Retrieve attachments with access checks, filters, sorting, pagination, and related task and project information.
The method returns native attachment fields together with the related task name and project name where available. Access restrictions are applied automatically according to the authenticated user or guest/public access context.
The number in the URL path (/1/) is the organization identifier — referred to as account_id.
This value must match the account associated with the provided session_id, token, or project_token.
This endpoint supports both:
GET https://api.doboard.com/42/attachment_get?task_id=101&period_begin=2026-09-01%2000:00:00&length=25&order_column=created&order_dir=desc&session_id=abc123xyz
In this example:
42 is the organization/account ID.task_id=101 returns attachments associated with task 101.period_begin returns attachments created on or after the specified date.length=25 limits the response to 25 attachments.order_column=created sorts the result by creation date.order_dir=desc returns the newest attachments first.session_id=abc123xyz is used for authentication.If the account ID in the URL does not match the account tied to the session or token, the request will be rejected.
Required
Provide one of the following:
session_id – for an authenticated usertoken – for guest access to a public taskproject_token – for guest access to a public projectSession IDs and tokens must contain 13–32 alphanumeric characters.
An authenticated non-guest user can retrieve attachments only from projects where the user is linked through projects_users.
This method does not apply a separate administrator bypass. Project membership is required by the attachment query for all users processed through the standard authenticated-user access mode.
When a valid task token creates a guest task context, the method returns only attachments associated with that task.
For this mode:
project_id and project_name are hidden in the response.A guest with a user ID but without a guest project context can retrieve only attachments uploaded by that guest user.
For this mode:
project_id and project_name are hidden in the response.A guest associated with a public project but without a user ID can retrieve attachments only when:
task_type=PUBLIC.status=REMOVED.A guest associated with both a public project and a user ID can retrieve:
tasks_users for that project.The source does not apply an additional task-status restriction in this access mode.
The method does not return an Access denied error for inaccessible attachments.
Access restrictions are applied as query filters. If the requested attachments are not accessible, the endpoint returns a successful response with an empty attachments array.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
session_id |
string | Yes* | – | Authenticated user session ID. |
token |
string | Yes* | – | Public task guest-access token. |
project_token |
string | Yes* | – | Public project guest-access token. |
attachment_id |
int / array / string | No | – | One or multiple attachment IDs. Accepts a single ID, an array, or comma-separated IDs. |
user_id |
int | No | – | Filters attachments by the user who uploaded them. |
comment_id |
int / array / string | No | – | One or multiple comment IDs. Accepts a single ID, an array, or comma-separated IDs. |
task_id |
int | No | – | Filters attachments by task ID. |
track_id |
int | No | – | Filters attachments by track ID. |
project_id |
int | No | – | Filters attachments by project ID. |
period_begin |
datetime | No | – | Inclusive lower boundary for the attachment creation date. Expected format: Y-m-d H:i:s. |
period_end |
datetime | No | – | Inclusive upper boundary for the attachment creation date. Expected format: Y-m-d H:i:s. |
start |
int | No | 0 |
Result offset for pagination. |
length |
int | No | 250 |
Page size. Allowed values: 10, 25, 50, 100, 250. |
order_column |
string | No | attachment_id |
Sorting column. Allowed values: attachment_id, created, user_id, comment_id, attachment_order. |
order_dir |
string | No | desc |
Sort direction: asc or desc. Values are case-insensitive. |
* One of session_id, token, or project_token is required.
All supplied filters are combined using AND.
For example:
GET https://api.doboard.com/42/attachment_get?project_id=7&user_id=15&period_begin=2026-09-01%2000:00:00&session_id=abc123xyz
This request returns attachments that:
Access restrictions are always applied in addition to the requested filters.
attachment_id accepts:
Values are converted to integers. Empty values and zero IDs are removed, and duplicate IDs are discarded.
comment_id follows the same input rules:
Empty values, zero IDs, and duplicate IDs are removed.
If normalization leaves no usable IDs, the corresponding attachment_id or comment_id filter is not applied.
Use positive numeric IDs to avoid an invalid list being treated as an omitted filter.
period_begin applies:
created >= period_begin
period_end applies:
created <= period_end
Both boundaries are inclusive.
Dates are parsed and normalized by the server. If a date cannot be parsed, the request returns a validation error.
Default sorting:
attachment_id DESC
Allowed sorting columns:
attachment_idcreateduser_idcomment_idattachment_orderAllowed sort directions:
ascdescSort-direction values are case-insensitive.
If order_column is missing or unsupported, attachment_id is used.
If order_dir is missing or unsupported, DESC is used.
Allowed page sizes:
102550100250If length is missing or unsupported, 250 is used.
start defines the result offset and defaults to 0.
{
"data": {
"operation_status": "SUCCESS",
"attachments": [
{
"attachment_id": 301,
"created": "2026-09-18 10:15:00",
"updated": "2026-09-18 10:16:00",
"filename": "screenshot.png",
"URL": "https://example.com/path/screenshot.png",
"URL_thumbnail": "https://example.com/path/screenshot-thumbnail.webp",
"user_id": 5,
"comment_id": 501,
"task_id": 101,
"track_id": 12,
"project_id": 7,
"mime_content_type": "image/png",
"attachment_order": 0,
"file_size": 245760,
"task_name": "Fix login bug",
"project_name": "Web Platform"
}
],
"records_filtered": 1
}
}
records_filtered contains the total number of accessible attachments matching all filters before pagination is applied.
{
"data": {
"operation_status": "SUCCESS",
"attachments": [],
"records_filtered": 0
}
}
An empty response is returned when:
{
"data": {
"operation_status": "FAILED",
"operation_message": "period_begin wrong format, expected format: Y-m-d H:i:s"
},
"error_message": "period_begin wrong format, expected format: Y-m-d H:i:s",
"error_no": 3002
}
Each object in attachments[] contains the native attachment fields together with related task and project information.
| Field | Type | Description |
|---|---|---|
attachment_id |
int | Unique attachment identifier. |
created |
datetime | Date and time when the attachment was created. |
updated |
datetime/null | Date and time when the attachment was last updated. |
filename |
string | Attachment display filename. |
URL |
string | Current file URL. It can refer to temporary or permanent storage depending on upload-processing status. |
URL_thumbnail |
string/null | Generated thumbnail URL for supported images. null when a thumbnail is unavailable or has not yet been generated. |
user_id |
int | ID of the user who uploaded the attachment. |
comment_id |
int | ID of the related comment. |
task_id |
int/null | ID of the task associated with the comment. |
track_id |
int/null | ID of the track associated with the comment. |
project_id |
int/null | Related project ID. It may be hidden in some guest responses. |
mime_content_type |
string | MIME type detected for the uploaded file. |
attachment_order |
int | Numeric attachment order value. |
file_size |
int | File size in bytes. |
task_name |
string/null | Name of the task associated with the comment. |
project_name |
string/null | Name of the related task project. It may be hidden in some guest responses. |
The endpoint returns all native fields available in the attachments table. If additional native columns exist in the current database schema, they are also included.
For guests without a project context, the following fields are explicitly returned as null:
project_idproject_nameThis applies to:
Other attachment and task fields are not removed by this response transformation.
task_name and project_name are resolved through the attachment’s comment and its related task.
As a result:
task_name can be null for an attachment whose comment is not linked to a task.project_name can be null when no related task project can be resolved.| HTTP Code | error_no |
Message | Description |
|---|---|---|---|
401 |
– | Unauthorized |
No valid session_id, token, or project_token was provided. |
200 |
7 |
limit reached |
Too many failed session-validation attempts from the same IP address. |
200 |
3002 |
period_begin wrong format, expected format: Y-m-d H:i:s |
period_begin could not be parsed. |
200 |
3003 |
period_end wrong format, expected format: Y-m-d H:i:s |
period_end could not be parsed. |
200 |
0 |
Internal API Error |
The attachment query failed. |
The authentication attempt limit is 50 failed session checks per IP address within 10 minutes.
This is a read-only method.
It does not create, update, or delete attachment records and does not publish WebSocket events.
AND.attachment_id and comment_id accept single IDs, comma-separated IDs, or arrays.period_begin and period_end are inclusive.attachment_id DESC.250.250.records_filtered is calculated before pagination.projects_users.null for track-only comments.URL and URL_thumbnail reflect their current stored values and may change after asynchronous upload processing.