---
title: "Download Shared Attachment"
method: GET
path: "/api/attachments/shared/{token}"
tags: ["attachments"]
---

# Download Shared Attachment

`GET /api/attachments/shared/{token}`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/attachments/shared/{token}`
- Auth: none declared

Serve one attachment or agent working file through a short-lived share link
(TOS-7678, TOS-7684).

Unauthenticated on purpose: the caller is a third-party tool (Higgsfield
``media_import_url``, curl in a sandbox) holding a URL an agent minted with
``attachment_url``. The random token is the whole credential, and
``resolve_share_link`` re-checks on every fetch that the minting agent can
still see the attachment in its chat. Unknown, expired and revoked links
all answer the same 404. Declared before ``/{attachment_id}`` so the
literal segment wins.

## Path parameters

- `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-20** `ce2c2ce318b1`: 1 info
  - api operation id `download_shared_attachment_api_attachments_shared__token__head` removed and replaced with `download_shared_attachment_api_attachments_shared__token__get`

[Operation history](https://skmtc.dev/thinqos/apis/thinqos-api/changes/api/attachments/shared/:token/get.md)

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/5387b4ded614?raw)