# GET /api/v1/inboxes/:id/messages/:msgId/attachments/:attId

Auth: Bearer

HTML: https://cooperemail.com/docs/reference/message-attachment

## Summary

Download attachment bytes. Content-Disposition is inline only when the stored disposition is inline and the content type is image/png, image/jpeg, image/gif, image/webp, image/avif, audio/*, or video/*. Every other type, including image/svg+xml, text/html, application/xhtml+xml, text/xml, application/xml, application/javascript, and unknown types, is attachment. text/html, application/xhtml+xml, image/svg+xml, text/xml, application/xml, application/javascript, and other html, xhtml, svg, xml, or javascript types are served as application/octet-stream. Message JSON still reports the stored content_type. ?download=1 forces attachment. The filename drops quotes, CR, LF, other control characters, and path separators. A non-ASCII name also sets filename* (RFC 5987 UTF-8). Responses set X-Content-Type-Options: nosniff, Content-Security-Policy: default-src 'none'; sandbox; frame-ancestors 'none', X-Frame-Options: DENY, and Referrer-Policy: no-referrer. Cache-Control is private. There is no Cross-Origin-Resource-Policy header. A held message returns HTTP 409 message_held until release.

## Request

```json
GET /api/v1/inboxes/inb_example/messages/msg_example/attachments/att_example
```

## Response

The OpenAPI document does not declare a JSON response schema for this call. The summary is the contract.

## Errors

- HTTP 409 message_held

The live `message` is the sentence for that code. Branch on `code`.

```json
{
  "error": {
    "type": "conflict",
    "code": "message_held",
    "docs_url": "https://cooperemail.com/docs#message_held"
  }
}
```

## Idempotency

This route does not document Idempotency-Key or client_id.