---
title: "List registration attachments"
method: GET
path: "/v1/compliance/attachments"
tags: ["attachments"]
---

# List registration attachments

`GET /v1/compliance/attachments`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/compliance/attachments`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Returns the registration attachments uploaded for the workspace, most recent first. Use this to offer a previously uploaded file for reuse on a new registration instead of uploading it again. Attachments that were never cited by a registration and have expired are not listed.

## Query parameters

- `sort` 'created_at': Field to sort registration attachments by.
- `order` 'asc' | 'desc': Sort direction, ascending or descending.
- `limit` integer
- `starting_after` string
- `ending_before` string
- `include_total` boolean

## Headers

- `X-Workspace-Id` string
- `X-Organization-Id` string

## Response `200`

A page of attachments.

- AttachmentList
  - `data` Attachment[], required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `id` string, required
    - `filename` string, required: The uploaded file's name.
    - `content_type` string, required: The file's content type, determined from its contents.
    - `size_bytes` integer, required: The file's size in bytes.
    - `description` string: A short note describing what the file shows.
    - `status` 'draft' | 'attached', required: Lifecycle of an attachment. `draft` is a file that has been uploaded but nothing has been registered or submitted with it yet, and it is discarded at its `expires_at`. `attached` means at least one registration has cited it, so it is kept permanently and can no longer be deleted.
    - `download_url` string, uri, required: Short-lived signed URL for downloading or previewing the attachment. Valid for 24 hours from when the resource was fetched; request a fresh resource to obtain a new URL after expiry. Do not cache beyond `download_url_expires_at`. Registration authorities (10DLC and toll-free carriers) retrieve evidence via a separate, longer-lived token; this URL is not that token.
    - `preview_url` string, uri: Optional signed URL for inline viewing on an isolated storage origin. Valid for one hour; fetch the attachment again to refresh it.
    - `download_url_expires_at` string, date-time, required: When `download_url` expires. Both fields are always present; the server returns an error rather than omitting them.
    - `expires_at` string, date-time, nullable, required: When this attachment is discarded if nothing is registered or submitted with it. Null once its status is `attached`.
  - `next_cursor` string, nullable, required: Cursor for the next page. Pass back as `starting_after` to advance forward. `null` when no next page exists.
  - `prev_cursor` string, nullable, required: Cursor for the previous page. Pass back as `ending_before` to step backward. `null` when no previous page exists.
  - `refresh_cursor` string, nullable, required: Refresh anchor, the first row of this response. Pass back as `ending_before` to fetch what precedes it in the current sort order. On a newest-first sort those are the items that have appeared since; on any other sort they are the items that sort earlier, so refreshing such a list means re-fetching it instead. Non-`null` whenever `data` is non-empty; `null` only on an empty page. Distinct from `prev_cursor`.
  - `total` integer, nullable: Total number of items matching the request's filters across all pages. Present only when `include_total=true` was passed; otherwise `null`.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error

## Changes

- **2026-10-20** `a1977645a499`: 1 info
  - endpoint added
- **2026-10-20** `6cec81ac4862`: 1 breaking
  - api path removed without deprecation
- **2026-10-20** `3e2a50466454`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/messagebird/apis/bird-api/changes/v1/compliance/attachments/get.md)

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/a1977645a499?raw)