Get a fresh signed URL for a private attachment
Returns an access-controlled download URL for one private attachment.
/api/conversations/{conversationId}/attachments/{id}/accessReturns an access-controlled download URL for one private attachment. Private operator Email attachments require active authorization at download time and have no transferable signed URL; other private attachments receive short-lived signed URLs. The returned expiresIn value is expressed in seconds.
Endpoint requirements
- Credentials
- Use either
Bearer API keyorX-API-Key header. - Required scope
conversations:read- Module
- Automation & API module (
api_access) - Organization and site scope
- Requests can access only resources owned by the authenticated organization. The API does not reveal whether an identifier belongs to another organization or site.
- Retry behavior
- Safe read: You can safely retry this read-only request after a transport failure. It does not change resource state.
Path Parameters
Resource identifier.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidResource identifier.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidHeader Parameters
DA-4035: selects the active site (project) for project-scoped operations. Accepts a site UUID, or the literal all to aggregate across every accessible site on read-only aggregate routes (single-or-all-read). Mutations and single-site routes reject all. Path-owned project routes (/api/projects/{projectId}/…) resolve the site from the URL and ignore this header. Conflicting selectors across header/query/body/path return PROJECT_CONTEXT_CONFLICT (400); an archived site returns PROJECT_ARCHIVED (410).
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
{ "url": "https://files.example.invalid/private/signed-download", "expiresIn": 900}Request examples
curl
curl --request GET \
'https://api.convor.io/api/conversations/22222222-2222-4222-8222-222222222222/attachments/11111111-1111-4111-8111-111111111111/access' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer convor_sk_...'JavaScript
const response = await fetch("https://api.convor.io/api/conversations/22222222-2222-4222-8222-222222222222/attachments/11111111-1111-4111-8111-111111111111/access", {
method: "GET",
headers: {
"Accept": "application/json",
"Authorization": "Bearer convor_sk_..."
},
});
const contentType = response.headers.get("content-type") ?? "";
const data = response.status === 204
? null
: contentType.includes("json")
? await response.json()
: contentType.startsWith("text/")
? await response.text()
: await response.blob();
if (!response.ok) {
const message = typeof data === "object" && data !== null
&& "error" in data && typeof data.error === "object"
&& data.error !== null && "message" in data.error
? String(data.error.message)
: "Convor API request failed (" + response.status + ")";
throw new Error(message);
}
console.log(data);Was this page helpful?