Microsoft Exchange Attachments API

openapi: 3.1.0
info:
  title: Microsoft Exchange Exchange Online Admin Accepted Domains Attachments API
  description: REST-based administrative API that enables a focused set of Exchange cmdlets and parameters as POST-only endpoints. Provides access to key tasks previously available through Exchange Web Services (EWS), including organization configuration, accepted domains, mailbox properties, mailbox folder permissions, and distribution group membership. Built as a complementary REST-first surface for specific administrative tasks caused by the EWS deprecation planned for October 2026.
  version: 2.0.0
  contact:
    name: Microsoft Support
    url: https://support.microsoft.com
    email: support@microsoft.com
  license:
    name: Microsoft API License
    url: https://www.microsoft.com/en-us/legal/terms-of-use
  x-date-modified: '2026-03-04'
servers:
- url: https://outlook.office365.com/adminapi/v2.0
  description: Exchange Online Admin API v2.0 endpoint
security:
- oauth2: []
tags:
- name: Attachments
  description: Operations for managing message attachments
paths:
  /me/messages/{message-id}/attachments:
    get:
      operationId: listMessageAttachments
      summary: Microsoft Exchange List message attachments
      description: Retrieve a list of attachment objects attached to a message. Includes file attachments, item attachments, and reference attachments.
      tags:
      - Attachments
      parameters:
      - $ref: '#/components/parameters/MessageIdParam'
      - $ref: '#/components/parameters/SelectParam'
      responses:
        '200':
          description: Successfully retrieved attachments
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttachmentCollectionResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: addMessageAttachment
      summary: Microsoft Exchange Add attachment to message
      description: Add a file, item, or reference attachment to a message. This operation limits the size of the attachment to 3 MB. For larger attachments, use the upload session approach.
      tags:
      - Attachments
      parameters:
      - $ref: '#/components/parameters/MessageIdParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Attachment'
      responses:
        '201':
          description: Successfully added attachment
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Attachment'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  schemas:
    AttachmentCollectionResponse:
      type: object
      description: Collection of attachments
      properties:
        '@odata.context':
          type: string
        value:
          type: array
          items:
            $ref: '#/components/schemas/Attachment'
    Attachment:
      type: object
      description: A file or item attached to a message
      properties:
        '@odata.type':
          type: string
          description: 'The OData type of the attachment. Use #microsoft.graph.fileAttachment for file attachments or #microsoft.graph.itemAttachment for item attachments.'
        id:
          type: string
          readOnly: true
          description: The attachment's unique identifier
        name:
          type: string
          description: The display name of the attachment
        contentType:
          type: string
          description: The MIME type of the attachment
        size:
          type: integer
          readOnly: true
          description: The size in bytes of the attachment
        isInline:
          type: boolean
          description: Indicates if the attachment is inline
        lastModifiedDateTime:
          type: string
          format: date-time
          readOnly: true
          description: The date and time the attachment was last modified
        contentBytes:
          type: string
          format: byte
          description: The base64-encoded contents of the file (for fileAttachment)
        contentId:
          type: string
          description: The ID of the attachment in the Exchange store
    ODataError:
      type: object
      description: OData error response
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: The error code
            message:
              type: string
              description: The error message
            innerError:
              type: object
              properties:
                request-id:
                  type: string
                date:
                  type: string
                  format: date-time
  parameters:
    SelectParam:
      name: $select
      in: query
      description: Comma-separated list of properties to include in the response
      schema:
        type: string
    MessageIdParam:
      name: message-id
      in: path
      required: true
      description: The unique identifier of the message
      schema:
        type: string
  responses:
    NotFound:
      description: Not found - the specified resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    Unauthorized:
      description: Unauthorized - authentication is required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    BadRequest:
      description: Bad request - the request body or parameters are invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
  securitySchemes:
    oauth2:
      type: oauth2
      description: OAuth 2.0 authorization with Microsoft identity platform
      flows:
        clientCredentials:
          tokenUrl: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
          scopes:
            https://outlook.office365.com/.default: Default scope for Exchange Online Admin API