Microsoft Exchange Attachments API

openapi: 3.2.0
info:
  title: Microsoft Exchange Microsoft Graph Mail Attachments API
  description: Access Exchange Online mailboxes through the Microsoft Graph API, providing modern REST endpoints for reading, sending, and managing email messages, drafts, attachments, and mail folders. Supports accessing data in users' primary mailboxes and shared mailboxes stored in the cloud on Exchange Online as part of Microsoft 365.
  version: 1.0.0
  contact:
    name: Microsoft Support
    url: https://support.microsoft.com
    email: support@microsoft.com
  license:
    name: Microsoft API License
    url: https://www.microsoft.com/en-us/legal/terms-of-use
  x-date-modified: '2026-03-04'
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph v1.0 production endpoint
security:
- oauth2: []
tags:
- name: Attachments
  description: Operations for managing message attachments
paths:
  /me/messages/{message-id}/attachments:
    get:
      operationId: listMessageAttachments
      summary: Microsoft Exchange List message attachments
      description: Retrieve a list of attachment objects attached to a message. Includes file attachments, item attachments, and reference attachments.
      tags:
      - Attachments
      parameters:
      - $ref: '#/components/parameters/MessageIdParam'
      - $ref: '#/components/parameters/SelectParam'
      responses:
        '200':
          description: Successfully retrieved attachments
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttachmentCollectionResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: addMessageAttachment
      summary: Microsoft Exchange Add attachment to message
      description: Add a file, item, or reference attachment to a message. This operation limits the size of the attachment to 3 MB. For larger attachments, use the upload session approach.
      tags:
      - Attachments
      parameters:
      - $ref: '#/components/parameters/MessageIdParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Attachment'
      responses:
        '201':
          description: Successfully added attachment
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Attachment'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    BadRequest:
      description: Bad request - the request body or parameters are invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    NotFound:
      description: Not found - the specified resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    Unauthorized:
      description: Unauthorized - authentication is required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
  schemas:
    AttachmentCollectionResponse:
      type: object
      description: Collection of attachments
      properties:
        '@odata.context':
          type: string
        value:
          type: array
          items:
            $ref: '#/components/schemas/Attachment'
    ODataError:
      type: object
      description: OData error response
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: The error code
            message:
              type: string
              description: The error message
            innerError:
              type: object
              properties:
                request-id:
                  type: string
                date:
                  type: string
                  format: date-time
    Attachment:
      type: object
      description: A file or item attached to a message
      properties:
        '@odata.type':
          type: string
          description: 'The OData type of the attachment. Use #microsoft.graph.fileAttachment for file attachments or #microsoft.graph.itemAttachment for item attachments.'
        id:
          type: string
          readOnly: true
          description: The attachment's unique identifier
        name:
          type: string
          description: The display name of the attachment
        contentType:
          type: string
          description: The MIME type of the attachment
        size:
          type: integer
          readOnly: true
          description: The size in bytes of the attachment
        isInline:
          type: boolean
          description: Indicates if the attachment is inline
        lastModifiedDateTime:
          type: string
          format: date-time
          readOnly: true
          description: The date and time the attachment was last modified
        contentBytes:
          type: string
          format: byte
          description: The base64-encoded contents of the file (for fileAttachment)
        contentId:
          type: string
          description: The ID of the attachment in the Exchange store
  parameters:
    MessageIdParam:
      name: message-id
      in: path
      required: true
      description: The unique identifier of the message
      schema:
        type: string
    SelectParam:
      name: $select
      in: query
      description: Comma-separated list of properties to include in the response
      schema:
        type: string
  securitySchemes:
    oauth2:
      type: oauth2
      description: OAuth 2.0 authorization with Microsoft identity platform
      flows:
        authorizationCode:
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
          tokenUrl: https://login.microsoftonline.com/common/oauth2/v2.0/token
          scopes:
            Mail.Read: Read user mail
            Mail.ReadWrite: Read and write access to user mail
            Mail.Send: Send mail as a user
            Mail.ReadBasic: Read user basic mail