add return url in attachment api
fix safe_content