---
title: "Get a received email's attachment"
method: GET
path: "/v1/email/inbound-messages/{inbound_message_id}/attachments/{attachment_id}"
tags: ["email-inbound-messages"]
---

# Get a received email's attachment

`GET /v1/email/inbound-messages/{inbound_message_id}/attachments/{attachment_id}`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/email/inbound-messages/{inbound_message_id}/attachments/{attachment_id}`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Returns the raw bytes of a single attachment on a received email, served as `application/octet-stream`. The attachment's declared MIME type and filename are in its metadata, from [List a received email's attachments](/docs/api/reference/list-inbound-message-attachments), which is also where you find the `attachment_id`. Returns `404` when the attachment is not part of the message or its stored bytes have expired. A received message, including its attachments, cannot exceed 20 MB.

## Headers

- `X-Workspace-Id` string
- `X-Organization-Id` string

## Response `200`

The raw attachment bytes.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/3e2a50466454?raw)