Feature
SuiteCRM 7 provides two ways to retrieve a Note's file attachment:
- The legacy download entry point (
index.php?entryPoint=download&id=...&type=Notes), used by the UI and commonly by integrations.
- The V8 REST API can create a Note with a file via the
filecontents attribute — and in a 7.x install the entry point above covers the read side.
In SuiteCRM 8 there is no working equivalent for programmatic download:
- The V8 API (served from
public/legacy) still accepts filecontents on Note creation, but GET /Api/V8/module/Notes/{id} returns only metadata — there is no endpoint that returns the stored file.
- The new SuiteCRM 8 GraphQL API does not expose attachment content either.
- The legacy
entryPoint=download URL is not a substitute for API clients: it is session-authenticated rather than OAuth2, and in our SuiteCRM 8.8.0 testing the legacy-URL compatibility layer fatals on this route before reaching the download code (it appears to enter entryPoint.php twice and dies in LanguageManager). Happy to file that separately as a bug with a stack trace if useful.
Net effect: an integration can push a file into SuiteCRM 8 through the API but can never get it back out. Round-tripping attachments (the obvious use case for filecontents) is write-only.
Context
Our use case: a customer portal that files support cases into SuiteCRM as Cases with Note attachments via the V8 API. Uploading works; when an agent attaches a file to their reply, the portal has no supported way to serve it back to the customer.
We worked around it with an upgrade-safe custom V8 route (a single file under custom/application/Ext/Api/V8/Config/routes.php, no core changes) that runs inside the existing OAuth2 ResourceServerMiddleware:
GET /Api/V8/custom/Notes/{id}/file
It looks the Note up via BeanFactory first (404 unless the row exists — server-generated GUIDs, so arbitrary ids never reach the filesystem), then reads upload://{note_id} using the note's canonical id, and returns JSON:API-shaped filename, file_mime_type, and base64 filecontents — symmetric with what the create call accepts.
We're happy to contribute this upstream as a PR — either roughly as-is against the legacy V8 API, or reshaped however the team prefers (e.g. as part of the SuiteCRM 8 API proper, or a streamed Content-Disposition response instead of base64 JSON). Mainly we'd like to know whether attachment download is on the v8 API roadmap and, if not, whether a contribution in this area would be accepted.
This is a recurring community ask with no supported answer to date — e.g. note attachment via V8 returns 404, how to obtain note attachments directly, download document through API V8, how to get a file via API v8. Possibly related (but distinct — that one is about the new attachment field type, not Note files): #891.
Tested on SuiteCRM 8.8.0 (PHP 8.x).
Feature
SuiteCRM 7 provides two ways to retrieve a Note's file attachment:
index.php?entryPoint=download&id=...&type=Notes), used by the UI and commonly by integrations.filecontentsattribute — and in a 7.x install the entry point above covers the read side.In SuiteCRM 8 there is no working equivalent for programmatic download:
public/legacy) still acceptsfilecontentson Note creation, butGET /Api/V8/module/Notes/{id}returns only metadata — there is no endpoint that returns the stored file.entryPoint=downloadURL is not a substitute for API clients: it is session-authenticated rather than OAuth2, and in our SuiteCRM 8.8.0 testing the legacy-URL compatibility layer fatals on this route before reaching the download code (it appears to enterentryPoint.phptwice and dies inLanguageManager). Happy to file that separately as a bug with a stack trace if useful.Net effect: an integration can push a file into SuiteCRM 8 through the API but can never get it back out. Round-tripping attachments (the obvious use case for
filecontents) is write-only.Context
Our use case: a customer portal that files support cases into SuiteCRM as Cases with Note attachments via the V8 API. Uploading works; when an agent attaches a file to their reply, the portal has no supported way to serve it back to the customer.
We worked around it with an upgrade-safe custom V8 route (a single file under
custom/application/Ext/Api/V8/Config/routes.php, no core changes) that runs inside the existing OAuth2ResourceServerMiddleware:It looks the Note up via
BeanFactoryfirst (404 unless the row exists — server-generated GUIDs, so arbitrary ids never reach the filesystem), then readsupload://{note_id}using the note's canonical id, and returns JSON:API-shapedfilename,file_mime_type, and base64filecontents— symmetric with what the create call accepts.We're happy to contribute this upstream as a PR — either roughly as-is against the legacy V8 API, or reshaped however the team prefers (e.g. as part of the SuiteCRM 8 API proper, or a streamed
Content-Dispositionresponse instead of base64 JSON). Mainly we'd like to know whether attachment download is on the v8 API roadmap and, if not, whether a contribution in this area would be accepted.This is a recurring community ask with no supported answer to date — e.g. note attachment via V8 returns 404, how to obtain note attachments directly, download document through API V8, how to get a file via API v8. Possibly related (but distinct — that one is about the new attachment field type, not Note files): #891.
Tested on SuiteCRM 8.8.0 (PHP 8.x).