Attach receipt images to an employee expense (v2)
Uploads one or more receipt images (JPEG, PNG, GIF, BMP, TIFF …) to an existing employee expense (v2 route).
The v2 route of POST /v1/employee-expense/{employeeExpenseID}/image — identical behaviour: multipart/form-data with one image per part (every part is a file), each part must decode as an image or nothing is stored, 16 MB per request, JSON null in response. GET the expense for the 15-minute download URLs in ImageUrls. Create the expense first, then attach.
Use it to:
- Receipt-capture / OCR app uploading the photographed receipt right after creating the expense
Not for:
- PDF receipts —
POST /v2/employee-expense/{employeeExpenseID}/file - Replacing a receipt — delete it (deleteimage) and attach the new one; attach only appends
Behaviour:
- Not idempotent.
- Not safe to retry blindly. After a lost response, GET the expense and compare ImageUrls before retrying.
- Duplicates: Not deduplicated: the same image uploaded twice becomes two attachments.
- On failure: All parts are decoded before any upload, so an invalid part stores nothing.
- Changes are visible to the next read immediately.
- Batch: For validation: one bad part rejects the call. Not transactional for storage failures.
Call first: POST /v2/employee-expense
Next: GET /v2/employee-expense/{employeeExpenseID}
See also: POST /v1/employee-expense/{employeeExpenseID}/image, POST /v2/employee-expense/{employeeExpenseID}/file, DELETE /v2/employee-expense/{employeeExpenseID}/image
Not yet documented: behaviour → side effects on failure; examples; request → body → multipart → formats.
curl -X POST "https://app3.timelog.com/your-account/api/v2/employee-expense/123/image" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://app3.timelog.com/your-account/api/v2/employee-expense/123/image"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.post(url, headers=headers)
print(response.json())
const response = await fetch("https://app3.timelog.com/your-account/api/v2/employee-expense/123/image", {
method: "POST",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("POST", "https://app3.timelog.com/your-account/api/v2/employee-expense/123/image", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://app3.timelog.com/your-account/api/v2/employee-expense/123/image')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
"null"
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Not Found",
"message": "The requested resource was not found",
"code": 404
}
{
"error": "Error",
"message": "- **Code 415** — The request body is not a MIME multipart message. — Fix: Send Content-Type multipart/form-data with one part per file.",
"code": 415
}
{
"error": "Internal Server Error",
"message": "An unexpected error occurred on the server",
"code": 500,
"requestId": "req_1234567890"
}
/v2/employee-expense/{employeeExpenseID}/imageTarget server for requests. Edit to use your own host.
OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.
Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.The expense to attach to.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
Not yet documented: how to obtain a token.
Not yet documented: token lifetime.
Path Parameters
The expense to attach to.
Responses
*Success without content: HTTP 200 with the literal JSON body null. Body is the JSON literal null. The new files appear in ImageUrls of GET /v2/employee-expense/{id}.
Order: none
Empty result: none*