Get Timesheet Attachments

Retrieve temporary download URLs for the photos and files attached to a timesheet. This endpoint returns a temporary, ready-to-download URL for each attachment on a given timesheet.

The URLs point directly at secure file storage, so you download the files straight from there — no additional authentication needed on the download itself.

📘
The URLs are temporary
Each URL is valid for 1 hour from the moment you request it. Download the files promptly rather than saving the URLs for later. See Working with the URLs below.

Request

GET https://api.timeero.app/api/public/attachments/{timesheetId}

Path parameters

Parameter	Type	Required	Description
`timesheetId`	integer	Yes	ID of the timesheet whose attachments you want. Must be numeric.

Headers

Header	Value
`Authorization`	Your Public API key

Example

curl --request GET \
  --url 'https://api.timeero.app/api/public/attachments/12345' \
  --header 'Authorization: YOUR_API_KEY'

Response

200 OK

{
  "items": [
    "https://timeero-filevault.s3.ap-south-1.amazonaws.com/images/company_id_5/3egVeHKmrDpl0XZrOVOFYLxdrtH5Qb8PaAgEJm7z.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=...&X-Amz-Date=20260803T135718Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=...",
    "https://timeero-filevault.s3.ap-south-1.amazonaws.com/images/company_id_5/9kTpQ2mNvXbR7wLsYhF4jD8cZaG1oE6uH3iK5nMx.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=...&X-Amz-Date=20260803T135718Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=..."
  ],
  "message": "Attachments loaded successfully."
}

Response fields

Field	Type	Description
`items`	array of strings	One temporary download URL per attachment. Empty array if the timesheet has no attachments.
`message`	string	Confirmation message.

Issue a plain GET against any URL in items to download that file. Do not send your API key with those requests — the URL already carries its own authorization.

👍
A timesheet with no attachments is not an error
You'll get 200 OK with "items": []. The same applies to a timesheet ID that doesn't exist in your account.

Working with the URLs

Each URL carries a signature valid for 1 hour (X-Amz-Expires=3600).

Request them when you're ready to download. Every call to this endpoint generates brand new URLs, so there's no need to track expiry on your side — just call the endpoint again whenever you need the files.

Don't store the URLs. If you need long-term access to an attachment, download the file and keep your own copy. A saved URL stops working after an hour and cannot be renewed or extended.

⚠️
Treat the URLs as confidential
Anyone who obtains one of these URLs can download that file for the remainder of its hour, without your API key. Avoid writing them to application logs, pasting them into tickets or chat, or exposing them in client-side code you don't control.

Errors

Status	Meaning	How to fix
`401 Unauthorized`	API key missing or invalid	Check the `Authorization` header. See Authentication.
`404 Not Found`	`timesheetId` was not a number, e.g. `/attachments/abc`	Pass a numeric timesheet ID.
`500 Internal Server Error`	Unexpected error on our side	Retry; contact support if it persists.

See the Get timesheet attachments section of the API Reference for full response details.