Download attachment

Downloads the binary content of a transaction attachment. Attachment IDs are returned in each transaction’s attachments array in the card statement response.

Supported formats:

image/png — screenshots, photos
image/jpeg — photos, scanned receipts
application/pdf — invoices, documents

Attachments uploaded as spreadsheets or financial exchange files (XLS, XLSX, ODF, OFX — see CreateAttachmentFileInput.contentType) can also be downloaded; the response Content-Type reflects the original file format.

Download behavior is the same regardless of the attachment's status (PROCESSING or AVAILABLE).

See also: Best practices — Attachments for download examples.

curl -X GET "https://api-sandbox.contasimples.com/attachments/v1/content/example_string" \
  -H "Content-Type: application/json" \
  -H "Signature-Input: example_string" \
  -H "Signature: example_string" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

import requests
import json

url = "https://api-sandbox.contasimples.com/attachments/v1/content/example_string"
headers = {
  "Content-Type": "application/json",
  "Signature-Input": "example_string",
  "Signature": "example_string",
  "Authorization": "Bearer YOUR_API_TOKEN"
}

response = requests.get(url, headers=headers)
print(response.json())

const response = await fetch("https://api-sandbox.contasimples.com/attachments/v1/content/example_string", {
  method: "GET",
  headers: {
  "Content-Type": "application/json",
  "Signature-Input": "example_string",
  "Signature": "example_string",
  "Authorization": "Bearer YOUR_API_TOKEN"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("GET", "https://api-sandbox.contasimples.com/attachments/v1/content/example_string", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Signature-Input", "example_string")
    req.Header.Set("Signature", "example_string")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api-sandbox.contasimples.com/attachments/v1/content/example_string')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Signature-Input'] = 'example_string'
request['Signature'] = 'example_string'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'

response = http.request(request)
puts response.body

{}

{
  "error": "Bad Request",
  "message": "The request contains invalid parameters or malformed data",
  "code": 400,
  "details": [
    {
      "field": "email",
      "message": "Invalid email format"
    }
  ]
}

GET

/attachments/v1/content/{attachmentId}

GET

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token

Bearer Tokenstring

Required

Bearer token from OAuth 2.0 client credentials. Format: Bearer TOKEN

path

attachmentIdstring

Required

Unique attachment ID, from the attachments array in the card statement response.

header

Signature-Inputstring

What was signed and the signature parameters, in the RFC 9421 format. A credential with a public key must send it on every call, reads included, or the request is refused with 401. The signature covers the @method, @path, and @query components, and also content-digest when there is a body. created and alg are required, and created is valid for 300 seconds. The full format, with examples, is in Request Signing.

header

Signaturestring

The signature of the base defined by RFC 9421, in base64, between : and under the same label used in Signature-Input, for example sig=:SGVsbG8gd29ybGQ=:. It always goes together with Signature-Input.