Get a private attachment and a fresh signed URL
Returns private attachment metadata and an access-controlled download URL.
/api/conversations/{conversationId}/attachments/{id}Returns private attachment metadata and an access-controlled download URL. Private operator Email attachments never expose transferable signed object URLs. The attachment must belong to the path conversation and authenticated organization. Visitor bearer callers can access only attachments in their own conversation. The signed URL is temporary and must not be treated as a stable public object URL.
Endpoint requirements
- Credentials
- Use either
Bearer API keyorX-API-Key header. - Required scope
conversations:read- Module
- Automation & API module (
api_access) - Organization and site scope
- Requests can access only resources owned by the authenticated organization. The API does not reveal whether an identifier belongs to another organization or site.
- Retry behavior
- Safe read: You can safely retry this read-only request after a transport failure. It does not change resource state.
Path Parameters
Resource identifier.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidResource identifier.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidHeader Parameters
DA-4035: selects the active site (project) for project-scoped operations. Accepts a site UUID, or the literal all to aggregate across every accessible site on read-only aggregate routes (single-or-all-read). Mutations and single-site routes reject all. Path-owned project routes (/api/projects/{projectId}/…) resolve the site from the URL and ignore this header. Conflicting selectors across header/query/body/path return PROJECT_CONTEXT_CONFLICT (400); an archived site returns PROJECT_ARCHIVED (410).
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
{ "id": "66666666-6666-4666-8666-666666666666", "attachmentId": "66666666-6666-4666-8666-666666666666", "filename": "invoice-2026.pdf", "originalName": "invoice-2026.pdf", "mimeType": "application/pdf", "size": 18432, "url": "https://files.example.invalid/private/signed-download"}Request examples
curl
curl --request GET \
'https://api.convor.io/api/conversations/22222222-2222-4222-8222-222222222222/attachments/11111111-1111-4111-8111-111111111111' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer convor_sk_...'JavaScript
const response = await fetch("https://api.convor.io/api/conversations/22222222-2222-4222-8222-222222222222/attachments/11111111-1111-4111-8111-111111111111", {
method: "GET",
headers: {
"Accept": "application/json",
"Authorization": "Bearer convor_sk_..."
},
});
const contentType = response.headers.get("content-type") ?? "";
const data = response.status === 204
? null
: contentType.includes("json")
? await response.json()
: contentType.startsWith("text/")
? await response.text()
: await response.blob();
if (!response.ok) {
const message = typeof data === "object" && data !== null
&& "error" in data && typeof data.error === "object"
&& data.error !== null && "message" in data.error
? String(data.error.message)
: "Convor API request failed (" + response.status + ")";
throw new Error(message);
}
console.log(data);Was this page helpful?