Returns a signed URL for the bytes of an inbound message attachment. The URL is short-lived; request the operation again to mint a fresh one.

By default this operation also records a reveal that is visible to every user in the workspace, the same as opening the attachment in the inbox. Pass the literal query value reveal=false for unattended downloads, background syncs and retries to mint the URL without adding a workspace-visible reveal. This does not undo an existing reveal. Every issuance is recorded in the attachment audit trail either way.

Attachments under review return 403, attachments that were removed return 410, and attachments without available stored bytes return 409. This may be temporary while ingestion completes or permanent if storage failed or the part is unsupported. Retry with bounded exponential backoff and a deadline; do not retry indefinitely.