Using a REST API User with only "user" rights - after receiving a webhook I got a 403 for some of the attachments (e.g. inline images filled from agents).
All other attachments can be processed directly.
To process the 403 I have to wait about 15 minutes until I can access them via REST - with the same user (token based) and then without a 403.
