Summary
Download attachment bytes that belong to a message in this thread. Response headers match the message attachment route: inline only for image/png, image/jpeg, image/gif, image/webp, image/avif, audio/*, and video/* when the stored disposition is inline; every other type is attachment; html, xhtml, svg, xml, and javascript are application/octet-stream while message JSON still reports the stored content_type; ?download=1 forces attachment. Filenames drop quotes, CR, LF, other control characters, and path separators, and a non-ASCII name sets filename* (RFC 5987 UTF-8). Responses set X-Content-Type-Options: nosniff, Content-Security-Policy: default-src 'none'; sandbox; frame-ancestors 'none', X-Frame-Options: DENY, and Referrer-Policy: no-referrer. Cache-Control is private. There is no Cross-Origin-Resource-Policy header. Unknown thread returns thread_not_found. An attachment outside the thread returns attachment_not_found.
Request
This call has no JSON body.
Response
The OpenAPI document does not declare a JSON response schema for this call. The summary is the contract.Errors
The summary and the OpenAPI operation do not name an error code.
Idempotency
This route does not document Idempotency-Key or client_id.