ADD API of upload-attachment, authorize download link