> This page is for Developers. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://zuora.ferndocs.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server. # List attachments by object type and key GET https://rest.test.zuora.com/v1/attachments/{object-type}/{object-key} Use the View Attachment REST request to get a list of attachments on an account, an invoice, a subscription, a credit memo, or a debit memo. You can only use this operation if you have a Billing role that includes the Manage Attachments permission. For more information, see [Billing roles](https://knowledgecenter.zuora.com/Billing/Tenant_Management/A_Administrator_Settings/User_Roles/d_Billing_Roles). To change your Billing role, contact your Zuora platform administrator. **Note**: The Credit and Debit Memos feature is only available if you have [Invoice Settlement](https://knowledgecenter.zuora.com/Billing/Billing_and_Payments/Invoice_Settlement) enabled. The Invoice Settlement feature is generally available as of Zuora Billing Release 296 (March 2021). This feature includes Unapplied Payments, Credit and Debit Memo, and Invoice Item Settlement. If you want to enable Invoice Settlement, see [Invoice Settlement Enablement and Checklist Guide](https://knowledgecenter.zuora.com/Billing/Billing_and_Payments/Invoice_Settlement/Invoice_Settlement_Migration_Checklist_and_Guide) for more information. Reference: https://zuora.ferndocs.com/developers/api-reference/zuora-api/general-purpose-operations/attachments/get-attachments-list ## Authentication - `Authorization` header (bearer token, required) — Use `Bearer {{token}}` in the `Authorization` header for authentication. ## Servers - `https://rest.test.zuora.com` (US Developer & Central Sandbox (incl. Test Drive), default) - `https://rest.sandbox.na.zuora.com` (US API Sandbox Cloud 1) - `https://rest.apisandbox.zuora.com` (US API Sandbox Cloud 2) - `https://rest.na.zuora.com` (US Production Cloud 1) - `https://rest.zuora.com` (US Production Cloud 2) - `https://rest.test.eu.zuora.com` (EU Developer & Central Sandbox) - `https://rest.sandbox.eu.zuora.com` (EU API Sandbox) - `https://rest.eu.zuora.com` (EU Production) - `https://rest.test.ap.zuora.com` (APAC Developer & Central Sandbox) - `https://rest.ap.zuora.com` (APAC Production) ## Request ### Path parameters - `object-type` (enum, required) — The type of the object to list attachements for. - Allowed values: `account`, `invoice`, `subscription`, `creditmemo`, `debitmemo` - `object-key` (string, required) — ID of the object to list attachements for. - If `object-type` is `account`, specify an account ID or number. - If `object-type` is `invoice`, specify an invoice ID. - If `object-type` is `subscription`, specify a subscription number. - If `object-type` is `creditmemo`, specify a credit memo ID or number. - If `object-type` is `debitmemo`, specify a debit memo ID or number. ### Query parameters - `page` (integer, optional, default: 1) — The index number of the page that you want to retrieve. This parameter is dependent on `pageSize`. You must set `pageSize` before specifying `page`. For example, if you set `pageSize` to `20` and `page` to `2`, the 21st to 40th records are returned in the response. - `pageSize` (integer, optional, default: 20) — The number of records returned per page in the response. ### Headers - `Accept-Encoding` (string, optional) — Include the `Accept-Encoding: gzip` header to compress responses as a gzipped file. It can significantly reduce the bandwidth required for a response. If specified, Zuora automatically compresses responses that contain over 1000 bytes of data, and the response contains a `Content-Encoding` header with the compression algorithm so that your client can decompress it. - `Content-Encoding` (string, optional) — Include the `Content-Encoding: gzip` header to compress a request. With this header specified, you should upload a gzipped file for the request payload instead of sending the JSON payload. - `Zuora-Track-Id` (string, optional) — A custom identifier for tracing the API call. If you set a value for this header, Zuora returns the same value in the response headers. This header enables you to associate your system process identifiers with Zuora API calls, to assist with troubleshooting in the event of an issue. The value of this field must use the US-ASCII character set and must not include any of the following characters: colon (`:`), semicolon (`;`), double quote (`"`), and quote (`'`). - `Zuora-Entity-Ids` (string, optional) — An entity ID. If you have [Zuora Multi-entity](https://knowledgecenter.zuora.com/BB_Introducing_Z_Business/Multi-entity) enabled and the OAuth token is valid for more than one entity, you must use this header to specify which entity to perform the operation in. If the OAuth token is only valid for a single entity, or you do not have Zuora Multi-entity enabled, you should not set this header. - `Zuora-Org-Ids` (string, optional) — Comma separated IDs. If you have Zuora Multi-Org enabled, you can use this header to specify which orgs to perform the operation in. If you do not have Zuora Multi-Org enabled, you should not set this header. The IDs must be a sub-set of the user's accessible orgs. If you specify an org that the user does not have access to, the operation fails. This header is important in Multi-Org (MO) setups because it defines the organization context under which the API should operate—mainly used for read access or data visibility filtering. If the header is not set, the operation is performed in scope of the user's accessible orgs. - `Zuora-Version` (string, optional) — The minor API version. For a list of available minor versions, see [API upgrades](https://developer.zuora.com/v1-api-reference/api-upgrades/). ## Response ### 200 OK - `attachments` (list of GETAttachmentResponseWithoutSuccessType, optional) — Container for one or more attachments. - `nextPage` (string, optional) — URL to retrieve the next page of the response if it exists; otherwise absent. - `success` (boolean, optional) — Returns `true` if the request was processed successfully. ## Errors ### 500 Internal Server Error Internal Server Error - `reasons` (list of ErrorResponseReasonsItems, optional) ### 400 Client Request Error Request Errors - `processId` (string, optional) — The ID of the process that handles the operation. - `reasons` (list of CommonResponseReasonsItems, optional) — The container of the error code and message. This field is available only if the `success` field is `false`. - `requestId` (string, optional) — Unique identifier of the request. - `success` (boolean, optional) — Indicates whether the call succeeded. ## Types ### GETAttachmentResponseWithoutSuccessType - `createdBy` (string, optional) — Zuora user id of who added this attachment to the object. - `createdOn` (string, optional) — Date and time when the attachment was added to the object. - `description` (string, optional) — Description of the attachment. - `fileContentType` (string, optional) — Attachment file type. - `fileId` (string, optional) — File ID of the attached file. Use this file ID with [Get files](https://developer.zuora.com/api-references/api/operation/GET_Files) to download the file. - `fileName` (string, optional) — Attachment file name. - `id` (string, optional) — Zuora id of this attachement. - `organizationLabel` (string, optional) — The organization that this object belongs to. Note: This field is available only when the Multi-Org feature is enabled. - `updatedBy` (string, optional) — Zuora user id who last updated the attachment. - `updatedOn` (string, optional) — Date and time when the attachment was last updated. ### ErrorResponseReasonsItems - `code` (string, optional) — The error code of response. - `message` (string, optional) — The detail information of the error response ### CommonResponseReasonsItems - `code` (string, optional) — The error code of response. - `message` (string, optional) — The detail information of the error response ## Examples **Response** ```json { "attachments": [ { "createdBy": "402881e522cf4f9b0122cf5d82860002", "createdOn": "2016-03-21 14:00:47", "fileContentType": "application/pdf", "fileId": "402896b95397c169015397c2ebc50002", "fileName": "Search _ Splunk.pdf", "id": "402896b95397c169015397c2ebca0003", "updatedBy": "402881e522cf4f9b0122cf5d82860002", "updatedOn": "2016-03-21 14:00:47", "success": true }, { "createdBy": "4028e487327fd45a0132829ebb673ff9", "createdOn": "2016-05-02 13:09:17", "description": "", "fileContentType": "text/plain", "fileId": "8a8083e1545b706a01547316d9094400", "fileName": "AttachTest.txt", "id": "8a8083e1545b706a01547316d93f4401", "updatedBy": "4028e487327fd45a0132829ebb673ff9", "updatedOn": "2016-05-02 13:09:17" } ], "success": true } ``` **SDK Code** ```python response import requests url = "https://rest.test.zuora.com/v1/attachments/account/object-key" headers = {"Authorization": "Bearer "} response = requests.get(url, headers=headers) print(response.json()) ``` ```javascript response const url = 'https://rest.test.zuora.com/v1/attachments/account/object-key'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go response package main import ( "fmt" "net/http" "io" ) func main() { url := "https://rest.test.zuora.com/v1/attachments/account/object-key" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby response require 'uri' require 'net/http' url = URI("https://rest.test.zuora.com/v1/attachments/account/object-key") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java response import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://rest.test.zuora.com/v1/attachments/account/object-key") .header("Authorization", "Bearer ") .asString(); ``` ```php response request('GET', 'https://rest.test.zuora.com/v1/attachments/account/object-key', [ 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp response using RestSharp; var client = new RestClient("https://rest.test.zuora.com/v1/attachments/account/object-key"); var request = new RestRequest(Method.GET); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift response import Foundation let headers = ["Authorization": "Bearer "] let request = NSMutableURLRequest(url: NSURL(string: "https://rest.test.zuora.com/v1/attachments/account/object-key")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```