I'm trying to find a way to update an attachment's body from a custom visual force page I've created. I have the attachment ID but when I try to call a PATCH web request on the URL: http://appid.salesforce.com/services/data/v38.0/sobjects/Attachment/{attachmentId} I get the following http error:

BAD REQUEST: Unable to create/update fields: ParentId. Please check the security settings of this field and verify that it is read/write for your profile or permission set.

How can I update an existing attachment's body? I don't want to create a new attachment or anything like that.

The I execute the request is the following:

    var objectUrl = http://appid.salesforce.com/services/data/v38.0/sobjects/Attachment/0660L000000WLlH;
    xhr.open("PATCH", objectUrl);
    xhr.setRequestHeader("Authorization", "OAuth " + SFsessionId);
    xhr.setRequestHeader("X-PrettyPrint", "1");
    xhr.setRequestHeader("Content-Type", "application/json");
    xhr.setRequestHeader("Accept", "application/json");

where attachmentBody is:

var attachment = JSON.stringify({
          name: documentName,
          ContentType: "application/pdf",
          body: pdfAsBase64,
          ParentId: parentid,
          Description: "pdf data"


The problem is the ParentId: parentid. During updating it must not be included. Only once during creation.

  • Did you double check FLS and CRUD for your profile to Attachment? Commented Jun 9, 2017 at 12:10
  • Shouldn't your URL should be like https://yourInstance.salesforce.com. try again while changing http -> https and instance in the URL apart from what Alexander has mentioned.
    – Raul
    Commented Jun 9, 2017 at 12:18
  • Did you read this document?
    – sfdcfox
    Commented Jun 9, 2017 at 12:29

1 Answer 1


Assuming you followed Insert or Update Blob Data, odds are, you specified a ParentId. ParentId must not be set after creation, as the field can only be set when you create a new Attachment; trying to reparent an attachment is not allowed.

  • How can I update an existing attachment's body then?
    – PentaKon
    Commented Jun 9, 2017 at 12:46
  • @Konstantine Use the patch method described in the document I linked (which I suspect you're already doing), but do not specify a ParentId.
    – sfdcfox
    Commented Jun 9, 2017 at 12:47
  • I don't think that's going to work. Inside the visual force page, I download the attachment's body as a blob and show it in my application. The page itself has no knowledge of the attachmentId used so how will it know which attachment to update?
    – PentaKon
    Commented Jun 9, 2017 at 12:49
  • @Konstantine You need the attachment Id. You're not going to get around that.
    – sfdcfox
    Commented Jun 9, 2017 at 12:57
  • I have the attachment ID but you said I cannot use it. As explained in my question the only thing I'm doing is creating an XHR object with the given url (which contains the attachmentID) and setting the body as the new binary object. I'm not using any apex or salesforce specific stuff, I just want to use the REST Api. What should I do, because just calling that URL with a PATCH method doesn't seem to work...
    – PentaKon
    Commented Jun 9, 2017 at 13:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .