Attachment fetching through REST API fails with 400 error

[Martin W]

Attempting to fetch attachment content and thumbnails through the v2 API results in a 400 response with a body and headers as shown in the attached screenshots.

We are using OAuth to facilitate access with the required scopes as listed in the API docs.
The call is failing when accessed via api.atlassian.net/ex/jira/{cloudId}/rest/api/2/attachment/{id} and
<your-site>rest/api/2/attachment/content/{id}.

All other API calls with the same token are functioning correctly and the content is able to be downloaded using basic auth.

This issue started occurring at around 3rd December 07:00 UTC across multiple Jira cloud instances. I have not seen anything indicating an issue on the Jira side via status.atlassian.com and see no API changelogs to indicate the API should be functioning any differently than we expect.

Please advise.

Thanks,

Martin

[Mercy]

It looks like you’re hitting the attachment download endpoints that still require cookie-based auth or direct authentication rather than pure OAuth scopes. Even with `read:jira-work` or similar scopes, the `/attachment/{id}` and `/attachment/content/{id}` URLs can return 400 or 403 if the request isn’t including a valid session context. For OAuth apps, the supported approach is to first GET the attachment metadata via `/rest/api/3/attachment/{id}`, then use the `content` or `thumbnail` URLs in that payload, making sure to pass the OAuth bearer token in the `Authorization` header when fetching them.