list_attachments
The files pinned on one artefact, newest first, each with its name, size, kind, uploader and the REST endpoint that streams its bytes; the agreed record only for a guest token.
Return the files pinned on one artefact, newest first: each with its name, size in bytes, MIME type and kind (image, document, spreadsheet, presentation, archive, text or other), who uploaded it and when, and the REST endpoint that streams its bytes to the same token. Read it when a story, a requirement or a decision names a wireframe, a specification or a sample, so you fetch the right file rather than guess at it; the MCP transport carries JSON, so the bytes come over REST.
The artefact is named by artefact_type (epic, work-item, requirement, business-rule, use-case, raid-item, decision, data-entity or glossary-term) and artefact_id. A guest token reads the files on the agreed record only. Uploading and removing files stays with people and the REST API.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
artefact_type*stringThe artefact's type.
epicwork-itemrequirementbusiness-ruleuse-caseraid-itemdecisiondata-entityglossary-termbaselinechange-requestartefact_id*stringUUID of the artefact whose attachments to list.
What it returns
{ "data": [ { "id": "c9d0e1f2-a3b4-4c5d-9e6f-7a8b9c0d1e23", "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13", "artefact_type": "work-item", "artefact_id": "0f9e8d7c-6b5a-4c3d-8e2f-1a0b9c8d7e6f", "name": "checkout-wireframe.png", "size": 184320, "mime": "image/png", "kind": "image", "uploaded_by": "c3d4e5f6-a7b8-4c9d-8e0f-1a2b3c4d5e6f", "uploader_name": "Jane Doe", "download_url": "https://api.example.test/v1/attachments/c9d0e1f2-a3b4-4c5d-9e6f-7a8b9c0d1e23/download", "created_at": "2026-10-28T09:20:00+00:00" } ]}How it fails
VALIDATION_FAILEDartefact_type is not one of the nine; the response lists them.
RESOURCE_NOT_FOUNDunknown artefact_id, an artefact of a project outside the token's scope or the person's visibility, or an artefact a guest token may not read.
FORBIDDENthe token holder's role on the project does not carry attachment:view-any.
TOKEN_MISSING_ABILITYtoken lacks attachment:view-any.
How is this guide?
Last updated on