Uploading attachment via AttachmentApiController is broken

[Somebodyisnobody]

Since at least 1.17.2 (currently 1.17.4 installed) I am not able to upload attachments via the API anymore. I am getting an HTTP 400 with no response body and the following error is being logged:

{
  "reqId": "xxx",
  "level": 0,
  "time": "2026-06-29T22:53:31+00:00",
  "remoteAddr": "xxx",
  "user": "Test",
  "app": "deck",
  "method": "POST",
  "url": "/apps/deck/api/v1.0/boards/1/stacks/2/cards/3/attachments",
  "scriptName": "/index.php",
  "message": "Failed to call controller method: OCA\\Deck\\Controller\\AttachmentApiController::create(): Argument #3 ($data) must be of type string, null given, called in /var/www/html/lib/private/AppFramework/Http/Dispatcher.php on line 205",
  "userAgent": "bruno-runtime/3.5.0",
  "version": "33.0.3.2",
  "exception": {
    "Exception": "TypeError",
    "Message": "OCA\\Deck\\Controller\\AttachmentApiController::create(): Argument #3 ($data) must be of type string, null given, called in /var/www/html/lib/private/AppFramework/Http/Dispatcher.php on line 205",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 205,
        "function": "create",
        "class": "OCA\\Deck\\Controller\\AttachmentApiController",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 118,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Deck\\Controller\\AttachmentApiController"
          },
          "create"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/App.php",
        "line": 153,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Deck\\Controller\\AttachmentApiController"
          },
          "create"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Route/Router.php",
        "line": 321,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::",
        "args": [
          "OCA\\Deck\\Controller\\AttachmentApiController",
          "create",
          {
            "__class__": "OC\\AppFramework\\DependencyInjection\\DIContainer"
          },
          {
            "_route": "deck.attachment_api.create",
            "apiVersion": "1.0",
            "boardId": "1",
            "stackId": "2",
            "cardId": "3"
          }
        ]
      },
      {
        "file": "/var/www/html/lib/base.php",
        "line": 1155,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->",
        "args": [
          "/apps/deck/api/v1.0/boards/1/stacks/2/cards/3/attachments"
        ]
      },
      {
        "file": "/var/www/html/index.php",
        "line": 25,
        "function": "handleRequest",
        "class": "OC",
        "type": "::",
        "args": []
      }
    ],
    "File": "/var/www/html/custom_apps/deck/lib/Controller/AttachmentApiController.php",
    "Line": 49,
    "message": "Failed to call controller method: OCA\\Deck\\Controller\\AttachmentApiController::create(): Argument #3 ($data) must be of type string, null given, called in /var/www/html/lib/private/AppFramework/Http/Dispatcher.php on line 205",
    "exception": "{\"class\":\"TypeError\",\"message\":\"OCA\\Deck\\Controller\\AttachmentApiController::create(): Argument #3 ($data) must be of type string, null given, called in /var/www/html/lib/private/AppFramework/Http/Dispatcher.php on line 205\",\"code\":0,\"file\":\"/var/www/html/custom_apps/deck/lib/Controller/AttachmentApiController.php:49\",\"trace\":\"#0 /var/www/html/lib/private/AppFramework/Http/Dispatcher.php(205): OCA\\Deck\\Controller\\AttachmentApiController->create(5409, 'file', NULL)\\n#1 /var/www/html/lib/private/AppFramework/Http/Dispatcher.php(118): OC\\AppFramework\\Http\\Dispatcher->executeController(Object(OCA\\Deck\\Controller\\AttachmentApiController), 'create')\\n#2 /var/www/html/lib/private/AppFramework/App.php(153): OC\\AppFramework\\Http\\Dispatcher->dispatch(Object(OCA\\Deck\\Controller\\AttachmentApiController), 'create')\\n#3 /var/www/html/lib/private/Route/Router.php(321): OC\\AppFramework\\App::main('OCA\\\\Deck\\\\Contro...', 'create', Object(OC\\AppFramework\\DependencyInjection\\DIContainer), Array)\\n#4 /var/www/html/lib/base.php(1155): OC\\Route\\Router->match('/apps/deck/api/...')\\n#5 /var/www/html/index.php(25): OC::handleRequest()\\n#6 {main}\"}",
    "CustomMessage": "Failed to call controller method: OCA\\Deck\\Controller\\AttachmentApiController::create(): Argument #3 ($data) must be of type string, null given, called in /var/www/html/lib/private/AppFramework/Http/Dispatcher.php on line 205"
  },
  "id": "xxx"
}

So obviously $data is null. But I am sending an attachment according to the api documentation, I have not changed my productive application (not bruno) recently. Did you change anything with the routing or parameter mapping? Is the form-field file renamed and the docs not updated maybe?

I could reproduce this with bruno (you see it in the log output above). Here is a bruno-collection to reproduce. You need to select a file for form-parameter file to reproduce it.

Add attachment api call.yml

[Somebodyisnobody]

Please tell me if and to which version I can downgrade to get production working again.