---
title: "Download Inbox Attachment"
method: GET
path: "/inbox/attachments/{token}"
tags: ["AI Inbox"]
---

# Download Inbox Attachment

`GET /inbox/attachments/{token}`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/inbox/attachments/{token}`
- Auth: HTTP bearer

Download a draft or internal-note attachment. Not enveloped: bytes are bytes.

The token only opens a file of THIS organisation: it is bound to the org
that uploaded it, and a token from anywhere else is a flat 404. Served
with `Content-Disposition: attachment` and `nosniff`, never inline.

## Path parameters

- `token` string, required: The `token` returned by `POST /inbox/drafts/attachments` or `POST /inbox/notes/attachments`.

## Headers

- `Authorization` string, nullable
- `X-Target-Org-Id` string, nullable

## Response `200`

The file's bytes.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/89fc11143b70?raw)