Download Attachment

Overview

The Download Attachment endpoint retrieves a document attached to a worksheet/Order in cieTrade and returns it as a binary file stream. This does not include/support internally generated cieTrade Documents, only works for attachments with a DocType ='Attachment'. The response is sent as a file attachment using the document name stored in cieTrade as the filename, with a content type that matches the file's extension. Documents stored in compressed form are decompressed automatically before they are returned, so the caller always receives the original file.

The document to be downloaded is identified by its unique document ID, which can be obtained from any of the List Attachment endpoints.

Authentication

All calls to this endpoint require a valid bearer token passed in the HTTP Authorization header. The token is validated together with the UserID query string parameter, and the combination determines which client database the request connects to.

Authorization: Bearer YOUR_TOKEN

Requests without an Authorization header, or with a scheme other than Bearer, are rejected with a 400 Bad Request.

Endpoint Details

Method	GET
URL	`https://api.cietrade.net/DownloadAttachment`
Headers	`Authorization: Bearer YOUR_TOKEN`
Content-Type	Not required — parameters are passed via query string.

Query String Parameters

This endpoint uses a GET request. All parameters are passed as query string values appended to the endpoint URL. There is no request body.

Example: https://api.cietrade.net/DownloadAttachment?UserID=Example@cieTrade.com&DocID=10045

Parameter	Type	Required	Description
UserID	String	Yes	The LoginID of the user making the request. Validated together with the bearer token to authorize the call.
DocID	String	Yes	The unique identifier of the document to download. This value is returned by the List Attachments endpoint.
DocType	String	No	Reserved for future use. Accepted but currently ignored.

Response

Success

On success the endpoint returns 200 OK with the document as a binary file stream. The response includes the following headers:

Header	Value
Content-Type	Based on the document's file extension (see table below).
Content-Disposition	`attachment; filename="…"; filename*=UTF-8''…` — the filename is the document name stored in cieTrade.

Content Types

File Extension	Content-Type
pdf	`application/pdf`
jpg, jpeg	`image/jpeg`
png	`image/png`
doc	`application/msword`
docx	`application/vnd.openxmlformats-officedocument.wordprocessingml.document`
xls	`application/vnd.ms-excel`
xlsx	`application/vnd.openxmlformats-officedocument.spreadsheetml.sheet`
txt	`text/plain`
eml	`message/rfc822`
Any other extension	`application/octet-stream`

Errors

Error responses return a JSON body with a Message property describing the problem.

Status	Message	Cause
400 Bad Request	Error: Request must include a bearer authorization token	The `Authorization` header is missing or does not use the `Bearer` scheme.
400 Bad Request	Error: Request must include a target Docuemnt.	The `DocID` parameter is missing or empty.
400 Bad Request	Error: Authentication Error	The bearer token and `UserID` could not be authenticated. The message contains the reason returned by the authentication service.
404 Not Found	Document not found.	No document exists with the given `DocID`.
404 Not Found	Error: Contact cieTrade Support	An error occurred while retrieving the document. The message contains the error details.

Example error body:

{
    "Message": "Document not found."
}

Usage Note

Because this endpoint requires an Authorization header, it cannot be called by navigating the browser directly to the URL (for example with window.location.href or a plain link) — the browser has no way to attach the bearer token. Use a fetch call with blob handling instead.

Fetch with blob handling. Use a fetch call that includes the bearer token to retrieve the binary response, convert it to a blob, and programmatically trigger a download link in the browser. The filename can be read from the Content-Disposition response header.

var url = 'https://api.cietrade.net/DownloadWorksheetAttachment'
        + '?UserID=' + encodeURIComponent(userId)
        + '&DocID=' + encodeURIComponent(docId);

fetch(url, {
    method: 'GET',
    headers: { 'Authorization': 'Bearer ' + token }
})
    .then(function(response) {
        if (!response.ok) {
            return response.json().then(function(err) { throw new Error(err.Message); });
        }

        // Pull the filename from the Content-Disposition header
        var fileName = 'download';
        var disposition = response.headers.get('Content-Disposition');
        if (disposition) {
            var match = /filename\*=UTF-8''([^;]+)/i.exec(disposition)
                     || /filename="?([^";]+)"?/i.exec(disposition);
            if (match) { fileName = decodeURIComponent(match[1]); }
        }

        return response.blob().then(function(blob) { return { blob: blob, fileName: fileName }; });
    })
    .then(function(result) {
        var blobUrl = window.URL.createObjectURL(result.blob);
        var a = document.createElement('a');
        a.href = blobUrl;
        a.download = result.fileName;
        document.body.appendChild(a);
        a.click();
        a.remove();
        window.URL.revokeObjectURL(blobUrl);
    })
    .catch(function(error) {
        alert('Download failed: ' + error.message);
    });

When calling from a browser on a different origin, the server must include Content-Disposition in its Access-Control-Expose-Headers CORS setting; otherwise the header is hidden from JavaScript and the fallback filename is used.

Server-to-server example (cURL)

curl -H "Authorization: Bearer YOUR_TOKEN" \
     -OJ "https://api.cietrade.net/DownloadWorksheetAttachment?UserID=YOUR_USER_ID&DocID=10045"

The -OJ flags save the file using the filename from the Content-Disposition header.