> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maxcare.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List a policy's insurance card images

> Returns the front and/or back insurance card scans stored against this policy, each with a short-lived signed download URL. A side that was never scanned is simply absent from the list. Requires read:patient_documents scope.



## OpenAPI

````yaml /openapi-v2.json get /insurance-policies/{id}/attachments
openapi: 3.0.0
info:
  title: Max AI Public API
  description: API for third-party marketplace apps
  version: '2.0'
  contact: {}
servers:
  - url: https://api.maxcare.ai/v2
security: []
tags: []
paths:
  /insurance-policies/{id}/attachments:
    get:
      tags:
        - Insurance Policies
      summary: List a policy's insurance card images
      description: >-
        Returns the front and/or back insurance card scans stored against this
        policy, each with a short-lived signed download URL. A side that was
        never scanned is simply absent from the list. Requires
        read:patient_documents scope.
      operationId: InsurancePoliciesPublicController_listInsuranceCardAttachments
      parameters:
        - name: id
          required: true
          in: path
          description: Insurance policy ID
          schema:
            type: string
        - name: X-Organization-Id
          in: header
          required: true
          schema:
            type: string
          description: Target clinic organization ID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/ListInsuranceCardAttachmentsSuccessResponse
        '400':
          description: Missing or invalid request parameter
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiBadRequestResponse'
        '401':
          description: Invalid or missing API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiUnauthorizedResponse'
        '403':
          description: Insufficient scope
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiForbiddenResponse'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiNotFoundResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiRateLimitResponse'
      security:
        - api-key: []
components:
  schemas:
    ListInsuranceCardAttachmentsSuccessResponse:
      type: object
      properties:
        code:
          type: string
          description: Response code
          example: success
        data:
          $ref: '#/components/schemas/ListInsuranceCardAttachmentsResponseData'
      required:
        - code
        - data
    PublicApiBadRequestResponse:
      type: object
      properties:
        code:
          type: string
          description: Error code
          example: bad_request
        message:
          type: string
          description: Human-readable error message
          example: '''id'' must be a valid UUID'
        trace_id:
          type: string
          description: Trace ID for debugging
          example: 550e8400-e29b-41d4-a716-446655440000
      required:
        - code
        - message
        - trace_id
    PublicApiUnauthorizedResponse:
      type: object
      properties:
        code:
          type: string
          description: Error code
          example: unauthorized
        message:
          type: string
          description: Human-readable error message
          example: Invalid or missing API key
        trace_id:
          type: string
          description: Trace ID for debugging
          example: 550e8400-e29b-41d4-a716-446655440000
      required:
        - code
        - message
        - trace_id
    PublicApiForbiddenResponse:
      type: object
      properties:
        code:
          type: string
          description: Error code
          example: forbidden
        message:
          type: string
          description: Human-readable error message
          example: Insufficient scope
        trace_id:
          type: string
          description: Trace ID for debugging
          example: 550e8400-e29b-41d4-a716-446655440000
      required:
        - code
        - message
        - trace_id
    PublicApiNotFoundResponse:
      type: object
      properties:
        code:
          type: string
          description: Error code
          example: not_found
        message:
          type: string
          description: Human-readable error message
          example: Resource not found
        trace_id:
          type: string
          description: Trace ID for debugging
          example: 550e8400-e29b-41d4-a716-446655440000
      required:
        - code
        - message
        - trace_id
    PublicApiRateLimitResponse:
      type: object
      properties:
        code:
          type: string
          description: Error code
          example: rate_limit_exceeded
        message:
          type: string
          description: Human-readable error message
          example: Rate limit exceeded. Maximum 1000 requests per 60 seconds.
        trace_id:
          type: string
          description: Trace ID for debugging
          example: 550e8400-e29b-41d4-a716-446655440000
      required:
        - code
        - message
        - trace_id
    ListInsuranceCardAttachmentsResponseData:
      type: object
      properties:
        attachments:
          type: array
          items:
            $ref: '#/components/schemas/ExternalInsuranceCardAttachmentResponse'
      required:
        - attachments
    ExternalInsuranceCardAttachmentResponse:
      type: object
      properties:
        side:
          type: string
          description: Which side of the insurance card this image is.
          enum:
            - front
            - back
          example: front
        fileId:
          type: string
          description: >-
            Stored file identifier. An opaque UUID on every version —
            sub-resource ids are not prefix-encoded from v3, because nothing
            accepts them back as input.
          example: b7c8d9e0-1f2a-4b3c-8d4e-5f6a7b8c9d0e
        filename:
          type: string
          description: Original filename
          nullable: true
          example: card_front.jpg
        mimeType:
          type: string
          description: MIME type
          nullable: true
          example: image/jpeg
        bytes:
          type: number
          description: Size in bytes
          nullable: true
          example: 184320
        url:
          type: string
          description: >-
            Short-lived signed download URL. Null when the URL could not be
            signed.
          nullable: true
        expiresInSeconds:
          type: number
          description: Lifetime of `url` in seconds. Null when there is no URL.
          nullable: true
        createdAt:
          type: string
          description: When the image was stored
          example: '2026-08-14T10:15:00.000Z'
      required:
        - side
        - fileId
        - filename
        - mimeType
        - bytes
        - url
        - expiresInSeconds
        - createdAt
  securitySchemes:
    api-key:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: Marketplace API key

````