# List a Finding's Attachments
Source: https://docs.pitchpointsolutions.com/api/findings/get_workflow_finding_attachments/
**Beta**
The finding's attachments, each with its download link. A finding itself carries only `hasAttachments`; this call lists them.
A removed attachment no longer appears here at all; there is no `deleted` flag to check. A finding with no attachments returns a 200 with an empty array.
Read-only and safe to poll.
### Sample
```bash
url="https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/attachments"
curl -X GET "${url}" \
-H "Authorization: Bearer your_access_token_here"
```
#### Header Properties
| Property | Value | Required? |
|----------|-------|-----------|
| Authorization | Bearer *your token* | true |
#### Path Parameters
| Property | Description | Type |
|----------|-------------|------|
| workflowId | The workflow's id, exactly as this API returned it. | string |
| findingId | The finding's id, exactly as published in `findingId`. | string |
> **Warning:** `workflowId`, `findingId` and `attachmentId` are opaque. Send each one back exactly as this API returned it: don't parse it, build one yourself, or add or remove its prefix. A `findingId` or `attachmentId` that isn't exactly as published, including one with its prefix removed, returns a 404 as if it didn't exist.
### Responses
**200**
| Property | Description | Type |
|----------|-------------|------|
| workflowId | The workflow's id. | string |
| findingId | The finding's id. | string |
| attachments | The finding's attachments. `[]` when it has none, never null. | array |
##### Attachment
| Property | Description | Type |
|----------|-------------|------|
| attachmentId | The attachment's opaque id. It resolves only under the finding it belongs to. Always present. | string |
| name | The document's file name: a display value, not an identifier. Two attachments on one finding may share a name. Omitted when it can't be resolved; the attachment is still listed. | string |
| contentType | The document's media type, so you can decide how to render or store it before downloading. For a document you uploaded, it is the `Content-Type` you sent on the `file` part. Omitted when none was recorded. | string |
| modifiable | Whether a user may change or remove this document: `true` for a user's own upload, `false` for a document the system captured. Always present. | boolean |
| updatedAt | When this attachment last changed. Omitted when none was recorded. | string |
| links.download | Where the document's bytes are served from, in `src`: see [Download an Attachment](https://docs.pitchpointsolutions.com/api/findings/get_workflow_finding_attachment_content). An ordinary authenticated endpoint, **never a signed or expiring URL**. | object |
```json
{
"workflowId": "wfpop_0000000000002082611",
"findingId": "fndg_0000000000006051384",
"attachments": [
{
"attachmentId": "jattmt_0000000000006099213",
"name": "paystub-august.pdf",
"contentType": "application/pdf",
"modifiable": true,
"updatedAt": "2026-08-07T15:01:12Z",
"links": {
"download": {
"src": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/attachments/jattmt_0000000000006099213/content"
}
}
}
]
}
```
> **Warning:** `links.download` carries its address in a `src` key. `src` means "fetch this for the content" (as in HTML's `![]()
`): following `links.download` returns the document's raw bytes, not JSON.
**401**
No credential the service could accept reached it. The body is an RFC 9457 problem document, served as `application/problem+json`, and the response carries a `WWW-Authenticate` challenge. The request body is never read, so a 401 says nothing about whether the rest of your request would have been accepted.
Two problem types tell the cases apart:
| `type` | Meaning | `WWW-Authenticate` |
|--------|---------|--------------------|
| `about:blank` | No credential was presented. | `Bearer realm="Helix"` |
| `https://pointservices.com/problems/invalid-token` | A credential was presented and rejected. The response doesn't say why: an expired, revoked, badly signed and malformed token all look the same. | `Bearer realm="Helix", error="invalid_token"` |
```json
{
"type": "https://pointservices.com/problems/invalid-token",
"title": "The access token was not accepted",
"status": 401,
"detail": "The access token was rejected.",
"instance": "urn:pps:request:0000000000000000000000000000000000000000000000000000"
}
```
> **Warning:** Refresh your token on a 401, and only on a 401. An expiring token moves a call from 200 to 401, never to 403, so a fresh token is the fix here and never the fix for a 403.
**403**
You may not read this workflow.
You are authenticated, and the answer is still no. This is an authorization decision, not a statement about your token, so refreshing the token won't turn it into a 200.
The body is an RFC 9457 problem document, served as `application/problem+json`. Two problem types tell the cases apart:
| `type` | Meaning |
|--------|---------|
| `about:blank` | The request was refused before the operation ran. |
| `https://pointservices.com/problems/not-authorized` | The operation ran, and policy won't let you act on the workflow or finding you named. |
```json
{
"type": "https://pointservices.com/problems/not-authorized",
"title": "Not authorized",
"status": 403,
"detail": "The authenticated identity is not permitted to perform this action.",
"instance": "urn:pps:request:0000000000000000000000000000000000000000000000000000"
}
```
A 403 can also come from the edge, before the service is reached: for example, when a request value resembles SQL injection or cross-site scripting. Those refusals carry no problem document. Write your client to handle an error response it can't parse, rather than assuming every failure has a JSON body.
**404**
Unknown `workflowId` or unknown `findingId`.
The body is an RFC 9457 problem document, served as `application/problem+json`. Two problem types tell the cases apart:
| `type` | Meaning |
|--------|---------|
| `https://pointservices.com/problems/not-found` | An id in the path isn't one this API knows. Check that you sent it exactly as the API returned it. |
| `about:blank` | The URL or method isn't one this API serves at all. Check the path. |
| Property | Description | Type |
|----------|-------------|------|
| type | An absolute URI identifying the problem type. This is the stable value to match on; compare it as a string. | string |
| title | A short summary, written for a person. | string |
| status | The HTTP status code, repeated in the body. | number |
| detail | An explanation of this occurrence, written for your logs. Never match on it. | string |
| instance | A URI identifying this occurrence, written as `urn:pps:request:`. The id is the same value as the `x-pps-request-id` response header. Quote it when you report a problem to PPS. | string |
```json
{
"type": "https://pointservices.com/problems/not-found",
"title": "No such resource",
"status": 404,
"detail": "Finding[fndg_0000000000006051384] not found",
"instance": "urn:pps:request:8d3a1f56-6c94-4e20-b7f8-0a5e9c2d4b73"
}
```
> **Warning:** Branch on `type`, never on the text of `title` or `detail`.