Download an attachment
Streams one attachment from private storage after validating the authenticated account, parent message, attachment identifier, and 15-minute expiry. Filenames never select an R2 object and downloads are always forced as attachments. A 304 response is still charged.
Authorizations
Send a live API key in the Authorization header. Keys in query strings are rejected. A staging key never authenticates against production.
Headers
Return 304 when the current representation matches this entity tag.
Path Parameters
Opaque message identifier.
^msg_[A-Za-z0-9_-]{10,64}$"msg_7c2m9v4k8q"
Opaque attachment identifier; never an R2 object key or filename.
^att_[A-Za-z0-9_-]{10,64}$"att_6w3n8p2x9r"
Response
Attachment bytes.
The response is of type file.