# GET /api/v1/inboxes/:id/threads/:threadId/attachments/:attId

Auth: Bearer

HTML: https://cooperemail.com/docs/reference/thread-attachment

## Summary

Download attachment bytes that belong to a message in this thread. Response headers match the message attachment route: inline only for image/png, image/jpeg, image/gif, image/webp, image/avif, audio/*, and video/* when the stored disposition is inline; every other type is attachment; html, xhtml, svg, xml, and javascript are application/octet-stream while message JSON still reports the stored content_type; ?download=1 forces attachment. Filenames drop quotes, CR, LF, other control characters, and path separators, and a non-ASCII name sets filename* (RFC 5987 UTF-8). Responses set X-Content-Type-Options: nosniff, Content-Security-Policy: default-src 'none'; sandbox; frame-ancestors 'none', X-Frame-Options: DENY, and Referrer-Policy: no-referrer. Cache-Control is private. There is no Cross-Origin-Resource-Policy header. Unknown thread returns thread_not_found. An attachment outside the thread returns attachment_not_found.

## Request

This call has no JSON body.

## Response

The OpenAPI document does not declare a JSON response schema for this call. The summary is the contract.

## Errors

The summary and the OpenAPI operation do not name an error code.

## Idempotency

This route does not document Idempotency-Key or client_id.