Attachments

When someone sends a file to one of your inboxes, Notix stores it with the message. You can open it in the console, or download it from a link in the API answer or the webhook.

Where attachments show up

• In the console. Each received message in the Inbox lists its files under the text. Select one to download it.
• In the `email.received` webhook. The payload's attachments list has each file's name, type, size and a download link.
• In the API. Get a received message returns the same list.

Each attachment looks like this:

{
  "filename": "bank-statement.pdf",
  "contentType": "application/pdf",
  "size": 184220,
  "url": "https://..."
}

size is in bytes.

Download a file

1. 1

   Get the message

   Read the message by its id, from the webhook or the list of received messages.

   bashCopy

   curl https://app.usenotix.dev/api/v1/inbound/messages/inm_8f2k1 \
     -H "Authorization: Bearer $NOTIX_API_KEY"
   

2. 2

   Download each file

   Fetch each url with a plain GET. The link needs no API key.

   bashCopy

   curl -o bank-statement.pdf "<url from the attachments list>"
   

3. 3

   Store what you need

   Copy the file into your own storage if you need to keep it.

Work with attachments one at a time

Three calls let you handle a message's files without reading the whole message:

import { Notix } from "notix-js";

const notix = new Notix(process.env.NOTIX_API_KEY);

const { data: page } = await notix.inbound.list({ limit: 10 });
const message = page?.data[0];
if (message) {
  const { data: files } = await notix.inbound.listAttachments(message.messageId);
  const first = files?.data[0];
  if (first) {
    const { data: link } = await notix.inbound.getAttachmentLink(message.messageId, first.id);
    console.log(first.filename, link?.url);
  }
}

curl https://app.usenotix.dev/api/v1/inbound/messages/inm_8f2k1/attachments \
  -H "Authorization: Bearer $NOTIX_API_KEY"

A download always comes as a file, never shown inline. HTML, SVG and other types a browser could run are sent as application/octet-stream. The 5 minute link works for anyone who holds it, so do not log it or pass it on. Messages that fail the virus check keep no attachments.

The MCP tools list_inbound_attachments and get_inbound_attachment give an AI agent the file names and a short-lived link, never the file itself. See AI agents and untrusted email.

Get the whole original message

Download the original message returns the message exactly as it arrived, as an .eml file, with every attachment inside it. Notix keeps the original for 30 days. After that the call answers 422.

curl -o message.eml https://app.usenotix.dev/api/v1/inbound/messages/inm_8f2k1/raw \
  -H "Authorization: Bearer $NOTIX_API_KEY"

Treat files as untrusted

Anyone can send a file to an inbox address. Notix checks every message for viruses and puts anything caught in Spam, which never reaches your webhook. Still treat a file like any upload from the internet: check its type before you open it, and never run it. Messages over 40 MB are dropped.

For sending files with your own email, see Attachments.