---
title: "Download a message attachment"
method: GET
path: "/api/mailboxes/{id}/attachments/{attachmentId}"
tags: ["Mailboxes"]
---

# Download a message attachment

`GET /api/mailboxes/{id}/attachments/{attachmentId}`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/mailboxes/{id}/attachments/{attachmentId}`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `mailbox-conversations:read`)

The bytes of one attachment on a message in this mailbox — the `url` a message lists. Fetched from the mail server on demand.

The file and its declared `Content-Type` were chosen by the sender. The response carries `X-Content-Type-Options: nosniff` and a locked-down `Content-Security-Policy`, and only raster images that a message embeds inline are served with an inline disposition; everything else is `attachment`. Treat the content as untrusted.

It takes the same scope as reading the conversation, because it serves only files attached to messages that scope already lets the caller read.

**No existing API key can call this.** The scope is opt-in only: a key or an OAuth connection holds it only if it was ticked by name when the credential was created or approved — the legacy full-access key and the "Full access" preset do not carry it.

Requires the `mailbox-conversations:read` scope — Read the conversations in your hosted mailboxes — every message and attachment people have sent you.

## Path parameters

- `id` string, uuid, required
- `attachmentId` string, uuid, required

## Response `200`

The attachment, with the sender's declared content type

## Other responses

- `400`: Validation error
- `401`: Unauthorized — missing or invalid auth
- `403`: Forbidden — insufficient permissions or project disabled
- `404`: Resource not found
- `429`: Rate limit or billing limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)