Extract attachment text as text/plain; charset=utf-8 with Content-Disposition attachment. The filename drops quotes, CR, LF, other control characters, and path separators. A non-ASCII name also sets filename* (RFC 5987 UTF-8). Responses set X-Content-Type-Options: nosniff, Content-Security-Policy: default-src 'none'; sandbox; frame-ancestors 'none', X-Frame-Options: DENY, and Referrer-Policy: no-referrer. Cache-Control is private. There is no Cross-Origin-Resource-Policy header. Supports text, JSON, CSV, PDF text, DOCX, XLSX, and XLS. Input cap 10 MB. Inflated bytes past 50 MB, a lying central directory that hides that expansion, or a spreadsheet that declares more than 10,000 rows by 256 columns is HTTP 400 attachment_too_large. A zip is checked even when the declared type is the legacy spreadsheet type. A file that cannot be read is HTTP 400 text_extraction_failed. Extraction stops after 10 seconds. Output cap 200,000 characters (x-cooper-text-truncated: 1). An image-only PDF is HTTP 200 with an empty body and x-cooper-text-empty: 1. Unsupported types are HTTP 415 text_extraction_unsupported. Successful and failed extractions are cached. A held message returns HTTP 409 message_held until release. Another account's attachment is 404.