---
title: "Download attachment bytes"
method: GET
path: "/attachments/{category}/{uuid}/{file_name}"
tags: ["Attachments"]
---

# Download attachment bytes

`GET /attachments/{category}/{uuid}/{file_name}`

## Request

- Base URL: `https://api.100hires.com/v2`
- URL: `https://api.100hires.com/v2/attachments/{category}/{uuid}/{file_name}`
- Auth: HTTP bearer

Streams the raw file bytes for an attachment identified by `category` + `uuid`.

The full URL is pre-built and returned in other API responses (resume, candidate files, application attachments, message attachments, call recordings). Clients should follow the URL as-is with the same `Authorization: Bearer` header used elsewhere.

Visibility rules: the attachment must belong to a company accessible by the authenticated API key (partner + clients, or the authenticated company itself). Shadowed candidates return 404.

The response sets `Content-Disposition: attachment; filename="..."` with the original filename (not the internal hashed name in the URL).

## Path parameters

- `category` 'application' | 'candidate' | 'candidate_comment' | 'call_recording' | 'company_favicon' | 'company_header' | 'company_link_preview' | 'email_template' | 'export_csv' | 'import_cv' | 'job_note' | 'job_preview' | 'mail_attachment' | 'qas' | 'system' | 'voicemail', required
- `uuid` string, uuid, required
- `file_name` string, required

## Response `200`

Raw file bytes.

## Other responses

- `401`: Unauthorized
- `404`: Not found
- `429`: Too many requests

---

[API](https://skmtc.dev/100hires/apis/100hires-api.md) · [All operations](https://skmtc.dev/100hires/apis/100hires-api/llms.txt) · [OpenAPI document](https://skmtc.dev/100hires/apis/100hires-api/revisions/e63e2d3115f7?raw)