> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apowerb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Webhook Log Attachment

> Serve one attachment captured at webhook reception time.

Defence layers, in order:
  1. Ownership check — log must belong to the current user (404
     otherwise; no enumeration oracle).
  2. DB cross-check — the requested filename must appear in the
     ``attachments`` JSONB column of that log row. Prevents serving
     a residual file someone else dropped in the per-log directory.
  3. ``resolve_attachment_path`` — path-traversal-safe lookup that
     confirms the file lives inside ATTACHMENT_ROOT.
  4. ``Content-Type`` taken from the JSONB row (set by the Graph
     metadata at capture time), not re-guessed from the extension.
  5. ``Content-Disposition: inline`` only for PDF and images, so
     the dashboard can iframe-preview them; everything else
     downloads to disk.



## OpenAPI

````yaml /api-reference/openapi.json get /api/webhooks/logs/{log_id}/attachments/{filename}
openapi: 3.1.0
info:
  title: apowerb API
  description: REST API of the apowerb agentic framework (open-source edition).
  version: 0.1.2
  license:
    name: MIT
    url: https://github.com/apowerb/apowerb/blob/main/LICENSE
servers:
  - url: https://api.example.com
    description: Your apowerb instance
  - url: http://localhost:8000
    description: Local stack
security: []
paths:
  /api/webhooks/logs/{log_id}/attachments/{filename}:
    get:
      tags:
        - webhooks
      summary: Get Webhook Log Attachment
      description: |-
        Serve one attachment captured at webhook reception time.

        Defence layers, in order:
          1. Ownership check — log must belong to the current user (404
             otherwise; no enumeration oracle).
          2. DB cross-check — the requested filename must appear in the
             ``attachments`` JSONB column of that log row. Prevents serving
             a residual file someone else dropped in the per-log directory.
          3. ``resolve_attachment_path`` — path-traversal-safe lookup that
             confirms the file lives inside ATTACHMENT_ROOT.
          4. ``Content-Type`` taken from the JSONB row (set by the Graph
             metadata at capture time), not re-guessed from the extension.
          5. ``Content-Disposition: inline`` only for PDF and images, so
             the dashboard can iframe-preview them; everything else
             downloads to disk.
      operationId: >-
        get_webhook_log_attachment_api_webhooks_logs__log_id__attachments__filename__get
      parameters:
        - name: log_id
          in: path
          required: true
          schema:
            type: integer
            title: Log Id
        - name: filename
          in: path
          required: true
          schema:
            type: string
            title: Filename
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer

````

## Related topics

- [Get Webhook Log By Id](/api-reference/webhooks/get-webhook-log-by-id.md)
- [Get Webhook Log Body](/api-reference/webhooks/get-webhook-log-body.md)
- [Webhooks](/guides/webhooks.md)
- [List Webhook Logs](/api-reference/webhooks/list-webhook-logs.md)
- [Retrigger Webhook Log](/api-reference/webhooks/retrigger-webhook-log.md)