> ## Documentation Index
> Fetch the complete documentation index at: https://www.papers.bot/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Download a private untrusted attachment

> Requires inboxes:read for email or sms:read for MMS. Returns application/octet-stream as an attachment. Requires authorization on every request. Returns 409 while storage is pending and 503 if storage is unavailable.



## OpenAPI

````yaml /openapi.json get /attachments/{id}/download
openapi: 3.1.0
info:
  title: Papers API
  version: 0.1.0
  description: >-
    Email, SMS, and workspace resources for Papers. Authenticate resource
    requests with a scoped API key or OAuth token. Administrative endpoints
    require a human session.
servers:
  - url: https://www.papers.bot/v1
security:
  - bearerAuth: []
paths:
  /attachments/{id}/download:
    get:
      tags:
        - Attachments
      summary: Download a private untrusted attachment
      description: >-
        Requires inboxes:read for email or sms:read for MMS. Returns
        application/octet-stream as an attachment. Requires authorization on
        every request. Returns 409 while storage is pending and 503 if storage
        is unavailable.
      operationId: downloadAttachment
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Private attachment bytes; treat as untrusted content
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '429':
          description: >-
            Request rate limit or communication quota exceeded. Rate-limit
            responses include Retry-After.
          headers:
            Retry-After:
              description: >-
                Seconds until the request-rate window resets (rate_limited
                errors)
              schema:
                type: integer
                minimum: 1
                maximum: 60
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: Request rejected
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Error:
      $schema: https://json-schema.org/draft/2020-12/schema
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            request_id:
              type: string
            retryable:
              type: boolean
            details:
              anyOf:
                - type: object
                  properties:
                    approvalId:
                      type: string
                      minLength: 1
                  required:
                    - approvalId
                  additionalProperties: false
                - type: array
                  items:
                    type: object
                    properties:
                      code:
                        type: string
                      path:
                        type: array
                        items:
                          type:
                            - string
                            - number
                      message:
                        type: string
                    required:
                      - code
                      - path
                      - message
                    additionalProperties: false
          required:
            - code
            - message
            - request_id
            - retryable
          additionalProperties: false
      required:
        - error
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Workspace API key or delegated OAuth access token with /v1 resource
        audience. Administrative routes require the Better Auth browser session
        instead.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.