Download an attachment

GEThttps://anjal.app/v1/inboxes/{id}/messages/{messageId}/attachments/{aid}

Streams the raw attachment bytes with the original Content-Type and Content-Disposition headers.

A PNG, JPEG, GIF or WebP is read for hidden instructions before an API key or agent is given it, because a model can look at an image the way it reads a body. If the text in it reads like instructions aimed at an AI, or it cannot be checked, this returns 403 IMAGE_HELD and a person can still open it in the dashboard. 503 IMAGE_HELD means it could not be checked right now and is worth retrying. A signed-in person in the dashboard is never held, and neither is an inbox or account that has turned mail protection off.

Path parameters

`id` required string	Inbox UUID
`messageId` required string	Message UUID
`aid` required string	Attachment UUID

Responses

200application/octet-streamAttachment bytes

string

403The image is held (`IMAGE_HELD`), or its message is quarantined (`QUARANTINED`)

503The image could not be checked right now (`IMAGE_HELD`); retry shortly

Authentication

Send your API key in the X-API-Key header (or Authorization: Bearer <key>). Any prefix accepted by this endpoint — tk_, wk_, ak_, or sa_ — is documented in the key prefix table.

Request

import { Anjal } from "anjal";

const client = new Anjal({ apiKey: process.env.MYAGENTMAIL_API_KEY! });

// GET /v1/inboxes/{id}/messages/{messageId}/attachments/{aid}
const result = await client.request("get", "/v1/inboxes/{id}/messages/{messageId}/attachments/{aid}", { params: { id: "00000000-0000-0000-0000-000000000000", messageId: "00000000-0000-0000-0000-000000000000", aid: "00000000-0000-0000-0000-000000000000" } });

Example response · 200

"string"