> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senderkit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get an attachment

> Streams one attachment's bytes, extracted on demand from the raw MIME
(attachments are not stored separately). `index` matches the
`attachments[].index` on the message resource. Subject to the same
30-day retention as the raw message.




## OpenAPI

````yaml https://www.senderkit.com/openapi.yaml get /v1/inbound/messages/{publicId}/attachments/{index}
openapi: 3.1.0
info:
  title: SenderKit Public API
  version: 1.0.0
  description: >
    Public REST API for SenderKit — send transactional messages (email, SMS,

    push, web push), list message history, and read/render templates.


    ## Authentication

    All endpoints require a Bearer API key:

        Authorization: Bearer sk_live_xxx

    The `sk_live_` / `sk_test_` prefix selects the environment (live vs. test).

    The prefix is only a hint for humans; the secret is the full token. Keys are

    created in the dashboard and shown once at creation.


    ## Sends are asynchronous

    `POST /v1/send` enqueues the message and returns `202` with `status:
    "queued"`.

    Delivery happens out of band; poll `GET /v1/messages` to observe progress.


    ## Rate limits

    All endpoints are rate limited per API key. Sends and reads count against

    separate budgets, so listing messages never competes with sending them.

    A `429` response includes a `Retry-After` header (seconds).
servers:
  - url: https://api.senderkit.com
    description: Production
  - url: http://localhost:3000/api
    description: Local development
security:
  - apiKey: []
tags:
  - name: Context
    description: Inspect the workspace and environment an API key operates in.
  - name: Send
    description: Dispatch messages.
  - name: Messages
    description: Read message history and cancel pending sends.
  - name: Templates
    description: Read and render stored templates.
  - name: Inbound
    description: |
      Provision addresses on your workspace's shared receiving domain and read
      mail sent to them. Requires an API key with the `inbound` scope.
paths:
  /v1/inbound/messages/{publicId}/attachments/{index}:
    get:
      tags:
        - Inbound
      summary: Get an attachment
      description: |
        Streams one attachment's bytes, extracted on demand from the raw MIME
        (attachments are not stored separately). `index` matches the
        `attachments[].index` on the message resource. Subject to the same
        30-day retention as the raw message.
      operationId: getInboundMessageAttachment
      parameters:
        - $ref: '#/components/parameters/InboundMessageId'
        - name: index
          in: path
          required: true
          description: Zero-based index into the message's `attachments` array.
          schema:
            type: integer
            minimum: 0
      responses:
        '200':
          description: |
            The attachment's raw bytes, with the original `Content-Type` and a
            `Content-Disposition: attachment` header carrying the filename.
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: >-
            The API key is missing the required `inbound` scope
            (`insufficient_scope`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: |
            No received message with that id in this workspace, or no
            attachment at that index (`not_found`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '410':
          description: |
            The raw message is past its 30-day retention window and no longer
            stored (`raw_expired`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: >-
            The `index` path segment is not a non-negative integer
            (`invalid_index`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  parameters:
    InboundMessageId:
      name: publicId
      in: path
      required: true
      description: Public inbound message ID (e.g. `rcv_...`).
      schema:
        type: string
  responses:
    Unauthorized:
      description: Missing, malformed, invalid, or revoked API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              description: Stable machine-readable error code.
              example: invalid_request
            message:
              type: string
            issues:
              type: array
              description: Present on validation failures (Zod issues).
              items:
                type: object
                additionalProperties: true
            limit:
              type: integer
              description: Present on rate-limit errors.
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      description: API key with an `sk_live_` or `sk_test_` prefix.

````