> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List a finding's attachments

> List the evidence files attached to a finding. Human tokens only; machine org tokens are rejected.



## OpenAPI

````yaml /api-reference/openapi.json get /api/v1/orgs/{orgSlug}/findings/{findingId}/attachments
openapi: 3.0.3
info:
  title: Tolmo API
  version: 1.0.0
  description: >-
    The Tolmo REST API. Every endpoint is scoped to one organization and
    authenticated with an API token.
servers:
  - url: https://api.tolmo.com
    description: Production
security:
  - bearerAuth: []
paths:
  /api/v1/orgs/{orgSlug}/findings/{findingId}/attachments:
    get:
      tags:
        - findings
      summary: List a finding's attachments
      description: >-
        List the evidence files attached to a finding. Human tokens only;
        machine org tokens are rejected.
      operationId: listFindingAttachments
      parameters:
        - schema:
            type: string
          in: path
          name: orgSlug
          required: true
        - schema:
            type: string
            format: uuid
            pattern: >-
              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
          in: path
          name: findingId
          required: true
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                      format: uuid
                      pattern: >-
                        ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                    findingId:
                      type: string
                      format: uuid
                      pattern: >-
                        ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                    fileName:
                      type: string
                    title:
                      nullable: true
                      type: string
                    contentType:
                      type: string
                    sizeBytes:
                      type: integer
                      minimum: -9007199254740991
                      maximum: 9007199254740991
                    sha256:
                      type: string
                    uploadedBy:
                      type: string
                    createdAt:
                      type: string
                  required:
                    - id
                    - findingId
                    - fileName
                    - title
                    - contentType
                    - sizeBytes
                    - sha256
                    - uploadedBy
                    - createdAt
                  additionalProperties: false
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        A Tolmo API token, sent as `Authorization: Bearer <token>`. Either a
        user token (`usr_tok.*`, minted by `tolmo auth login`, scoped to your
        own permissions) or an org API token created in the Tolmo app, for CI
        and automation.

````