It appears that Jira Cloud apps cannot download file attachments.
The REST API method GET /rest/api/3/attachment/{id} returns the metadata of the attachment, not the file itself. Its JSON response includes a link to download the attachment, but the link is in form of “…/jira/secure/…”, which cannot be accessed by the Connect app.
I ran a quick test and was able to download the content of a text file attachment. I wonder if there are any extra permission restrictions being applied in your case.
I’ve also created [ACJIRA-2209] - Ecosystem Jira because the API for downloading an attachment is not sufficiently documented.
after further investigation we can confirm that attachments are accessible using JWT authentication.
The errors we encountered seem to be caused by the url encoding of spaces in the filename of the attachments.
Expanding the documentation would be indeed very helpful to developers.
When we saw the 401 - Unauthorized errors, we thought that there is maybe a system restriction that requires a session with an authenticated user, since the URLs for the contents of the attachments are not in the “/rest/api/” namespace but in “/secure”. Thus one might think that accessing the contents is not part of the REST API available for Connect addons.