> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contactbutton.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Download a tenant-authorized private attachment



## OpenAPI

````yaml /openapi.yaml get /workspaces/{workspace}/inbox-attachments/{attachment}
openapi: 3.1.0
info:
  title: Contact Button API
  version: 1.0.0-alpha.1
  description: >
    API-first management and public agent actions for Contact Buttons and
    button.contact pages.

    API v1 is the first public contract. Existing private legacy API and browser
    workflows remain supported.
  contact:
    name: Contact Button
    url: https://learn.contactbutton.com
servers:
  - url: https://api.contactbutton.com/v1
    description: Production (canonical)
  - url: https://app.contactbutton.com/v1
    description: Backwards-compatible application-domain alias
security:
  - bearerAuth: []
tags:
  - name: Onboarding
    description: Human-verified agent onboarding.
  - name: Workspaces
  - name: Team
  - name: Pages
  - name: Domains
  - name: Buttons
  - name: Forms
  - name: Surveys
  - name: Apps
  - name: Knowledge
  - name: Booking
  - name: Telephony
    description: >-
      Bring-your-own-Telnyx setup, call flows, phone numbers, and voice
      interactions.
  - name: Reviews
    description: >-
      Send consented review requests through workspace-owned email, SMS, and
      WhatsApp channels.
  - name: Commerce
  - name: Engagement inbox
  - name: Public actions
    description: Public, rate-limited actions that may require human confirmation.
paths:
  /workspaces/{workspace}/inbox-attachments/{attachment}:
    get:
      tags:
        - Engagement inbox
      summary: Download a tenant-authorized private attachment
      operationId: downloadInboxAttachment
      parameters:
        - $ref: '#/components/parameters/WorkspaceId'
        - $ref: '#/components/parameters/InboxAttachmentId'
        - name: inline
          in: query
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Attachment content.
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
components:
  parameters:
    WorkspaceId:
      name: workspace
      in: path
      required: true
      schema:
        type: string
        format: uuid
    InboxAttachmentId:
      name: attachment
      in: path
      required: true
      schema:
        type: string
        format: uuid
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: Sanctum personal access token
      description: >
        A Contact Button scoped bearer key. Send `Authorization: Bearer
        <token>`.

        Token abilities are enforced independently of workspace membership; both
        checks must pass.

        OAuth 2.0 authorization-code flows are not currently available.
      x-contact-button-token-abilities:
        workspaces:read: Read workspaces, teams, domains, settings, and connections.
        workspaces:write: >-
          Create and manage workspaces, teams, domains, settings, and
          connections.
        content:read: Read buttons, forms, lists, pages, booking types, and knowledge.
        content:write: Create, update, publish, and remove content.
        engagements:read: >-
          Read submissions, subscribers, bookings, callbacks, calls, reviews,
          and conversations.
        engagements:manage: Reply to and manage engagement records.
        actions:request: Request protected actions that can still require human confirmation.

````

## Related topics

- [Upload a private inbox attachment](/api-reference/engagement-inbox/upload-a-private-inbox-attachment.md)
- [Read authorized call or voice-message audio](/api-reference/telephony/read-authorized-call-or-voice-message-audio.md)
- [Set up with a coding agent](/agents/coding-agents.md)
- [A2A agent framework](/agents/a2a.md)
- [Rollout and rollback](/guides/rollout.md)