---
title: "Download an attachment"
canonical: "https://bird.com/docs/api/reference/get-amb-attachment-content"
---

# Download an attachment

`GET /v1/amb/attachments/{attachment_id}/content`

Downloads an attachment by its `aat_` ID and returns its decrypted
bytes with the media type the attachment declares. Bird checks the
bytes only for a declared PNG, JPEG, GIF or WebP type: a declared
raster type the bytes do not match returns
`application/octet-stream`. Any other declared type is returned as
declared, without a check that the bytes match it. A missing or
malformed type returns `application/octet-stream`. The
`Content-Disposition` header carries the original filename.

Bird serves a received attachment from its own copy when it has one,
including after `expires_at`; otherwise it downloads the attachment
from Apple. An unknown ID returns `404`. An attachment past
`expires_at` that Apple confirms it no longer holds returns `410`;
any other failure to download from Apple returns `503`, and the
request can be retried.

## Servers

- `https://{region}.platform.bird.com`: Regional API endpoint. Use the host for the region your organization is hosted in. Official Bird SDKs and the CLI select it automatically from your API key, so you rarely need to set it by hand.
  - `region`: `us1`, `eu1`. Default: `us1`. The region your organization's data is hosted in.
- `https://platform.bird.com`: Region-independent endpoint for authentication and account administration.
- `http://localhost:8080`: Local development.

## Authentication

Use one authentication option:

- `BearerAuth`: HTTP bearer authentication. Pass the API key as a bearer token in the `Authorization` header. Workspace
keys use `bk_{region}_*`; organization master keys use `bm_{region}_*`.
The prefix identifies the region and selects the
API endpoint. Official Bird SDKs and the CLI derive the region from the key.

- `CookieAuth`: Send `bird_session` in cookie. Session cookie set after signing in to the Bird dashboard. The cookie
value is an opaque session token; no session data is stored in the cookie
itself.

## Code samples

**CLI**

```sh
bird amb attachments download <attachment-id>
```

Examples: [CLI](/docs/api/reference/get-amb-attachment-content.cli.md) · [MCP](/docs/api/reference/get-amb-attachment-content.mcp.md) · [cURL](/docs/api/reference/get-amb-attachment-content.curl.md)

## Path parameters

- `attachment_id` (string, required): Attachment identifier. Starts with `aat_`.

## Header parameters

- `X-Workspace-Id` (string, optional): Workspace context for the request. Required for dashboard authentication and master keys. Workspace keys and access tokens already identify their workspace; send that workspace or omit the header. A different one is rejected.
- `X-Organization-Id` (string, optional): Organization context for the request. Required for dashboard authentication. An API key or access token carries its own organization, so send either that organization or no header at all; a different one is rejected.

## Related resources

- [Should I use a Bird SDK or call the API directly?](/explained/platform/should-i-use-an-sdk-or-call-the-api-directly) (answer)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first email](/docs/get-started/send-your-first-email) (docs)

[Get an implementation brief](/learn/workspace?topic=api-basics)