# List message attachments

> List the stored file attachments for an email message and get a short-lived signed downloadUrl for each. Works for both inbound emails (received via message.inbound) and outbound emails you sent with attachments. Messages without stored attachments (including SMS, WhatsApp, and other channels) return an empty list. Each downloadUrl is generated fresh per request and expires — fetch the file promptly and do not cache the URL.

`GET https://api.zavu.dev/v1/messages/{messageId}/attachments`

List the stored file attachments for an email message and get a short-lived signed `downloadUrl` for each. Works for both inbound emails (received via `message.inbound`) and outbound emails you sent with attachments. Messages without stored attachments (including SMS, WhatsApp, and other channels) return an empty list. Each `downloadUrl` is generated fresh per request and expires — fetch the file promptly and do not cache the URL.

## Parameters

- `messageId` (path, string, required)

## Responses

### 200

List of attachments.

- `items` (object[], required)
  - `id` (string, required)
  - `filename` (string, required)
  - `mimeType` (string, required): MIME type of the attachment.
  - `size` (integer, required): Size of the attachment in bytes.
  - `contentId` (string, required, nullable): Content-ID for inline attachments (referenced in the HTML body as `cid:<contentId>`). Null for regular attachments.
  - `isInline` (boolean, required): Whether the attachment is inline (embedded in the HTML body) rather than a regular attachment.
  - `downloadUrl` (string<uri>, required, nullable): Short-lived signed URL to download the attachment bytes. Freshly generated on each request and expires; do not cache it. Null if the stored file is no longer available.
  - `createdAt` (string<date-time>, required)

### 401

Unauthorized.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

### 404

Message not found.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

## Example

```bash
curl -X GET "https://api.zavu.dev/v1/messages/message_abc123/attachments" \
  -H "Authorization: Bearer $ZAVUDEV_API_KEY"
```

```typescript
import Zavudev from "@zavudev/sdk";

const zavu = new Zavudev({ apiKey: process.env.ZAVUDEV_API_KEY });

const result = await zavu.messages.listAttachments("message_abc123");

console.log(result);
```