# List incident attachments — API reference

> Returns uploaded files for the incident with filenames, media types, sizes, uploader IDs and pagination.

Source: https://upfour.io/docs/api/incidents/list-incident-attachments

[Developers](https://upfour.io/docs/api.md)/[Incidents](https://upfour.io/docs/api/incidents.md)

Returns uploaded files for the incident with filenames, media types, sizes, uploader IDs and pagination.

GET https://app.upfour.io/v1/incidents/{incidentID}/attachments

scope incident.read stable returns 200

## Parameters

| Field | Type | Description |
| --- | --- | --- |
| `incidentID` required | uuid | path parameter |

## Returns

A successful request returns `200` with application/json.

Response fields 2 top-level fields

| Field | Type | Description |
| --- | --- | --- |
| `data` | IncidentAttachment[]  · nullable | |
| Each item · 8 fields FieldTypeDescription `created_at` string (date-time) `file_size` integer `filename` string `id` uuid `incident_id` uuid `mime_type` string `storage_key` string The server-side storage key of the file. Download it from the attachment endpoint instead. `uploaded_by` uuid  · nullable | | |
| `pagination` | Pagination | |
| Pagination · 5 fields FieldTypeDescription `cursor` string  · nullable `has_more` boolean `limit` integer 1–250 `next_cursor` string  · nullable `prev_cursor` string  · nullable | | |

## Errors

Only the errors this operation can return. Every error uses the [same envelope](https://upfour.io/docs/api/responses.md).

| Status | Code | Meaning |
| --- | --- | --- |
| 400 | [bad_request](https://upfour.io/docs/api/errors#code-bad_request) | The request is malformed or fails validation. |
| 404 | [not_found](https://upfour.io/docs/api/errors#code-not_found) | The requested resource does not exist or is outside the caller's scope. |

Every call can also return `unauthorized` (401), `rate_limit_exceeded` (429) or `internal_error` (500 / 502). See [Responses and errors](https://upfour.io/docs/api/responses.md).

[PreviousAdd an incident update](https://upfour.io/docs/api/incidents/add-an-incident-update.md) [NextUpload an incident attachment](https://upfour.io/docs/api/incidents/upload-an-incident-attachment.md)

## Request

### cURL

```bash
curl -s "https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments" \
  -H "Authorization: Bearer $UP4_API_KEY"
```

### JavaScript

```javascript
const res = await fetch("https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments", {
  headers: {
    Authorization: `Bearer ${process.env.UP4_API_KEY}`,
  },
});
console.log(res.status, await res.json());
```

### Python

```python
import os
import requests

res = requests.get(
    "https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments",
    headers={"Authorization": f"Bearer {os.environ['UP4_API_KEY']}"},
)
print(res.status_code, res.json())
```

### Go

```go
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments", nil)
	req.Header.Set("Authorization", "Bearer "+os.Getenv("UP4_API_KEY"))
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	out, _ := io.ReadAll(res.Body)
	fmt.Println(res.StatusCode, string(out))
}
```

### PHP

```php
<?php
$ch = curl_init("https://app.upfour.io/v1/incidents/00000000-0000-4000-8000-000000000001/attachments");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer " . getenv("UP4_API_KEY"),
    ],
]);
$response = curl_exec($ch);
echo curl_getinfo($ch, CURLINFO_RESPONSE_CODE), " ", $response, "\n";
curl_close($ch);
```

## Response

### 200

```json
{
  "data": [
    {
      "created_at": "2026-10-27T09:00:00Z",
      "file_size": 42,
      "filename": "checkout-error.txt",
      "id": "00000000-0000-4000-8000-000000000002",
      "incident_id": "00000000-0000-4000-8000-000000000001",
      "mime_type": "text/plain",
      "storage_key": "00000000-0000-4000-8000-000000000001/00000000-0000-4000-8000-000000000003_checkout-error.txt",
      "uploaded_by": "00000000-0000-4000-8000-000000000004"
    }
  ],
  "pagination": {
    "cursor": null,
    "has_more": false,
    "limit": 50,
    "next_cursor": null,
    "prev_cursor": null
  }
}
```

### 400

```json
{
  "error": {
    "code": "bad_request",
    "message": "The request is malformed or fails validation.",
    "request_id": "req_…"
  }
}
```

### 404

```json
{
  "error": {
    "code": "not_found",
    "message": "The requested resource does not exist or is outside the caller's scope.",
    "request_id": "req_…"
  }
}
```