> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qonto.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Retrieve an attachment
> OAuth scope: `attachment.read`
Retrieves the attachment identified by the `id` path parameter.
In the Qonto app, attachments are files uploaded onto transactions by users. Attachments typically correspond to the *invoice* or *receipt*, and are used to justify the transactions from a bookkeeping standpoint.
You can retrieve the IDs of those attachments inside each `transaction` object, by calling [GET /v2/transactions](/api-reference/business-api/transactions-statements/transactions/list-transactions).
Probative attachment is another version of attachment, compliant with [PAdES](https://en.wikipedia.org/wiki/PAdES) standard.
For security reasons, the `url` you retrieve for each attachment is **only valid for 30 minutes**. If you need to download the file after more than 30 minutes, you will need to perform another authenticated call in order to generate a new download URL.
If you download the file using `curl`, replace the `\\u0026` references by `&` in the `url` string.
## OpenAPI
````yaml get /v2/attachments/{id}
openapi: 3.1.1
info:
version: v2
title: Qonto
servers:
- url: https://thirdparty.qonto.com
description: Production URL
- url: https://thirdparty-sandbox.staging.qonto.co
description: Sandbox URL
security:
- OAuth:
- organization.read
- membership.read
- membership.write
- attachment.write
- internal_transfer.write
- payment.write
- supplier_invoice.write
- supplier_invoice.read
- client_invoices.read
- client_invoice.write
- client.read
- client.write
- product.read
- product.write
- request_review.write
- request_review.read
- team.read
- team.write
- request_transfers.write
- insurance_contract.read
- insurance_contract.write
- card.read
- card.write
- bank_account.write
- beneficiary.trust
- webhook
- payment_link.write
- payment_link.read
- sepa_direct_debit.read
- sepa_direct_debit.write
- terminal.read
- terminal.write
- SecretKey: []
paths:
/v2/attachments/{id}:
get:
tags:
- Attachments
summary: Retrieve an attachment
description: >
OAuth scope: `attachment.read`
Retrieves the attachment identified by the `id` path parameter.
In the Qonto app, attachments are files uploaded onto transactions by
users. Attachments typically correspond to the *invoice* or *receipt*,
and are used to justify the transactions from a bookkeeping standpoint.
You can retrieve the IDs of those attachments inside each `transaction`
object, by calling [GET
/v2/transactions](/api-reference/business-api/transactions-statements/transactions/list-transactions).
Probative attachment is another version of attachment, compliant with
[PAdES](https://en.wikipedia.org/wiki/PAdES) standard.
For security reasons, the `url` you retrieve for each attachment is **only valid for 30 minutes**. If you need to download the file after more than 30 minutes, you will need to perform another authenticated call in order to generate a new download URL.
If you download the file using `curl`, replace the `\\u0026` references by `&` in the `url` string.
operationId: get_attachment
parameters:
- $ref: '#/components/parameters/X-Qonto-Staging-Token'
- name: id
in: path
required: true
schema:
type: string
example: e72f6e43-0f27-4415-8781-ad648a89b47f
examples:
default:
value: e72f6e43-0f27-4415-8781-ad648a89b47f
responses:
'200':
description: Returns the attachment identified by the `id` path parameter.
content:
application/json:
schema:
type: object
properties:
attachment:
type: object
properties:
id:
type: string
created_at:
type: string
file_name:
type: string
file_size:
type: string
file_content_type:
type: string
url:
type: string
probative_attachment:
type: object
properties:
status:
type: string
file_name:
type: string
file_content_type:
type: string
file_size:
type: string
url:
type: string
examples:
default:
value:
attachment:
id: 71c32755-d0c3-4d82-9a78-774caa9d8556
created_at: '2021-03-23T14:21:51.000Z'
file_name: Foobar
file_size: '666'
file_content_type: image/png
url: https://my-s3.url.qonto.bucket.com/123456789
probative_attachment:
status: unavailable
file_name: statement.pdf
file_content_type: application/pdf
file_size: '666'
url: https://my-s3.url.qonto.bucket.com/123456789
'400':
$ref: '#/components/responses/400-Bad-request'
'401':
$ref: '#/components/responses/401-Unauthorized'
'403':
$ref: '#/components/responses/403-Forbidden'
'404':
$ref: '#/components/responses/404-Not-Found'
'500':
$ref: '#/components/responses/500-Internal-Server-Error'
security:
- OAuth:
- organization.read
- SecretKey: []
components:
parameters:
X-Qonto-Staging-Token:
name: X-Qonto-Staging-Token
in: header
description: >-
Required only for Sandbox API requests; to get one, please sign up to
the [Developer Portal](https://developers.qonto.com/).
schema:
type: string
responses:
400-Bad-request:
description: Returns a bad request error.
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestResponseBody'
examples:
Authorization field missing:
value:
errors:
- code: bad_request
detail: Authorization field missing
401-Unauthorized:
description: Returns an unauthorized error.
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedResponseBody'
examples:
authorization_header_missing:
value:
errors:
- code: authorization_header_missing
detail: authorization header missing
authorization_token_invalid:
value:
errors:
- code: authorization_token_invalid
detail: authorization token invalid
403-Forbidden:
description: Returns a forbidden error.
content:
application/json:
schema:
$ref: '#/components/schemas/ForbiddenResponseBody'
examples:
Insufficient permissions:
value:
errors:
- code: forbidden
detail: User does not have sufficient permissions for this action.
404-Not-Found:
description: Returns a not found error.
content:
application/json:
schema:
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/NotFoundError'
500-Internal-Server-Error:
description: Returns an internal server error.
schemas:
BadRequestResponseBody:
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/BadRequestError'
required:
- errors
UnauthorizedResponseBody:
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/UnauthorizedError'
required:
- errors
ForbiddenResponseBody:
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/ForbiddenError'
required:
- errors
NotFoundError:
type: object
properties:
code:
type: string
description: Error code.
detail:
type: string
description: Human readable error that explains error `code`.
source:
type: object
properties:
parameter:
type: string
description: The parameter that causes the error.
required:
- code
- detail
x-examples:
Object not found:
code: not_found
detail: Object not found
source:
parameter: id
BadRequestError:
type: object
properties:
code:
type: string
description: Error code.
detail:
type: string
description: Human readable error that explains error `code`.
source:
type: object
properties:
pointer:
type: string
description: >-
The property in the request body that caused the error
(optional).
parameter:
type: string
description: The query parameter that caused the error (optional).
required:
- code
- detail
x-examples:
Authorization field missing:
code: bad_request
detail: Authorization field missing
UnauthorizedError:
type: object
properties:
code:
type: string
description: Error code.
detail:
type: string
description: Human readable error that explains error `code`.
required:
- code
- detail
x-examples:
Invalid credentials:
code: unauthorized
detail: Invalid credentials
ForbiddenError:
type: object
properties:
code:
type: string
description: Error code.
detail:
type: string
description: Human readable error that explains error `code`.
required:
- code
- detail
x-examples:
Insufficient permissions:
code: forbidden
detail: User does not have sufficient permissions for this action.
securitySchemes:
OAuth:
type: oauth2
description: >
Bearer authorization header: `Bearer `, where `` is the
access token received from the authorization server at the end of the
[OAuth 2.0
flow](/get-started/business-api/authentication/oauth/oauth-flow).
flows:
authorizationCode:
refreshUrl: https://oauth.qonto.com/oauth2/token
authorizationUrl: https://oauth.qonto.com/oauth2/auth
scopes:
attachment.read: Retrieve attachments
attachment.write: Upload attachments and remove attachments from transactions
bank_account.write: Create, update and close bank accounts
beneficiary.trust: Trust SEPA beneficiaries
card.read: Retrieve cards
card.write: Create or update cards
client.read: Retrieve clients
client.write: Create clients
client_invoice.write: Create client invoices
client_invoices.read: Retrieve client invoices and credit notes
einvoicing.read: Retrieve e-invoicing settings
embed_auth_link.write: Create Embed auth links
insurance_contract.read: Retrieve insurance contracts
insurance_contract.write: Create and update insurance contracts
internal_transfer.write: >-
Create internal transfers (between 2 Qonto accounts of the same
organization)
international_transfer.write: Create international transfers
membership.read: Retrieve the authentified membership
membership.write: Invite team members
offline_access: Retrieve a refresh token
organization.read: >-
Retrieve organization, bank accounts, transactions, transfers,
beneficiaries, labels, memberships, requests & statements
payment.write: Create external transfers and untrust beneficiaries
payment_link.read: >-
Retrieve payment links, their payments, and the available payment
methods
payment_link.write: >-
Connect to the payment links provider, create and deactivate
payment links
product.read: Retrieve products
product.write: Create products
request_cards.write: Create card requests
request_review.write: Approve or decline requests
request_transfers.write: Create transfer requests
sepa_direct_debit.read: View SEPA Direct Debit payments
sepa_direct_debit.write: Manage SEPA Direct Debit payments
supplier_invoice.read: Retrieve supplier invoices
supplier_invoice.write: Create supplier invoices
team.read: Retrieve teams
team.write: Create teams
terminal.read: View your payment terminals
terminal.write: Configure your terminals and initiate payments
webhook: >-
Receive a notification each time a particular event occurs in
Qonto
tokenUrl: https://oauth.qonto.com/oauth2/token
SecretKey:
type: apiKey
description: cf. [API key](/get-started/business-api/authentication/api-key)
name: Authorization
in: header
````