> ## Documentation Index
> Fetch the complete documentation index at: https://scorecard-d65b5e8a-docs-attachment-api-reference.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# List Session Attachments

> Lists the uploaded attachments for a session. Only committed attachments are returned.



## OpenAPI

````yaml get /sessions/{sessionId}/attachments
openapi: 3.1.0
info:
  title: Scorecard API
  description: REST API for Scorecard
  version: 1.0.0
servers:
  - url: https://api2.scorecard.io/api/v2
security:
  - ApiKeyAuth: []
paths:
  /sessions/{sessionId}/attachments:
    get:
      summary: List Session Attachments
      description: >-
        Lists the uploaded attachments for a session. Only committed attachments
        are returned.
      operationId: listSessionAttachments
      parameters:
        - in: path
          name: sessionId
          description: The session ID to list attachments for.
          schema:
            type: string
            minLength: 1
            maxLength: 256
            example: c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7
          required: true
        - in: query
          name: limit
          description: >-
            Maximum number of items to return (1-100). Use with `cursor` for
            pagination through large sets.
          schema:
            type: integer
            exclusiveMinimum: 0
            default: 20
            example: 20
        - in: query
          name: cursor
          description: >-
            Cursor for pagination. Pass the `nextCursor` from the previous
            response to get the next page of results.
          schema:
            type: string
            example: eyJvZmZzZXQiOjAsInBhZ2VJZCI6ImNvZGUifQ
      responses:
        '200':
          description: The session's attachments.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Attachment'
                  nextCursor:
                    type:
                      - string
                      - 'null'
                  hasMore:
                    type: boolean
                  total:
                    type: integer
                    minimum: 0
                required:
                  - data
                  - nextCursor
                  - hasMore
              examples:
                Session attachments:
                  value:
                    data:
                      - id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
                        sessionId: c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7
                        filePath: /tmp/report.pdf
                        filename: report.pdf
                        contentType: application/pdf
                        sizeBytes: 482133
                        sha256: >-
                          9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
                        status: uploaded
                        uploadedAt: '2026-07-13T12:00:00.000Z'
                        metadata: null
                    nextCursor: null
                    hasMore: false
                  summary: Session attachments
                  description: >-
                    All files attached to the session, ready to download via the
                    get endpoint.
        '401':
          $ref: '#/components/responses/UnauthenticatedError'
        '500':
          $ref: '#/components/responses/ServiceError'
components:
  schemas:
    Attachment:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The ID of the Attachment.
          example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
        sessionId:
          type: string
          minLength: 1
          maxLength: 256
          description: >-
            The session ID the attachment belongs to. Matches the `session.id`
            emitted on OTel spans, which is how attachments are joined to traces
            and records.
          example: c59e5bd0-e5eb-4bf0-a08a-01f7e8f712c7
        filePath:
          type: string
          minLength: 1
          maxLength: 1024
          description: >-
            The logical file path of the attachment (e.g. the path the agent
            wrote on disk). Together with the session ID it identifies the
            attachment: re-uploading the same path in the same session updates
            the existing attachment in place.
          example: /tmp/report.pdf
        filename:
          type:
            - string
            - 'null'
          description: Display filename, if provided.
        contentType:
          type:
            - string
            - 'null'
          description: >-
            MIME type of the last committed content. Null until the first
            commit.
        sizeBytes:
          type:
            - integer
            - 'null'
          description: >-
            Size in bytes of the last committed content. Null until the first
            commit.
        sha256:
          type:
            - string
            - 'null'
          pattern: ^[0-9a-f]{64}$
          description: SHA-256 of the last committed content. Null until the first commit.
          example: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
        status:
          type: string
          enum:
            - pending
            - uploaded
          description: >-
            `uploaded` once a commit has succeeded; `pending` while an initiated
            upload has not been committed yet.
        uploadedAt:
          type:
            - string
            - 'null'
          description: >-
            ISO 8601 timestamp of the last successful commit. Null until the
            first commit.
        metadata:
          type:
            - object
            - 'null'
          additionalProperties: true
          description: Arbitrary caller-supplied metadata.
          x-stainless-any: true
      required:
        - id
        - sessionId
        - filePath
        - filename
        - contentType
        - sizeBytes
        - sha256
        - status
        - uploadedAt
        - metadata
      description: >-
        A file attached to a session. Bytes live in object storage; this
        describes the last committed content.
    ApiError:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        details:
          type: object
          additionalProperties: true
          x-stainless-any: true
      required:
        - code
        - message
        - details
      description: An API error.
  responses:
    UnauthenticatedError:
      description: Error indicating that the request is not authenticated.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            Authentication failure:
              value:
                code: UNAUTHORIZED
                message: Invalid or missing authentication token
                details: {}
              summary: Authentication failure
              description: >-
                Error returned when authentication credentials are invalid or
                missing.
    ServiceError:
      description: >-
        An internal service error indicating an issue with the Scorecard
        service.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            Internal error:
              value:
                code: INTERNAL_ERROR
                message: An unexpected error occurred while processing your request.
                details: {}
              summary: Internal error
              description: Generic error when an unexpected internal issue occurs.
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: starts with ak_

````