How to get an attachment's data with the openproject API - json

Question

I'm currently trying to show the data about an openproject workpackage in my website using the openproject api v3 (I'm using PHP with symfony.).
I have no issue getting the general data (subject, description, priority, etc), but I'm not sure I know how to show the attachments to the user.
I tried using "/api/v3/work_packages/".$id."/attachments", but there is no image in the json returned:
"_type":"Collection",
"total":1,
"count":1,
"_embedded":{
"elements":[{
"_type":"Attachment",
"id":1888,"fileName":"128-128-logo.png",
"fileSize":9583,
"description":{"format":"plain","raw":null,"html":""},
"contentType":"image/png",
"digest":{"algorithm":"md5","hash":"/*-hash-here-*/"},
"createdAt":"2018-07-09T16:49:26Z",
"_links":{
"self":{"href":"/api/v3/attachments/1888","title":"128-128-logo.png"},
"author":{"href":"/api/v3/users/7","title":"User Name"},
"container":{"href":"/api/v3/work_packages/1697","title":"Subject -\u003E Test Query OpenProject"},
"downloadLocation":{"href":"/attachments/1888/128-128-logo.png"},
"delete":{"href":"/api/v3/attachments/1888","method":"delete"}
}
}]
},
"_links":{
"self":{"href":"/api/v3/work_packages/1697/attachments"}
}
I also tried with a direct link to the attachment, but got
"_type":"Attachment",
"id":1888,
"fileName":"128-128-logo.png",
"fileSize":9583,
"description":{"format":"plain","raw":null,"html":""},
"contentType":"image/png",
"digest":{"algorithm":"md5","hash":"/*-hash-here-*/"},
"createdAt":"2018-07-09T16:49:26Z",
"_links":{
"self":{"href":"/api/v3/attachments/1888","title":"128-128-logo.png"},
"author":{"href":"/api/v3/users/7","title":"User Name"},
"container":{"href":"/api/v3/work_packages/1697","title":"Subject -\u003E Test Query OpenProject"},
"downloadLocation":{"href":"/attachments/1888/128-128-logo.png"},
"delete":{"href":"/api/v3/attachments/1888","method":"delete"}
}
The download location is not an API url and return 406 - unauthorised if I try to access it with an img tag ( <img src="https://XXXXXX.openproject.com/attachments/1888/128-128-logo.png"> )
So I guess my question is: How do I show my users the attachments even if they don't have an account on my openproject?

Answer 1

To show the attachment on your website you will have to:
Grant anonymous access to your openproject instance.
Have the attachment in a public project, meaning that it will have to be attached to a work package, wiki page ... of a public project
Grant anonymous access to your openproject instance
Uncheck "Authentication required" in the system settings ("Administration" -> "System settings" -> "Authentication" (Tab)") and save.
Turn project public
Check "Public" in the project settings (After navigating to a project -> "Project settings" -> "Information" (Tab)) and save.
Only attachments attached to a resource of that now public project will be accessible by your website.
Consequences
Everyone will be able to access your OpenProject instance, at least the part with the public project.
Alternative 1
If it is a private website and all visitors of that website will also have an account on the OpenProject instance and if it is assured, that they will always be logged into OpenProject when visiting the website, their browser will send the session cookie to the OpenProject instance automatically upon fetching the image which will result in them being authorized to get the attachment.
Alternative 2
Once OP 8.0 is released, API clients will be able to download attachments. Then a script with an API key could download the attachments of interest and store them in a location accessible to your website. The website visitors would then get the attachment from the website directly.