diff --git a/src/main/java/au/com/royalpay/payment/manage/support/attachment/package-info.java b/src/main/java/au/com/royalpay/payment/manage/support/attachment/package-info.java
new file mode 100644
index 000000000..24c399a24
--- /dev/null
+++ b/src/main/java/au/com/royalpay/payment/manage/support/attachment/package-info.java
@@ -0,0 +1,5 @@
+/**
+ * file upload
+ * Created by yixian on 2016-07-04.
+ */
+package au.com.royalpay.payment.manage.support.attachment;
\ No newline at end of file
diff --git a/src/main/java/au/com/royalpay/payment/manage/support/attachment/web/AttachmentController.java b/src/main/java/au/com/royalpay/payment/manage/support/attachment/web/AttachmentController.java
new file mode 100644
index 000000000..34a8f2907
--- /dev/null
+++ b/src/main/java/au/com/royalpay/payment/manage/support/attachment/web/AttachmentController.java
@@ -0,0 +1,49 @@
+package au.com.royalpay.payment.manage.support.attachment.web;
+
+import au.com.royalpay.payment.manage.permission.manager.RequireManager;
+import au.com.royalpay.payment.manage.permission.manager.RequirePartner;
+import au.com.royalpay.payment.tools.connections.attachment.core.AttachmentClient;
+import com.alibaba.fastjson.JSONObject;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.multipart.MultipartFile;
+
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * 文件上传
+ * Created by yixian on 2016-05-05.
+ */
+@RestController
+@RequestMapping("/attachment")
+public class AttachmentController {
+    @Resource
+    private AttachmentClient attachmentClient;
+
+    @RequestMapping(value = "/files", method = RequestMethod.POST)
+    @RequirePartner
+    @RequireManager
+    public JSONObject uploadImage(@RequestParam MultipartFile file) throws IOException {
+        return attachmentClient.uploadFile(file,false);
+    }
+
+    @RequestMapping(value = "/secret_files", method = RequestMethod.POST)
+    @RequirePartner
+    @RequireManager
+    public JSONObject uploadFile(@RequestParam MultipartFile file) throws IOException {
+        return attachmentClient.uploadFile(file,true);
+    }
+
+    @RequestMapping(value = "/files/{fileId}", method = RequestMethod.GET)
+    public void getFileUrl(@PathVariable String fileId, HttpServletResponse response) throws IOException {
+        String url = attachmentClient.getFileUrl(fileId);
+        response.sendRedirect(url);
+    }
+
+    @RequestMapping(value = "/files/{fileId}/thumbnail",method = RequestMethod.GET)
+    public void getThumbnail(@PathVariable String fileId, HttpServletResponse response) throws IOException {
+        JSONObject thumbnail = attachmentClient.getThumbnail(fileId, 320);
+        response.sendRedirect(thumbnail.getString("url"));
+    }
+}