check credentials
parameters
allow the attachment to be passed but not used