# Multimodal input and generated images
> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/guides/multimodal/
> Summary: Upload images, documents, text, and audio safely, attach them to a run, or generate a durable image attachment with an agent tool.
Tracon treats binary input as a stored attachment, not as JSON inside a message.
The run carries an attachment id. The model receives the verified bytes only when the
provider call is made.
## Mental model: bytes out of history
```mermaid
flowchart LR
accTitle: Attachment data flow
accDescr: A verified upload becomes an attachment id, the run resolves it to model content, and conversation history stores only the reference.
U["Upload multipart file"] --> S["Attachment store verified bytes"]
S --> I["Attachment id"]
I --> H["Session history small URI reference"]
H --> R["Resolver before model call"]
S --> R
R --> D["DataContent bytes and MIME type"]
D --> M["Provider model"]
```
This shape keeps session payloads small and makes attachment ownership enforceable.
It also avoids asking a provider to fetch a private URL it cannot reach.
## Upload, then run
Upload with a multipart field named `file`. `sessionId` is optional. When present, it
groups the attachment with that session for listing and lifecycle cleanup.
```bash
curl -sS -X POST \
"http://localhost:5081/tracon/api/attachments?sessionId=case-4182" \
-H "Authorization: Bearer $TRACON_TOKEN" \
-F 'file=@invoice.png'
```
The response is `201 Created` with an `AttachmentDescriptor`. Copy its `id`, then put
that UUID in `attachmentIds`:
```bash
curl -N -X POST \
http://localhost:5081/tracon/api/agents/invoice-reader/run \
-H "Authorization: Bearer $TRACON_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"sessionId": "case-4182",
"message": "Read this invoice and identify missing fields.",
"attachmentIds": ["6c825f61-85e1-4e5e-8ed4-247391e2a9bd"]
}'
```
The run endpoint checks every id before it starts the SSE stream. An unknown id, or an
id owned by another tenant, returns `400` without contacting the model. A request can
contain attachments without text, because one of `message`, `attachmentIds`, or
`approvals` is sufficient.
The console Playground implements the same flow behind its attachment button. It
uploads first, sends the returned ids with the next turn, and fetches protected image
or audio bytes into object URLs for preview.
## What reaches the model
The stored message contains a `UriContent` reference. Immediately before each model
call, `AttachmentResolvingChatClient` loads the tenant-owned bytes and replaces that
reference with `DataContent`. The resolved bytes are not written back into chat
history.
:::caution[Upload support is not model support]
Passing the upload guard means Tracon can store and transport the file. It does
not mean the selected model understands that image, PDF, or audio format. Verify the
exact provider, model, and API surface. A text-only model can ignore the content or
reject the request.
:::
## Default types and limits
One attachment is limited to 20 MiB by default. The default allow list is:
- `image/png`, `image/jpeg`, `image/webp`, and `image/gif`
- `application/pdf`
- UTF-8 `text/plain`
- `audio/*`; the built-in detector recognizes WAV, Ogg, and MP3
The client-provided `Content-Type` and file extension are not trusted. Tracon
derives the type from magic bytes. Plain text is the exception: when the first 1 KiB
is valid UTF-8 and has no NUL or disallowed control byte, it is treated as
`text/plain`.
Empty files, unknown signatures, files above the byte limit, and detected types
outside the allow list return `400`.
Change the limit and narrow the list through options:
```csharp
builder.Services.Configure(options =>
{
options.Attachments.MaxBytes = 8 * 1024 * 1024;
options.Attachments.AllowedMediaTypes.Clear();
options.Attachments.AllowedMediaTypes.Add("image/png");
options.Attachments.AllowedMediaTypes.Add("application/pdf");
});
```
Register this configuration after `AddTracon()` when code values must override
the values read from `Tracon:Attachments`.
## List, download, and delete
```bash
# Descriptors only. Defaults: skip=0, take=50. take is clamped to 1..200.
curl -H "Authorization: Bearer $TRACON_TOKEN" \
"http://localhost:5081/tracon/api/attachments?sessionId=case-4182"
# Raw bytes with the stored MIME type and a SHA-256 ETag.
curl -OJ -H "Authorization: Bearer $TRACON_TOKEN" \
"http://localhost:5081/tracon/api/attachments/{attachmentId}"
# Immediate hard delete.
curl -X DELETE -H "Authorization: Bearer $TRACON_TOKEN" \
"http://localhost:5081/tracon/api/attachments/{attachmentId}"
```
Downloads send `Content-Disposition: attachment` and
`X-Content-Type-Options: nosniff`. A browser must fetch with the authorization header
and create an object URL for preview. A protected download URL cannot be used directly
as an `` or `