/employee-expense/123/image?imageUrl=%5B%22example_string%22%5D" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://app3.timelog.com/your-account/api/v2/employee-expense/123/image?imageUrl=%5B%22example_string%22%5D"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.delete(url, headers=headers)
print(response.json())
const response = await fetch("https://app3.timelog.com/your-account/api/v2/employee-expense/123/image?imageUrl=%5B%22example_string%22%5D", {
method: "DELETE",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("DELETE", "https://app3.timelog.com/your-account/api/v2/employee-expense/123/image?imageUrl=%5B%22example_string%22%5D", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://app3.timelog.com/your-account/api/v2/employee-expense/123/image?imageUrl=%5B%22example_string%22%5D')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Delete.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
"null"
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Not Found",
"message": "The requested resource was not found",
"code": 404
}
{
"error": "Internal Server Error",
"message": "An unexpected error occurred on the server",
"code": 500,
"requestId": "req_1234567890"
}
/v2/employee-expense/{employeeExpenseID}/imageTarget server for requests. Edit to use your own host.
OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.
Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.The expense.
An attachment URL of this expense (from ImageUrls or FileUrls), URL-encoded. Repeat the parameter for several. Matched on scheme + host + path; the query string is ignored. Default: none — the call then does nothing and returns 200
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
Not yet documented: how to obtain a token.
Not yet documented: token lifetime.
Path Parameters
The expense.
Query Parameters
An attachment URL of this expense (from ImageUrls or FileUrls), URL-encoded. Repeat the parameter for several. Matched on scheme + host + path; the query string is ignored.
Default: none — the call then does nothing and returns 200
Responses
*Success without content: HTTP 200 with the literal JSON body null. Body is the JSON literal null.
Order: none
Empty result: none*