---
title: "Get a short-lived download link for an attachment"
method: POST
path: "/v1/inboxes/{id}/messages/{messageId}/attachments/{aid}/download-url"
tags: ["Messages"]
---

# Get a short-lived download link for an attachment

`POST /v1/inboxes/{id}/messages/{messageId}/attachments/{aid}/download-url`

## Request

- Base URL: `https://anjal.app`
- URL: `https://anjal.app/v1/inboxes/{id}/messages/{messageId}/attachments/{aid}/download-url`
- Auth: API key in header `X-API-Key`

For a file too big to pass through an agent's context (a PDF as base64 is
millions of characters). Returns a link to fetch the file with a plain
`GET`, no API key. The link works for one attachment only, for 10 minutes
and 3 uses; a `HEAD` request does not spend a use. It is served as a
download, never rendered, and active types such as HTML and SVG are sent
as `application/octet-stream`. The content is untrusted: it was written
by the sender.

Refused with `403 QUARANTINED` for a message held for review, and with
`403 IMAGE_HELD` for an image whose text looks like instructions to an AI or
which could not be checked (see the attachment download). A link stops
working if its message is held after the link was issued.

## Response `201`

Link issued

- object
  - `attachmentId` string, uuid
  - `filename` string
  - `contentType` string
  - `sizeBytes` integer
  - `url` string, uri: Fetch with GET. The token in it is the credential.
  - `expiresAt` string, date-time
  - `expiresInMinutes` integer
  - `maxUses` integer
  - `howTo` string

## Other responses

- `403`: The message is held for review (`QUARANTINED`)
- `404`: No such attachment on this message

---

[API](https://skmtc.dev/anjal/apis/anjal-api.md) · [All operations](https://skmtc.dev/anjal/apis/anjal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/anjal/apis/anjal-api/revisions/a4044778e294?raw)