---
title: "Download an attachment"
method: GET
path: "/v1/messages/received/{id}/attachments/{attachment_id}"
tags: ["Inbound"]
---

# Download an attachment

`GET /v1/messages/received/{id}/attachments/{attachment_id}`

## Request

- Base URL: `https://api.mails.ai`
- URL: `https://api.mails.ai/v1/messages/received/{id}/attachments/{attachment_id}`
- Auth: HTTP bearer

**Requires scope:** `read`. The file's bytes, always as a download (`Content-Disposition: attachment`) with `X-Content-Type-Options: nosniff`. `Content-Type` is the declared type when it is on a safe list, else `application/octet-stream`; HTML and SVG are never served as themselves. `?inline=1` asks for `inline` display, granted only for PNG, JPEG, GIF, WebP, AVIF and BMP images.

## Path parameters

- `id` string, required
- `attachment_id` string, required

## Query parameters

- `inline` '1'

## Response `200`

The file.

## Other responses

- `400`: Invalid request — malformed JSON or a field failed validation. Also `feature_not_enabled` when this server has a feature switched off (custom domains before they are available).
- `401`: Missing or invalid API key.
- `403`: The API key lacks the required scope (`insufficient_scope`), or the token belongs to an app connected by sign-in and this operation is closed to connected apps (`connected_app_not_allowed`).
- `404`: Resource not found in this workspace, or the agent a send names is archived (`agent_archived`).
- `500`: Internal server error.

---

[API](https://skmtc.dev/mails/apis/mails-ai-api.md) · [All operations](https://skmtc.dev/mails/apis/mails-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mails/apis/mails-ai-api/revisions/4d4930a8c33b?raw)