How to list ticket attachments in Zoho Desk

Listing ticket attachments in Zoho Desk is straightforward via the REST API: send a GET request to the attachments sub-resource of any ticket, and the platform returns all files associated with that record.

Why this matters

When building integrations, automations, or audit workflows, you often need to inspect every file a customer has submitted alongside their support request. Retrieving the attachment list programmatically lets you mirror files to external storage, validate uploads, or surface them inside a custom portal — without requiring an agent to open the ticket manually.

Step-by-step

Step 1. Confirm your OAuth scopes are in place.

Before making any API call, verify that your connected app has been granted the Desk.tickets.READ scope (at minimum) or the broader Desk.tickets.ALL scope. Without these, the request will be rejected at the authorization layer. ^[8]

Step 2. Identify the ticket ID.

Every Zoho Desk ticket has a unique numeric ticketId. You can obtain this from a prior ticket-list call, from the ticket URL in the Desk UI, or from a webhook payload. Hold onto this value — it is the key path parameter for the next step.

Step 3. Send the list-attachments request.

Issue an HTTP GET to the following endpoint, substituting your real ticket identifier:

GET /api/v1/tickets/{ticketId}/attachments

The optional query-parameter object p can carry pagination or filtering arguments supported by the Zoho Desk API. ^[2][3]

A minimal Python implementation looks like this:

def list_ticket_attachments(self, ticketId: str, p: dict = None):
    return self.c.request(
        "GET",
        f"/api/v1/tickets/{ticketId}/attachments",
        p,
        None
    )

The method passes None as the request body (correct for a GET) and forwards any query parameters through p. ^[2]

Step 4. Parse the response.

The API returns a collection of attachment objects. Each object typically includes metadata such as the file name, size, and a reference ID you can use for follow-up operations.

Step 5. Fetch a single attachment when needed.

If you only need the details of one specific file, use the single-resource variant by appending the attachmentId to the path:

GET /api/v1/tickets/{ticketId}/attachments/{attachmentId}

This is useful when you already know the identifier from a previous list call and want to avoid processing the full collection. ^[5]

Step 6. (Optional) Retrieve attachments tied to a transition draft.

If your workflow uses ticket transitions (e.g., approval stages), attachments can also be scoped to a specific transition. Use the dedicated endpoint:

GET /api/v1/tickets/{ticketId}/transitions/{transitionId}/attachments

This is separate from the main attachment list and only applies when a transition draft is in progress. ^[7]

Common pitfalls

• Missing or incorrect scope. The Desk.tickets.READ scope must be present in your OAuth token. If you see a 401 or 403 response, re-check the scopes configured for your client and regenerate the access token. ^[8]
• Confusing ticketId with the human-readable ticket number. The path parameter must be the internal numeric ID, not the #1234-style reference shown in the UI. Using the display number will return a 404.
• Forgetting pagination. If a ticket has many attachments, the response may be paginated. Pass the appropriate page parameter through the p dictionary to retrieve subsequent pages. ^[2][3]
• Uploading vs. listing. The same path (/api/v1/tickets/{ticketId}/attachments) is used for both listing (GET) and uploading (POST). Make sure your integration uses the correct HTTP verb; a POST to that endpoint will create a new attachment rather than return the existing ones. ^[4][6]

What to check

• Scope verification: Confirm that Desk.tickets.READ or Desk.tickets.ALL appears in the active OAuth token before going live. ^[8]
• Response structure: Log the raw response from the first call to confirm the attachment metadata fields (name, size, ID) match what your downstream code expects. ^[2][5]
• Ticket ID source: Trace where your ticketId originates and validate it is the internal system ID, not a display reference, to avoid silent 404 errors.

---

*Beam Help is an independent expert support resource for Zoho products — we are not official Zoho support. For platform-level issues, always cross-reference the official Zoho Desk API documentation.*