---
title: "Download a table attachment"
method: GET
path: "/v1/tables/{tableId}/attachments/{assetId}"
tags: ["Tables"]
---

# Download a table attachment

`GET /v1/tables/{tableId}/attachments/{assetId}`

## Request

- Base URL: `https://api.banksync.io`
- URL: `https://api.banksync.io/v1/tables/{tableId}/attachments/{assetId}`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Streams the file. Authenticated and workspace-scoped — an attachment is customer financial content, so there is no anonymous read path and a leaked asset id is not a capability. Always served as a download (`Content-Disposition: attachment`) with `X-Content-Type-Options: nosniff`, and any content type outside the allowlist is served as `application/octet-stream`.

## Path parameters

- `tableId` string, required: Table ID
- `assetId` string, required: Attachment ID

## Response `200`

The file, as a download

## Other responses

- `400`: Validation failed, or a read-only field was written — `code` names the refusal and `details[]` the offending field or cell
- `401`: Unauthorized
- `403`: Forbidden — missing scope, insufficient role, or plan limit reached
- `404`: Not found

---

[API](https://skmtc.dev/banksync/apis/banksync-api.md) · [All operations](https://skmtc.dev/banksync/apis/banksync-api/llms.txt) · [OpenAPI document](https://skmtc.dev/banksync/apis/banksync-api/revisions/94465f5ee922?raw)