# Download an attachment of a message (/docs/api-reference/inboxes/get-inbox-message-attachment)

An inbound message's attachment, always as `application/octet-stream` (its declared type is the attachment's `content_type`): treat it as untrusted.

`GET https://api.coss.com/v1/inboxes/{inbox_id}/messages/{message_id}/attachments/{attachment_id}`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `inbox_id` (string, required): The inbox's id.
- `message_id` (string, required): The message's id.
- `attachment_id` (string, required): The attachment's id (from the message's `attachments`).

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.inboxes.messages.getAttachment("inbox_01k7c8m4q2f3e9v6t5r1n0p8yz", "imsg_01k7c8m4s1d3c9x0z4e6g7h8j9", "rcvdatt_01k7c8m4r0c2b8w9y3d5f6g7h8");
```

HTTP:

```sh
curl -X GET "https://api.coss.com/v1/inboxes/inbox_01k7c8m4q2f3e9v6t5r1n0p8yz/messages/imsg_01k7c8m4s1d3c9x0z4e6g7h8j9/attachments/rcvdatt_01k7c8m4r0c2b8w9y3d5f6g7h8" \
  -H "Authorization: Bearer $COSS_API_KEY"
```

## Response 200

The attachment.

Content type: application/octet-stream.

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: No such inbox, message or attachment in this environment (`not_found`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).