> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.helpyousponsor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List attachments on an email activity

> Returns the file attachments parsed from an inbound email Activity, each with an unsigned public S3 download URL. Errors generating individual download URLs are logged but do not fail the request — the affected attachment will be returned without a `download_url`.



## OpenAPI

````yaml get /activities/{id}/attachments
openapi: 3.0.0
info:
  title: Gratona API
  description: >-
    REST API for the Gratona fundraising platform, including donor, donation,
    sponsorship, program, event, and integration workflows. Endpoints are
    organized by tag. Most endpoints require either a Passport bearer token or
    an issued API key — see the Security Schemes section.
  contact:
    name: Gratona Engineering
    url: https://gratona.com
    email: devs@gratona.com
  version: 1.0.0
servers:
  - url: https://api.gratona.com/v1
    description: Server Version 1.0.0
security: []
tags:
  - name: Auth
    description: >-
      Login, signup, logout, password reset, and email verification for admin
      users and donors.
  - name: Donors
    description: >-
      Donor records: CRUD, profile fields, household linkage, search, filters,
      merge, and duplicate detection.
  - name: Donations
    description: >-
      Individual donation records, recurring commitments, soft credits, refunds,
      designations, and exports.
  - name: Sponsorships
    description: >-
      Donor-to-entity sponsorship relationships, lifecycle transitions, and
      sponsorship-specific filters.
  - name: Entities
    description: >-
      Recipient records (children, families, projects, animals, etc.), their
      status, and entity-level fields.
  - name: Programs
    description: >-
      Program / campaign configuration: hierarchy, settings, and program-level
      metadata.
  - name: Forms
    description: >-
      Custom form builder (HysForm), form fields, standardized donor fields, and
      field migrations.
  - name: Trips
    description: >-
      Mission-trip management: trips, participants, budgets, tasks,
      e-signatures, fundraising milestones, and background checks.
  - name: Communications
    description: >-
      Email templates, SMS, newsletters, donor email manager, and per-donor
      notes.
  - name: Payments
    description: >-
      Payment-gateway management (Stripe, PayPal, Flutterwave, QuickBooks).
      Excludes inbound webhooks — see the Webhooks tag.
  - name: Reports
    description: Dashboards, analytics, scheduled reports, and exports.
  - name: Admin
    description: >-
      Client-account administration: users, groups/permissions, settings,
      integrations, and account lifecycle.
  - name: Donor Portal
    description: >-
      Endpoints consumed by the donor-facing portal (donor login, dashboard,
      donation history, messages).
  - name: Recipient Portal
    description: Endpoints consumed by the recipient-facing portal.
  - name: Public
    description: >-
      Unauthenticated public endpoints: donor signup, public trip pages,
      peer-to-peer campaigns, public checkout.
  - name: Webhooks
    description: >-
      Inbound webhooks from third parties (Stripe, PayPal, Flutterwave, Checkr,
      DropboxSign). Annotated minimally for reference; payload shapes are owned
      by the upstream provider.
  - name: Client
    description: Client
  - name: Email Settings
    description: Email Settings
  - name: Admin Dashboard
    description: Admin Dashboard
  - name: Historical Archived Updates
    description: Historical Archived Updates
  - name: Team & access
    description: Team & access
  - name: Files
    description: Files
  - name: Wrapped
    description: Wrapped
  - name: Donor SignUp
    description: Donor SignUp
  - name: Frontend
    description: Frontend
  - name: User
    description: User
paths:
  /activities/{id}/attachments:
    get:
      tags:
        - Communications
      summary: List attachments on an email activity
      description: >-
        Returns the file attachments parsed from an inbound email Activity, each
        with an unsigned public S3 download URL. Errors generating individual
        download URLs are logged but do not fail the request — the affected
        attachment will be returned without a `download_url`.
      operationId: a5f280c56aac6762819236ac8ee61e95
      parameters:
        - name: id
          in: path
          description: Activity ID.
          required: true
          schema:
            type: integer
            format: int64
            example: 88123
      responses:
        '200':
          description: Attachment list.
          content:
            application/json:
              schema:
                properties:
                  attachments:
                    type: array
                    items:
                      properties:
                        id:
                          type: integer
                          format: int64
                        filename:
                          type: string
                        mime_type:
                          type: string
                        file_size:
                          type: integer
                        download_url:
                          type: string
                          format: uri
                          nullable: true
                        created_at:
                          type: string
                          format: date-time
                      type: object
                type: object
        '401':
          description: No valid bearer token / API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedResponse'
        '404':
          description: Activity id not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      security:
        - bearerAuth: []
        - apiKeyAuth: []
components:
  schemas:
    UnauthorizedResponse:
      title: UnauthorizedResponse
      description: >-
        Returned with HTTP 401 when the request lacks a valid Passport bearer
        token, a valid `X-HYS-API-Key`, or a valid session. The body is the
        simple `{message, status}` envelope emitted by `AuthenticateApiOrKey`.
      required:
        - message
        - status
      properties:
        message:
          description: >-
            Always the literal string `Unauthorized` from the `auth.api_or_key`
            middleware. Login endpoints return `Invalid Credentials` instead.
          type: string
          example: Unauthorized
        status:
          type: string
          example: error
      type: object
    NotFoundResponse:
      title: NotFoundResponse
      description: >-
        Returned with HTTP 404 when a resource lookup misses (typically because
        the id doesn't exist OR is scoped to a different `client_id`). Note:
        many endpoints intentionally collapse 'not found' and 'forbidden' into a
        single 404 to avoid leaking which records exist in another tenant.
      required:
        - message
      properties:
        message:
          description: >-
            Human-readable message. Often a more specific string like `Donor not
            found` or `Trip not found`.
          type: string
          example: Not Found
        status:
          type: string
          example: error
      type: object
  securitySchemes:
    bearerAuth:
      type: http
      description: Passport bearer token authentication for legacy admin sessions.
      scheme: bearer
      bearerFormat: JWT
    apiKeyAuth:
      type: apiKey
      description: Gratona API key sent with the compatibility header X-HYS-API-Key.
      name: X-HYS-API-Key
      in: header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.