Download an owned message attachment

Before you start

Connect your business and number in Portal → WhatsApp → Numbers & accounts first. Use an account-owner Production API key. Create templates in the Portal.

Result

Supply the IllyVoIP message_id. Returns the binary file as an attachment, not a JSON success envelope. Production owner credential and current account access required. Only supported image/audio/video/document content is available. Received files are retrieved on demand, integrity-checked and scanned; the saved connection must remain usable. Provider retention or access changes can make an older incoming attachment unavailable. Incoming binary temporary files are removed after the response; metadata/history remain. Outbound files follow their recorded local expiry. Tokens and provider URLs are never returned. Does not send a message, a read receipt, grant consent or debit the wallet.

Charges and safe retries

Inspect uncertain operations before retrying. A queued message is not delivered. IllyVoIP reserves its fee at queue admission and charges only delivered outbound messages; incoming messages are free.

Authentication

Send your account API key in the X-Api-Key header. Keep it on your server; never embed it in browser code.

Request examples

Replace the example values with your own inputs. Examples do not run on this page. Production requests can change your account or incur charges.

curl -X GET "https://app.illyvoip.com/api/v1/whatsapp/messages/attachment?message_id=YOUR_MESSAGE_ID" \
  -H "X-Api-Key: ${ILLYVOIP_API_KEY:?Set ILLYVOIP_API_KEY}" \
  --output attachment.bin

import { writeFile } from 'node:fs/promises';
const response = await fetch("https://app.illyvoip.com/api/v1/whatsapp/messages/attachment?message_id=YOUR_MESSAGE_ID", {
  method: "GET",
  headers: {
    "X-Api-Key": process.env.ILLYVOIP_API_KEY
  }
});

if (!response.ok) throw new Error("HTTP " + response.status + ": " + await response.text());
await writeFile("attachment.bin", Buffer.from(await response.arrayBuffer()));

<?php
$ch = curl_init('https://app.illyvoip.com/api/v1/whatsapp/messages/attachment?message_id=YOUR_MESSAGE_ID');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'X-Api-Key: ' . getenv('ILLYVOIP_API_KEY')
    ],
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . PHP_EOL;
if ($response === false || $status < 200 || $status >= 300) { throw new RuntimeException('Download failed: HTTP ' . $status); }
file_put_contents('attachment.bin', $response);

import os
import json
import requests

response = requests.request(
    "GET",
    "https://app.illyvoip.com/api/v1/whatsapp/messages/attachment?message_id=YOUR_MESSAGE_ID",
    headers={
        "X-Api-Key": os.environ["ILLYVOIP_API_KEY"]
    },
)

print(response.status_code)
response.raise_for_status()
open('attachment.bin', 'wb').write(response.content)

Node.js examples run on the server (Node.js 22.17+). Python examples require requests; PHP examples require cURL. Set the environment variables referenced in each example.

Request parameters

Query parameters

Request behavior

Supply the IllyVoIP message_id. Returns the binary file as an attachment, not a JSON success envelope. Production owner credential and current account access required. Only supported image/audio/video/document content is available. Received files are retrieved on demand, integrity-checked and scanned; the saved connection must remain usable. Provider retention or access changes can make an older incoming attachment unavailable. Incoming binary temporary files are removed after the response; metadata/history remain. Outbound files follow their recorded local expiry. Tokens and provider URLs are never returned. Does not send a message, a read receipt, grant consent or debit the wallet.

Conditions and examples

Production only; no WhatsApp Sandbox is available. Replace placeholders with your own account data. Response examples are abbreviated; use the OpenAPI schemas for the full contract. Meta bills its charges separately.

Response fields

• data: Endpoint-specific result object. Its nested fields are shown in the sample response.

HTTP responses

Expand a status to inspect its documented response format and examples. Example prices, IDs and timestamps are illustrative values, not quotes or account records.

{
  "format": "binary"
}

{
  "type": "string",
  "format": "binary"
}

Production only

This operation is not available in Sandbox. Use an enabled Production account and review its effects before executing.

Related reference