# List a template's attachments

```http
GET https://secure.yoprint.com/v2/api/store/{team_slug}/setting/message_template/{hash_id}/internal_attachment
```

- API version: v2
- Operation ID: `v2_public_message_template_internal_attachment_index`
- Section: Team settings › [Message template attachments](https://developer.yoprint.com/reference/message-template-attachments.md)
- Web page: https://developer.yoprint.com/reference/message-template-attachments/v2-message-template-internal-attachment-index/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Returns the attachments a message template adds when it is sent. The path takes the template's id. Attachment `type` values: `order` (the sales order or quote PDF), `order_compact` (its compact PDF), `so_jobs_with_mockup` and `so_jobs_without_mockup` (job sheets), `so_invoices` and `so_compact_invoices` (its invoices), `purchase_order` (the purchase order PDF), and `media` or `reference_media` (a file, by `media_id`). A template accepts only the values in its `supported_attachments`: purchase order templates take `purchase_order`, `media` and `reference_media`.

## Permission

Any member of the team, whatever their role. This is wider than the web app, whose Settings pages need Manage Settings: on the API only changes need it.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The message template. Its hash id from an earlier answer; there is no unique key for it. Example `DVubREua5aJkwh`.

## Request body

This operation takes no request body.

### Example request

```bash
curl 'https://secure.yoprint.com/v2/api/store/your-team/setting/message_template/DVubREua5aJkwh/internal_attachment' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1'
```

## Response

`200` Successful response.

Fields:

- `data` (array of objects, required)
  - Each item:
    - `created_at` (string (date-time), required)
    - `detail` (string | null, required): For a document attachment, defaults to its kind, such as `Sales Order/Quote (PDF)`.
    - `id` (string, required)
    - `media` (object | null, required): For a `media` or `reference_media` attachment, the file: `id`, `name`, `file_name`, `mime_type`, `size`, a download `url`, a signed `view_url` and more. Null for document attachments.
    - `media_id` (string | null, required)
    - `name` (string | null, required)
    - `options` (string | null, required): The attachment's options as a JSON-encoded string, not an object: `"[]"`, or for job sheets `"{\"show_mockup\":true}"`. `"null"` for a `media` or `reference_media` file. Decode it before use.
    - `order_id` (string | null, required)
    - `order_scoped_id` (string | integer | null, required)
    - `purchase_order_id` (string | null, required)
    - `purchase_order_scoped_id` (string | integer | null, required)
    - `type` (string, required)
    - `updated_at` (string (date-time), required)
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": [
    {
      "created_at": "2026-10-01T09:00:00+00:00",
      "detail": "Sales Order/Quote (PDF)",
      "id": "80qLp4P9l2ftvL",
      "media": null,
      "media_id": null,
      "name": "Sales order PDF",
      "options": "[]",
      "order_id": null,
      "order_scoped_id": "",
      "purchase_order_id": null,
      "purchase_order_scoped_id": "",
      "type": "order",
      "updated_at": "2026-10-01T09:00:00+00:00"
    }
  ],
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.

## Related

- [Add an attachment to a template](https://developer.yoprint.com/reference/message-template-attachments/v2-message-template-internal-attachment-store.md): `POST /v2/api/store/{team_slug}/setting/message_template/{hash_id}/internal_attachment`
- [Get a message template](https://developer.yoprint.com/reference/message-templates/v2-message-template-show.md): `GET /v2/api/store/{team_slug}/setting/message_template/{hash_id}`