# Get a message attachment

> One file on a support request message (`GET /api/support/tickets/{issueId}/messages/{messageId}/attachments/{index}`).

Source: https://docs.vigilbase.com/one/api/reference/support/get-support-tickets-issue-id-messages-message-id-attachments-index

`GET https://one.vigilbase.com/api/support/tickets/{issueId}/messages/{messageId}/attachments/{index}`

One file on a support request message (`GET /api/support/tickets/{issueId}/messages/{messageId}/attachments/{index}`). Same access as the thread: the issue must belong to the session's (or, for staff, the named) customer's Pylon account, and customers only reach files on customer-visible messages. The file is streamed from Pylon's file host; its signed link is never sent to the browser. Photos are served inline for previews; everything else, or any request with `?download=1`, downloads.

## Authorizations

Send one of these:

- `Authorization` (string, header, required): Bearer access token from Vigilbase Identity (`auth.vigilbase.com`), sent as `Authorization: Bearer <token>`. The CLI gets one with `vigilbase login`.
- `Authorization` (string, header, required): Organisation API key (`vb_one_…`) from **Settings → API keys** in Vigilbase One, sent as `Authorization: Bearer vb_one_…`. Read-only keys work. See [organisation API keys](https://docs.vigilbase.com/one/api#organisation-api-keys).
- Permissions checked: `support:access`

## Path parameters

- `issueId` (string, required)
- `messageId` (string, required)
- `index` (string, required)

## Query parameters

- `customerId` (string)
- `download` (string): One of `1`.

## Responses

### 200

Success

### 401

Authentication required

### 403

Not permitted

## Example request

```bash
# Token from `vigilbase login`, or an API key (vb_one_…)
curl --request GET \
  --url 'https://one.vigilbase.com/api/support/tickets/{issueId}/messages/{messageId}/attachments/{index}' \
  --header "Authorization: Bearer $VIGILBASE_TOKEN"
```