> ## Documentation Index > Fetch the complete documentation index at: https://docs.finsync.ar/llms.txt > Use this file to discover all available pages before exploring further. # List attachments on an operation > Returns metadata for files stored on an existing operation, using the same OperationAttachment rows and R2 private bucket as the dashboard. Each item includes a temporary signed download URL (1 hour). Tenant-scoped: missing operations and other companies return 404. Employees with assigned clients only see operations they can already view. ## OpenAPI ````yaml /docs/openapi.json get /api/operations/{id}/attachments openapi: 3.0.0 info: title: FinSync API Documentation version: 1.0.0 description: API documentation for FinSync application contact: name: FinSync Support email: support@finsync.com servers: - url: https://api.finsync.ar description: Direct Fly API (preferred for API keys and webhooks) - url: https://finsync.ar description: Same-origin via finsync.ar (Vercel rewrite) security: - apiKey: [] tags: - name: Clients description: Operations related to clients and their accounts - name: Tags description: >- Company-scoped client labels (Configuración > Etiquetas). Distinct from the special Centro de resultados / Centro de costos tag used for budget clients. - name: Accounts description: Operations related to account balances - name: Cost Centers description: Company centros de resultados (cost_center_id) and their budgets - name: Audit description: >- Read-only company audit trail. Requires audit.view for employee / personal API keys. Company x-api-key sees the full company. Tenant scope is audit_logs.company_id (FS-03: never attributed by actor). - name: Operations description: Operations for creating and managing financial operations - name: Operation Types description: Company operation types management - name: Transaction Types description: Company transaction types management - name: WhatsApp Tools description: >- Company-scoped WhatsApp bot operation tools (Configuración > WhatsApp > Tools). Same WhatsAppOperationTool rows as the dashboard. Authenticate with x-api-key. - name: External client description: >- Exports for external (portal-linked) clients. Authenticate with `x-api-key` (company-owned client ID) or `Authorization: Bearer` (Auth.js session for an ExternalAccessGrant). - name: Mesas description: >- Company FX trading desks (mesas). Same records and paths as the dashboard Mesas module. Integrators authenticate with x-api-key; the dashboard uses an employee session. Superadmin must set mesas_enabled first; there is no public PATCH for that flag. created_by / opened_by / closed_by are null for API-key callers. - name: Home metrics description: >- Named dashboard home metrics (list + values). API keys receive the Métricas-group cards (day P&L, commissions, cost centers) without the metrics-password cookie. Employee sessions need the matching view permission; they still skip the UI password gate on this surface. paths: /api/operations/{id}/attachments: get: tags: - Operations summary: List attachments on an operation description: >- Returns metadata for files stored on an existing operation, using the same OperationAttachment rows and R2 private bucket as the dashboard. Each item includes a temporary signed download URL (1 hour). Tenant-scoped: missing operations and other companies return 404. Employees with assigned clients only see operations they can already view. parameters: - in: path name: id required: true schema: type: integer description: Operation ID responses: '200': description: Attachments for the operation content: application/json: schema: type: object properties: attachments: type: array items: $ref: '#/components/schemas/OperationAttachment' '400': description: Invalid operation ID '401': description: Unauthorized - Missing or invalid API key '404': description: Operation not found or belongs to another company '500': description: Server error security: - apiKey: [] components: schemas: OperationAttachment: type: object description: >- Metadata for a file stored on an existing operation. signed_url is a temporary R2 download link (1 hour). properties: id: type: integer file_name: type: string mime_type: type: string nullable: true enum: - application/pdf - image/jpeg - image/png - image/gif - image/webp - image/bmp - image/tiff - image/svg+xml - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet - application/vnd.ms-excel.sheet.macroEnabled.12 - application/vnd.ms-excel - >- application/vnd.openxmlformats-officedocument.wordprocessingml.document - application/msword - >- application/vnd.openxmlformats-officedocument.presentationml.presentation - application/vnd.ms-powerpoint - text/csv - text/tab-separated-values - text/plain - application/json - application/xml - text/xml - application/zip - application/octet-stream size_bytes: type: integer nullable: true created_at: type: string format: date-time uploaded_by: $ref: '#/components/schemas/PublicAuditActor' signed_url: type: string format: uri nullable: true description: Temporary signed download URL (expires in 3600 seconds) PublicAuditActor: type: object description: >- Resolved actor for an audit event or operation. Email is included because audit_logs.changed_by stores only the employee email; without it integrators cannot tell two people with the same display name apart. It is Employee.email, never an AuthUser secret, password hash, or session token. id is null when the email does not match a current employee of this company (deleted employee, missing GUC, company API key write). properties: id: type: integer nullable: true name: type: string nullable: true email: type: string nullable: true securitySchemes: apiKey: type: apiKey in: header name: x-api-key description: API Key for authentication ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.