> ## Documentation Index > Fetch the complete documentation index at: https://developers.jobhandy.io/llms.txt > Use this file to discover all available pages before exploring further. # Bestellanhang herunterladen > Lädt das von einem Bestellanhang referenzierte Vertragsdokument herunter. ## Auf einen Blick | Eigenschaft | Verhalten | | ----------------- | -------------------------------------------------------------------------------------------- | | Authentifizierung | Erforderlich in `X-API-Key` | | Tenant-Kontext | Optionale Einschränkung; Ressource und Referenzen müssen im Scope bleiben | | Dry Run | Nicht unterstützt | | Request-Body | Keiner | | Response | Binär- oder Textdatei | | Primärer Erfolg | `200` | | Side Effects | Keine außer dem Herunterladen der autorisierten Ressource | | Retry-Empfehlung | Transiente `429`/`502`/`503`/`504` mit begrenztem Backoff wiederholen; Teildateien verwerfen | ## Betriebsverhalten Lädt das von einem Bestellanhang referenzierte Vertragsdokument herunter. * Verwenden Sie eine Attachment-ID aus einer Bestellungs-Response. Prüfen Sie Status und `Content-Type`, bevor Sie die Response als Datei behandeln. ## Häufige Fehler | Fehlercode | Bedeutung | | ----------------------- | ----------------------------------------------------------- | | `VALIDATION_ERROR` | Schema- oder fachliche Validierung ist fehlgeschlagen | | `INVALID_REQUEST_ID` | `X-Request-ID` ist keine UUID v4 oder v7 | | `INVALID_API_KEY` | API-Key fehlt, ist ungültig, gelöscht oder inaktiv | | `TENANT_NOT_IN_SCOPE` | Ausgewählter Tenant liegt außerhalb des API-Key-Scopes | | `NOT_FOUND` | Ressource fehlt oder ist im Scope nicht zugänglich | | `NOT_ACCEPTABLE` | Angeforderter Response-Medientyp ist nicht verfügbar | | `RATE_LIMIT_EXCEEDED` | Rate Limit des API-Keys wurde überschritten | | `INTERNAL_SERVER_ERROR` | Unerwarteter Serverfehler | | `BAD_GATEWAY` | Upstream-Dokumentabhängigkeit ist fehlgeschlagen | | `SERVICE_UNAVAILABLE` | Dienst oder Abhängigkeit ist nicht verfügbar | | `GATEWAY_TIMEOUT` | Upstream-Dokumentabhängigkeit ist in einen Timeout gelaufen | Die Response-Liste der Operation und die Seite [Fehlerbehandlung](/de/concepts/error-handling) sind für die vollständige Behandlung maßgeblich. ## Vor der Implementierung * Erzeugen und protokollieren Sie für den Versuch eine neue `X-Request-ID`. * Behandeln Sie jeden dokumentierten Response-Status. * Protokollieren Sie weder `X-API-Key` noch unnötige personenbezogene Daten. * Verwerfen Sie unvollständige Dateien nach Netzwerkunterbrechungen oder transienten Upstream-Fehlern. Prüfen Sie den vollständigen Prozess sowie Status-, Retry- und Betriebsmuster für diese Operation. ## OpenAPI ````yaml https://assets.jobhandy.io/api-spec/jobhandy-public-api.openapi.json GET /orders/attachments/{id} openapi: 3.1.0 info: title: JobHandy Public API version: 1.0.0 summary: Production API for HR, order, incident, division, and payroll integrations. description: >- Integrate HR and payroll systems with JobHandy through a versioned REST API. ## Production endpoint All public requests use `https://api.jobhandy.io/v1`. ## Core conventions - Authenticate protected operations with `X-API-Key`. - Use `X-Tenant-ID` where supported to select one tenant within the API-key scope. - Use `X-Request-ID` for end-to-end request correlation. - Validate supported writes with `dryRun=true` before applying them. - Collection endpoints support pagination, sorting, and the documented filter expression language. - Error responses use a stable JSON envelope with a machine-readable error code. Optional query and header parameters are documented but omitted from generated requests by default in the accompanying Mintlify configuration. servers: - url: https://api.jobhandy.io/v1 description: Production security: - apiKeyAuth: [] tags: - name: Employees description: Synchronize employee master data, account state, and division assignments. - name: Orders description: Read employee orders, record HR decisions, and download order documents. - name: Incidents description: Report and maintain employee incidents and upload supported attachments. - name: Divisions description: Maintain organizational divisions, hierarchy, ordering, and cost centers. - name: Payroll export documents description: List payroll export metadata and download generated payroll files. - name: Health description: Check basic public API availability without authentication. paths: /orders/attachments/{id}: get: tags: - Orders summary: Download an order attachment description: Downloads the contract document referenced by an order attachment. operationId: downloadOrderAttachment parameters: - in: path name: id description: Attachment ID from an order response. required: true schema: type: string example: contract.10495.1 - name: X-Tenant-ID description: >- Narrows the operation to one tenant in the API key's scope. Any referenced or target resource must be accessible through that tenant. In interactive clients, use the `{{tenantId}}` variable when a tenant must be selected. Keep the header disabled when tenant selection is not required. in: header required: false schema: type: string pattern: ^[0-9a-fA-F]{24}$ x-mint: post: - optional - not sent by default x-client-default-state: inactive x-default: '{{tenantId}}' - in: header name: X-Request-ID required: false description: >- Optional request identifier. If supplied, it must be a UUID v4 or v7 and is returned unchanged in every response. If omitted, the API generates one. Invalid values return `400 INVALID_REQUEST_ID`. If your client uses a `{{requestId}}` variable, refresh it with a new UUID version 4 or 7 for every HTTP request attempt. Keep the header disabled to let the API generate the request identifier. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ x-mint: post: - optional - not sent by default x-client-default-state: inactive x-default: '{{requestId}}' responses: '200': content: application/pdf: schema: type: string format: binary application/octet-stream: schema: type: string format: binary description: The requested contract document. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 RateLimit-Policy: description: Request quota policy expressed as an HTTP structured field. schema: type: string RateLimit: description: Current request quota availability and effective window. schema: type: string Content-Disposition: description: Download disposition and suggested filename, when provided. schema: type: string example: attachment; filename="document.pdf" Content-Length: description: Downloaded file size in bytes. schema: type: integer example: 245760 '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: validationError: summary: >- The request cannot be parsed or violates the request contract. value: error: code: VALIDATION_ERROR message: The request contains an invalid value. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 invalidRequestId: summary: X-Request-ID is not UUID v4 or v7 value: error: code: INVALID_REQUEST_ID message: The supplied X-Request-ID is invalid. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: The request cannot be parsed or violates the request contract. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 '401': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalidApiKey: summary: API key is missing, invalid, or inactive value: error: code: INVALID_API_KEY message: The supplied API key is missing, invalid, or inactive. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: The X-API-Key credential is missing, invalid, or inactive. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 '403': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: tenantNotInScope: summary: Selected tenant is not in the API-key scope value: error: code: TENANT_NOT_IN_SCOPE message: >- The integration does not have access to the selected tenant. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: The API key does not grant access to the selected tenant. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 RateLimit-Policy: description: Request quota policy expressed as an HTTP structured field. schema: type: string RateLimit: description: Current request quota availability and effective window. schema: type: string '404': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: notFound: summary: >- The resource was not found or is outside the API key's scope. value: error: code: NOT_FOUND message: The requested resource was not found. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: The resource was not found or is outside the API key's scope. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 RateLimit-Policy: description: Request quota policy expressed as an HTTP structured field. schema: type: string RateLimit: description: Current request quota availability and effective window. schema: type: string '406': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: notAcceptable: summary: Accept excludes all success media types value: error: code: NOT_ACCEPTABLE message: >- The endpoint cannot produce a response in a media type accepted by the request. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: The requested response media type is not supported. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 '429': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: rateLimitExceeded: summary: API-key request quota exceeded value: error: code: RATE_LIMIT_EXCEEDED message: The API key request rate limit has been exceeded. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: The API key request rate limit was exceeded. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 RateLimit-Policy: description: Request quota policy expressed as an HTTP structured field. schema: type: string RateLimit: description: Current request quota availability and effective window. schema: type: string Retry-After: description: >- Seconds to wait before retrying after request-rate admission was rejected. schema: type: integer example: 60 '500': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internalServerError: summary: Unexpected server error value: error: code: INTERNAL_SERVER_ERROR message: The request failed. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: An unexpected server error occurred. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 '502': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: badGateway: summary: The file could not be retrieved. value: error: code: BAD_GATEWAY message: The request could not be completed. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: The file could not be retrieved. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 RateLimit-Policy: description: Request quota policy expressed as an HTTP structured field. schema: type: string RateLimit: description: Current request quota availability and effective window. schema: type: string '503': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: serviceUnavailable: summary: File downloads are temporarily unavailable. value: error: code: SERVICE_UNAVAILABLE message: The requested operation is temporarily unavailable. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: File downloads are temporarily unavailable. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 RateLimit-Policy: description: Request quota policy expressed as an HTTP structured field. schema: type: string RateLimit: description: Current request quota availability and effective window. schema: type: string '504': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: gatewayTimeout: summary: The file download timed out. value: error: code: GATEWAY_TIMEOUT message: The request timed out. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: The file download timed out. headers: X-Request-ID: description: Request identifier returned for every public API response. schema: type: string format: uuid pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 RateLimit-Policy: description: Request quota policy expressed as an HTTP structured field. schema: type: string RateLimit: description: Current request quota availability and effective window. schema: type: string security: - apiKeyAuth: [] components: schemas: ErrorResponse: type: object properties: error: allOf: - $ref: '#/components/schemas/ApiError' - type: object description: Public error details. description: Machine-readable and human-readable details for the failed request. example: error: code: INVALID_API_KEY message: The supplied API key is missing, invalid, or inactive. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: Error envelope returned by every public API endpoint. required: - error ApiError: type: object properties: code: type: string example: INVALID_API_KEY description: >- Machine-readable public error code. Values are stable and case-sensitive. - `INVALID_API_KEY`: The API key is missing, invalid, inactive, or otherwise unusable. - `INVALID_REQUEST_ID`: X-Request-ID is not a valid UUID version 4 or 7. - `NOT_ACCEPTABLE`: The Accept header excludes all success media types produced by the operation. - `UNSUPPORTED_MEDIA_TYPE`: The request Content-Type is not supported by the operation. - `MISSING_ATTACHMENT`: A required multipart attachment field or file is missing. - `PAYLOAD_TOO_LARGE`: The complete request body exceeds the documented 5 MiB limit. - `UNKNOWN_QUERY_PARAMETER`: The request contains a query parameter that the operation does not accept. - `UNSUPPORTED_HEADER`: The request contains a header value or header usage that the public contract does not support. - `NOT_FOUND`: The target resource does not exist or is not visible in the caller scope. - `FILE_NOT_FOUND`: The referenced file is not available. - `BAD_GATEWAY`: A downstream file or integration service failed while processing the request. - `SERVICE_UNAVAILABLE`: The requested service is temporarily unavailable. - `GATEWAY_TIMEOUT`: A downstream operation did not complete before the timeout. - `INTERNAL_SERVER_ERROR`: An unexpected server-side error occurred. - `TENANT_CONTEXT_AMBIGUOUS`: The API cannot infer exactly one tenant from the supplied selectors and API-key scope. - `EMPLOYEE_PLACEMENT_AMBIGUOUS`: The API cannot infer one permitted employee division placement. - `TENANT_NOT_IN_SCOPE`: The selected tenant is not accessible to the API key. - `INVALID_REFERENCE_ID`: A referenced identifier is invalid for the requested operation. - `VALIDATION_ERROR`: The request is malformed or a supplied value fails contract or business validation. - `INVALID_FILTER_SYNTAX`: The filter expression cannot be parsed. - `UNSUPPORTED_FILTER_FIELD`: The filter uses a field that the operation does not expose for filtering. - `UNSUPPORTED_FILTER_OPERATOR`: The filter uses an operator that is not supported for the selected field. - `UNSUPPORTED_SORT_FIELD`: The sort field is not supported by the operation. - `UNSUPPORTED_FIELD`: The request contains a field that is not accepted by the operation. - `INVALID_REFERENCE`: A referenced resource cannot be used in the requested context or scope. - `EMPLOYEE_BLOCKED`: The requested operation cannot continue because the employee account is blocked. - `DIVISION_CYCLE`: The requested parent relationship would create a division hierarchy cycle. - `DIVISION_NAME_NOT_UNIQUE_ON_SAME_LEVEL`: A sibling division already uses the requested name. - `DUPLICATE_RESOURCE`: The request would create or update a resource to a value that must be unique. - `INVALID_STATE_TRANSITION`: The requested action is not permitted from the resource current lifecycle state. - `ORDER_ALREADY_DECIDED`: The order already has an HR review decision and cannot be decided again. - `RATE_LIMIT_EXCEEDED`: The API-key request quota has been exceeded. enum: - INVALID_API_KEY - INVALID_REQUEST_ID - NOT_ACCEPTABLE - UNSUPPORTED_MEDIA_TYPE - MISSING_ATTACHMENT - PAYLOAD_TOO_LARGE - UNKNOWN_QUERY_PARAMETER - UNSUPPORTED_HEADER - NOT_FOUND - FILE_NOT_FOUND - BAD_GATEWAY - SERVICE_UNAVAILABLE - GATEWAY_TIMEOUT - INTERNAL_SERVER_ERROR - TENANT_CONTEXT_AMBIGUOUS - EMPLOYEE_PLACEMENT_AMBIGUOUS - TENANT_NOT_IN_SCOPE - INVALID_REFERENCE_ID - VALIDATION_ERROR - INVALID_FILTER_SYNTAX - UNSUPPORTED_FILTER_FIELD - UNSUPPORTED_FILTER_OPERATOR - UNSUPPORTED_SORT_FIELD - UNSUPPORTED_FIELD - INVALID_REFERENCE - EMPLOYEE_BLOCKED - DIVISION_CYCLE - DIVISION_NAME_NOT_UNIQUE_ON_SAME_LEVEL - DUPLICATE_RESOURCE - INVALID_STATE_TRANSITION - ORDER_ALREADY_DECIDED - RATE_LIMIT_EXCEEDED minLength: 1 message: type: string example: The supplied API key is missing, invalid, or inactive. description: Human-readable error summary. minLength: 1 requestId: type: string example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 description: >- Request identifier also returned in the X-Request-ID response header. pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ format: uuid minLength: 1 description: Stable public API error details. required: - code - message - requestId example: code: VALIDATION_ERROR message: The request contains an invalid value. requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4 securitySchemes: apiKeyAuth: type: apiKey name: X-API-Key in: header description: >- JobHandy integration API key. Send the credential in the `X-API-Key` header. Treat the key as a secret and use it only from trusted server-side environments. ````