API REFERENCE
Beta
List a Finding’s Attachments
The only place attachment metadata and download links are published. A finding itself only carries hasAttachments (a boolean) plus links.attachments pointing here — to get the actual list, or any attachment’s download link, call this endpoint.
Live attachments only: a document that was removed no longer appears here at all — there is no deleted flag to check for. A finding with no attachments returns a 200 with an empty array, as does a finding whose hasAttachments is false.
Sample
url="https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/attachments"
curl -X GET "${url}" \
-H "Authorization: Bearer your_access_token_here"
Header Properties
| Property | Value | Required? |
|---|---|---|
| Authorization | Bearer your token | true |
Path Parameters
| Property | Description | Type |
|---|---|---|
| workflowId | The opaque handle identifying the workflow. | string |
| findingId | The opaque finding identifier (fndg_…). | string |
workflowId is accepted with or without its wfpop_ prefix — a bare GUID resolves. findingId and attachmentId are not interchangeable this way: either must carry its exact prefix, or the request 404s as if that finding or attachment did not exist. There is no bare form of either that has ever been valid.
Responses
200
| Property | Description | Type |
|---|---|---|
| workflowId | The workflow handle. | string |
| findingId | The finding handle. | string |
| attachments | The finding’s live attachments. [] when it has none, never null. | array |
| links.self | This collection’s own address. | object |
| links.finding | The parent finding’s address. | object |
Attachment
| Property | Description | Type |
|---|---|---|
| attachmentId | The opaque attachment handle (attchmnt_…) the download URL is built from. Resolves only within the finding it belongs to. | string |
| name | The document’s file name — a display value, not an identifier. Two attachments on one finding may share a name. Omitted when it can’t be resolved; the attachment’s identity is still published in that case. | string |
| contentType | The document’s MIME type, so you can decide how to render or store the bytes before spending a request on them. Omitted when the stored row carries none. | string |
| modifiable | Whether you may change this document — separates your own upload from a document the system captured on your behalf. Always present. | boolean |
| updatedAt | When this attachment last changed. Omitted when the stored row carries none. | string |
| links.download | Where the document’s bytes are served from — see Download an Attachment. An ordinary authenticated endpoint, never a signed or expiring URL. | object |
{
"workflowId": "wfpop_0000000000002082611",
"findingId": "fndg_0000000000006051384",
"attachments": [
{
"attachmentId": "attchmnt_0000000000006099213",
"name": "paystub-august.pdf",
"contentType": "application/pdf",
"modifiable": true,
"updatedAt": "2026-08-07T15:01:12Z",
"links": {
"download": {
"src": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/attachments/attchmnt_0000000000006099213/content"
}
}
}
],
"links": {
"self": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/attachments" },
"finding": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384" }
}
}
links.download uses a src key, not href — deliberately different from every other link on this surface. src means “fetch this for the content” (as in HTML’s <img src>); href means “navigate to this resource” and always returns JSON. Following links.download returns the document’s raw bytes, never JSON.
403
You are not authorized to read this workflow.
Zero-length body, no Content-Type. Do not attempt to parse a body from this response — there is none. Branch on the status code alone.
This surface uses a bodyless 403 for every authorization failure, which is different from a problem+json 404 on the same operation. Do not assume every non-2xx on this API carries JSON — check the status first.
A 403 is also produced at the edge, before this service is reached, when a request value resembles SQL injection or cross-site scripting, and separately from the per-address rate limit (429). Both of those are also bodyless and carry no Content-Type.
404
Unknown workflowId or unknown findingId.
An RFC 9457 problem document, served as application/problem+json.
| Property | Description | Type |
|---|---|---|
| type | An absolute URI identifying the problem type. https://pointservices.com/problems/not-found is the only type this surface emits. This is the stable value to match on. | string |
| title | A short summary, written for a person. | string |
| status | The HTTP status code, repeated in the body. | number |
| detail | An explanation of this occurrence, written for your logs — never a stable code. | string |
| instance | A URI identifying this occurrence, written as urn:pps:request:<id>. Quote it when you raise a support ticket. | string |
{
"type": "https://pointservices.com/problems/not-found",
"title": "No such resource",
"status": 404,
"detail": "No finding fndg_0000000000006051384 is available to this request.",
"instance": "urn:pps:request:8d3a1f56-6c94-4e20-b7f8-0a5e9c2d4b73"
}
Branch on type, never on the text of detail.