> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drin.run/llms.txt
> Use this file to discover all available pages before exploring further.

# List attachments

> GET /v1/emails/{id}/attachments — list a message's attachment metadata.

List the attachment metadata for a message. The bytes are never inlined — download each file with an authenticated GET on its url.

**`GET /v1/emails/{id}/attachments`**

Works for both directions: for an `inbound` message the attachments are parsed from the received MIME; for an `outbound` message they're the files you sent. Each entry includes a `url` you fetch with your bearer token to stream the bytes.

## Path parameters

<ParamField body="id" type="string" required>
  The message id.
</ParamField>

## Request

<CodeGroup>
  ```bash cURL theme={null}
  # List metadata
  curl https://api.drin.run/v1/emails/msg_01HZX9K3T2QF7P0M4N8B6C5D/attachments \
    -H "Authorization: Bearer $DRIN_API_KEY"

  # Download the bytes — authenticate the GET on each url
  curl -L -o invoice.pdf \
    "https://api.drin.run/v1/emails/msg_01HZX9K3T2QF7P0M4N8B6C5D/attachments/att_01HZX7" \
    -H "Authorization: Bearer $DRIN_API_KEY"
  ```

  ```typescript Node.js theme={null}
  import { DrinClient } from "@drin00/sdk";

  const drin = new DrinClient({ apiKey: process.env.DRIN_API_KEY });

  const attachments = await drin.emails.listAttachments(
    "msg_01HZX9K3T2QF7P0M4N8B6C5D",
  );

  // Download the bytes with your bearer token
  for (const a of attachments) {
    const res = await fetch(a.url, {
      headers: { Authorization: `Bearer ${process.env.DRIN_API_KEY}` },
    });
    const bytes = Buffer.from(await res.arrayBuffer());
    // …write bytes to disk / object storage…
  }
  ```
</CodeGroup>

## Response

`200 OK` — a `data` array of attachment metadata. The array is empty when the message has no attachments.

```json 200 OK theme={null}
{
  "data": [
    {
      "id": "att_01HZX7M9P2",
      "filename": "invoice.pdf",
      "contentType": "application/pdf",
      "size": 48213,
      "url": "https://api.drin.run/v1/emails/msg_01HZX9K3T2QF7P0M4N8B6C5D/attachments/att_01HZX7M9P2"
    }
  ]
}
```

### Fields

<ResponseField name="id" type="string">
  The attachment identifier.
</ResponseField>

<ResponseField name="filename" type="string">
  The file name.
</ResponseField>

<ResponseField name="contentType" type="string">
  The MIME type, e.g. `application/pdf`.
</ResponseField>

<ResponseField name="size" type="integer">
  The size in bytes.
</ResponseField>

<ResponseField name="url" type="string">
  The authenticated download URL. GET it with your `Authorization: Bearer` header to stream the bytes.
</ResponseField>

<Warning>
  **The url needs your key.** The download `url` isn't a public link — it requires the same `Authorization: Bearer` header as every other request. Don't hand it to a browser or embed it where the key would leak.
</Warning>