Download an attachment

GET 
/api/attachments/:attachmentId

Redirects (302) to a short-lived signed storage URL for the file. The underlying storage disk and path are NEVER exposed — the signed URL is the sole access path and expires after a few minutes. Authorized through the parent conversation's view ability; a cross-tenant attachment is invisible under RLS (404).

Request

Responses

302

Redirect to the short-lived signed download URL.

Response Headers

Location

The signed, expiring storage URL.

401

Not authenticated. code: account_disabled means the member's seat was deactivated in this workspace: the session is over even though the token was not revoked (clients sign out and clean up).

403

Authenticated but not allowed.

404

Resource not found (or not visible to the current tenant).