---
title: "Download Chat Attachment"
method: GET
path: "/api/v1/chats/attachments/{key}"
tags: ["chats"]
---

# Download Chat Attachment

`GET /api/v1/chats/attachments/{key}`

Stream a chat attachment by storage key.

Authz model: the signed ``token`` is the capability. Possession of a
valid token grants read access for the token's TTL (7 days by default,
matching the prior S3 presigned-URL behavior). The upload endpoint is
still JWT-protected, so only authed users can ever obtain a valid
token. ``<img src>`` cannot send Authorization headers, so the JWT
trust model doesn't work here — signed URLs do.

## Path parameters

- `key` string, required

## Query parameters

- `token` string, required — HMAC-signed token returned by /attachments upload.

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/netter/apis/dmi-backend.md) · [All operations](https://skmtc.net/netter/apis/dmi-backend/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netter/dmi-backend/versions/a59877bf911b/schema)