---
title: "Read Attachment"
method: GET
path: "/v1/teams/{team_id}/attachments/{name}"
tags: ["attachments"]
---

# Read Attachment

`GET /v1/teams/{team_id}/attachments/{name}`

## Request

- Base URL: `https://api.stormy.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stormy.ai/v1/teams/{team_id}/attachments/{name}`
- Auth: none declared

Hand the same picture back, so the person can SEE what they sent.

THE PATH IS FOR THE AGENT AND THIS IS FOR THE EYE, and conflating them is
what made an attached photograph invisible: the bubble was drawing
`<img src="/tmp/stormy-inbox/…">`, which is a real place on a computer in
another datacentre and nothing a browser can fetch. A chat that swallows
the picture you just sent is not a chat, so the inbox reads as well as it
writes.

IT IS NOT AN ARTIFACT AND STILL DOES NOT WANT A URL OF ITS OWN. This is a
plain authenticated read of a scratch file — the browser reaches it through
the same session-backed forward every other harness call uses, so no signed
link, no custody record and no public object outlive the conversation.

THE NAME IS THE WHOLE KEY, and it is one WE minted (`_safe_name` plus eight
random hex). Anything that does not survive that same cleaning unchanged is
refused rather than repaired, which makes traversal unrepresentable instead
of merely unlikely.

## Path parameters

- `team_id` string, uuid, required
- `name` string, required

## Headers

- `authorization` string, nullable
- `x-darwin-token` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/stormy/apis/stormy-control-plane.md) · [All operations](https://skmtc.dev/stormy/apis/stormy-control-plane/llms.txt) · [OpenAPI document](https://skmtc.dev/stormy/apis/stormy-control-plane/revisions/a4e2c287253f?raw)