> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tempmaillab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Treat docs/openapi.yaml as the normative public API contract.
> Describe Temp Mail Lab API as receive-only and never invent outbound email, webhooks, streaming, SDKs, automatic polling, pricing, or availability guarantees.
> Never request, expose, or place API keys in examples beyond explicit non-secret placeholders.

# Attachments

> Download private attachment bytes using opaque identifiers.

Message details include attachment metadata:

* `id`: the opaque identifier used by the download path.
* `filename`: a sanitized display filename, never a storage key.
* `content_type`: sender-supplied MIME type after safe parsing.
* `size_bytes`: decoded attachment size.
* `expires_at`: the same short content deadline.
* `download_path`: an authenticated relative API path.

```bash theme={null}
curl --fail-with-body \
  --header "Authorization: Bearer $TML_API_KEY" \
  --output attachment.bin \
  "$TML_API_BASE/v1/messages/$MESSAGE_ID/attachments/$ATTACHMENT_ID"
```

The service validates the authenticated account, parent message, attachment identifier, and expiry before reading private storage. Downloads use `application/octet-stream`, `nosniff`, and a forced attachment disposition.

Current hard limits are 10 attachments per message, 5 MiB per attachment, and 8 MiB total decoded attachment data. These safety limits are separate from request allowance.

<Warning>
  A sanitized filename and declared content type do not make a file trustworthy.
  Scan or quarantine downloads when your risk model requires it.
</Warning>