> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.getsinbad.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.getsinbad.com/_mcp/server. # Read a private message attachment GET https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/{tradeId}/messages/{messageId}/image Read a private message attachment. **Credential:** Customer session or partner secret **Before you call** - A customer session, or an owning partner server credential without Origin. - A trade you own. You can send messages while it is CREATED, PAID or DISPUTED. Read the private original attachment for an owned trade, including after settlement. Missing images and unowned trades return 404. Read contentType from the response: original merchant attachments may have other image formats or application/octet-stream and are not limited by the customer upload size. Storage unavailability can return 502 or 503 UPSTREAM_ERROR; retry with backoff and quote requestId if it persists. > Confirm with Sinbad that this endpoint is enabled in your environment. **Errors** | Status | Code | What to do | | --- | --- | --- | | 400 | `VALIDATION_ERROR` | Correct the fields reported in details before retrying. | | 401 | `UNAUTHENTICATED` | Create a new customer session or use a valid server credential. | | 403 | `FORBIDDEN` | Check credential ownership, integration and the supplied Origin. | | 404 | `NOT_FOUND` | Check the resource ID. A resource that belongs to someone else also returns 404. | | 409 | `CONFLICT` | Read the current state again before you prepare or retry. | | 502 | `UPSTREAM_ERROR` | Retry with backoff and quote requestId if it persists. For transaction reports, retry the same hash without sending another transaction. | | 503 | `UPSTREAM_ERROR` | Retry with backoff; preserve the same idempotency key for a repeated mutation. | Reference: https://docs.getsinbad.com/api-reference/trade-messages/get-partner-trade-message-image ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Path parameters - `tradeId` (string, required) - `messageId` (string, required) ## Response ### 200 Private image or proof-PDF bytes as base64; no public URL. A proof message can remain readable after the active proof is removed. - `contentType` (string, required) — Original attachment content type; may include image/webp, image/gif, image/heif or application/octet-stream. - `size` (integer, required) - `dataBase64` (string, required) ## Errors ### 400 Bad Request Error The request is invalid. - `error` (V1TradesTradeIdMessagesMessageIdImageGetResponsesContentApplicationJsonSchemaError, required) ### 401 Unauthorized Error Authentication is required. - `error` (V1TradesTradeIdMessagesMessageIdImageGetResponsesContentApplicationJsonSchemaError, required) ### 403 Forbidden Error You do not have permission to perform this action. - `error` (V1TradesTradeIdMessagesMessageIdImageGetResponsesContentApplicationJsonSchemaError, required) ### 404 Not Found Error The requested resource was not found. - `error` (V1TradesTradeIdMessagesMessageIdImageGetResponsesContentApplicationJsonSchemaError, required) ### 409 Conflict Error The request conflicts with the current state of the resource. - `error` (V1TradesTradeIdMessagesMessageIdImageGetResponsesContentApplicationJsonSchemaError, required) ### 502 Bad Gateway Error A required service is unavailable. - `error` (V1TradesTradeIdMessagesMessageIdImageGetResponsesContentApplicationJsonSchemaError, required) ### 503 Service Unavailable Error Service temporarily unavailable. - `error` (V1TradesTradeIdMessagesMessageIdImageGetResponsesContentApplicationJsonSchemaError, required) ## Types ### V1TradesTradeIdMessagesMessageIdImageGetResponsesContentApplicationJsonSchemaError - `code` (string, required) - `numericId` (integer, required) - `message` (string, required) - `requestId` (string, optional) - `details` (map from string to any, optional) ## Examples **Response** ```json { "contentType": "image/png", "size": 68, "dataBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/lS8AAAAASUVORK5CYII=" } ``` **SDK Code** ```python Success import requests url = "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/trade_demo/messages/message_demo/image" headers = {"Authorization": "Bearer "} response = requests.get(url, headers=headers) print(response.json()) ``` ```javascript Success const url = 'https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/trade_demo/messages/message_demo/image'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Success package main import ( "fmt" "net/http" "io" ) func main() { url := "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/trade_demo/messages/message_demo/image" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Success require 'uri' require 'net/http' url = URI("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/trade_demo/messages/message_demo/image") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java Success import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/trade_demo/messages/message_demo/image") .header("Authorization", "Bearer ") .asString(); ``` ```php Success request('GET', 'https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/trade_demo/messages/message_demo/image', [ 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp Success using RestSharp; var client = new RestClient("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/trade_demo/messages/message_demo/image"); var request = new RestRequest(Method.GET); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift Success import Foundation let headers = ["Authorization": "Bearer "] let request = NSMutableURLRequest(url: NSURL(string: "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/trades/trade_demo/messages/message_demo/image")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```