318 attachment api endpoint

closes #318