> ## Documentation Index
> Fetch the complete documentation index at: https://scorecard-d65b5e8a-docs-attachment-api-reference.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Attachment

> Retrieves an attachment's metadata and a short-lived signed download URL for its content.



## OpenAPI

````yaml get /attachments/{attachmentId}
openapi: 3.1.0
info:
  title: Scorecard API
  description: REST API for Scorecard
  version: 1.0.0
servers:
  - url: https://api2.scorecard.io/api/v2
security:
  - ApiKeyAuth: []
paths:
  /attachments/{attachmentId}:
    get:
      summary: Get Attachment
      description: >-
        Retrieves an attachment's metadata and a short-lived signed download URL
        for its content.
      operationId: getAttachment
      parameters:
        - in: path
          name: attachmentId
          description: The ID of the Attachment.
          schema:
            type: string
            format: uuid
            example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
          required: true
      responses:
        '200':
          description: The attachment.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Attachment'
                properties:
                  downloadUrl:
                    type:
                      - string
                      - 'null'
                    description: >-
                      Short-lived signed URL to download the file. Null while
                      the attachment has no committed content.
                  downloadExpiresAt:
                    type:
                      - string
                      - 'null'
                    description: ISO 8601 expiry of `downloadUrl`.
                required:
                  - downloadUrl
                  - downloadExpiresAt
              examples:
                Attachment:
                  value:
                    id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
                    sessionId: c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7
                    filePath: /tmp/report.pdf
                    filename: report.pdf
                    contentType: application/pdf
                    sizeBytes: 482133
                    sha256: >-
                      9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
                    status: uploaded
                    uploadedAt: '2026-07-13T12:00:00.000Z'
                    metadata: null
                    downloadUrl: >-
                      https://storage.example.com/object/sign/attachments/development/org_123/session/3fa85f64?token=def
                    downloadExpiresAt: '2026-07-13T12:10:00.000Z'
                  summary: Attachment
                  description: An uploaded attachment with a signed download URL.
        '401':
          $ref: '#/components/responses/UnauthenticatedError'
        '500':
          $ref: '#/components/responses/ServiceError'
components:
  schemas:
    Attachment:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The ID of the Attachment.
          example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
        sessionId:
          type: string
          minLength: 1
          maxLength: 256
          description: >-
            The session ID the attachment belongs to. Matches the `session.id`
            emitted on OTel spans, which is how attachments are joined to traces
            and records.
          example: c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7
        filePath:
          type: string
          minLength: 1
          maxLength: 1024
          description: >-
            The logical file path of the attachment (e.g. the path the agent
            wrote on disk). Together with the session ID it identifies the
            attachment: re-uploading the same path in the same session updates
            the existing attachment in place.
          example: /tmp/report.pdf
        filename:
          type:
            - string
            - 'null'
          description: Display filename, if provided.
        contentType:
          type:
            - string
            - 'null'
          description: >-
            MIME type of the last committed content. Null until the first
            commit.
        sizeBytes:
          type:
            - integer
            - 'null'
          description: >-
            Size in bytes of the last committed content. Null until the first
            commit.
        sha256:
          type:
            - string
            - 'null'
          pattern: ^[0-9a-f]{64}$
          description: SHA-256 of the last committed content. Null until the first commit.
          example: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
        status:
          type: string
          enum:
            - pending
            - uploaded
          description: >-
            `uploaded` once a commit has succeeded; `pending` while an initiated
            upload has not been committed yet.
        uploadedAt:
          type:
            - string
            - 'null'
          description: >-
            ISO 8601 timestamp of the last successful commit. Null until the
            first commit.
        metadata:
          type:
            - object
            - 'null'
          additionalProperties: true
          description: Arbitrary caller-supplied metadata.
          x-stainless-any: true
      required:
        - id
        - sessionId
        - filePath
        - filename
        - contentType
        - sizeBytes
        - sha256
        - status
        - uploadedAt
        - metadata
      description: >-
        A file attached to a session. Bytes live in object storage; this
        describes the last committed content.
    ApiError:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        details:
          type: object
          additionalProperties: true
          x-stainless-any: true
      required:
        - code
        - message
        - details
      description: An API error.
  responses:
    UnauthenticatedError:
      description: Error indicating that the request is not authenticated.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            Authentication failure:
              value:
                code: UNAUTHORIZED
                message: Invalid or missing authentication token
                details: {}
              summary: Authentication failure
              description: >-
                Error returned when authentication credentials are invalid or
                missing.
    ServiceError:
      description: >-
        An internal service error indicating an issue with the Scorecard
        service.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            Internal error:
              value:
                code: INTERNAL_ERROR
                message: An unexpected error occurred while processing your request.
                details: {}
              summary: Internal error
              description: Generic error when an unexpected internal issue occurs.
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: starts with ak_

````