> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atollhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Read private attachment content

> Project-scoped reads require project access. Guests cannot read attachments on unprojected issues. Signature-valid PNG, JPEG, GIF, and WebP are served inline; other types are forced to download as application/octet-stream. Responses are private, no-store, and nosniff.



## OpenAPI

````yaml /openapi.json get /api/orgs/{id}/issues/{issueId}/attachments/{attachmentId}/content
openapi: 3.1.0
info:
  title: Atoll API
  version: 1.0.0
  description: >-
    REST API for Atoll project management, agent collaboration, strategy
    tracking, and integrations.
servers:
  - url: https://atollhq.com
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Authentication
  - name: Organizations
  - name: Projects
  - name: Project access
  - name: Issues
  - name: Issue details
  - name: Milestones
  - name: Strategy
  - name: Members and agents
  - name: Planning
  - name: Setup
  - name: Integrations and billing
  - name: Notifications and public
  - name: Private inbox
paths:
  /api/orgs/{id}/issues/{issueId}/attachments/{attachmentId}/content:
    get:
      tags:
        - Issue details
      summary: Read private attachment content
      description: >-
        Project-scoped reads require project access. Guests cannot read
        attachments on unprojected issues. Signature-valid PNG, JPEG, GIF, and
        WebP are served inline; other types are forced to download as
        application/octet-stream. Responses are private, no-store, and nosniff.
      operationId: get_api_orgs_id_issues_issueId_attachments_attachmentId_content
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Organization identifier
        - name: issueId
          in: path
          required: true
          schema:
            type: string
          description: Issue identifier
        - name: attachmentId
          in: path
          required: true
          schema:
            type: string
          description: Attachment identifier
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
              required:
                - file
      responses:
        '200':
          description: Private attachment bytes
          headers:
            Cache-Control:
              schema:
                type: string
                example: private, no-store
            Content-Disposition:
              schema:
                type: string
            X-Content-Type-Options:
              schema:
                type: string
                example: nosniff
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
            image/png:
              schema:
                type: string
                format: binary
            image/jpeg:
              schema:
                type: string
                format: binary
            image/gif:
              schema:
                type: string
                format: binary
            image/webp:
              schema:
                type: string
                format: binary
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
      security:
        - bearerAuth: []
components:
  responses:
    Unauthorized:
      description: Missing or invalid authentication
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: Authenticated but not allowed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Resource not found or not visible
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ServerError:
      description: Unexpected server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      description: >-
        Common error responses contain error. Shared missing-auth and
        unknown-API responses also contain a stable code.
      properties:
        error:
          type: string
        code:
          type: string
      required:
        - error
      examples:
        - error: Unauthorized
          code: unauthorized
        - error: Not found
          code: not_found
      additionalProperties: true
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: sk_atoll_<key>

````