diff --git a/app/app.py b/app/app.py
index 3c820a7..30f6124 100644
--- a/app/app.py
+++ b/app/app.py
@@ -1,6 +1,6 @@
 import os, json, uuid
 import requests
-from flask import Flask, Response, request, jsonify, session, redirect, url_for
+from flask import Flask, Response, request, jsonify, session, redirect, url_for, send_file
 from authlib.integrations.flask_client import OAuth
 from functools import wraps
 from sqlalchemy import create_engine
@@ -98,6 +98,29 @@ def upload_attachment(cid):
     db.close()
     return jsonify({"status": "ok"})
 
+@app.route("/api/attachments/<cid>")
+@login_required
+def list_attachments(cid):
+    db = SessionLocal()
+    atts = db.query(Attachment).filter_by(conversation_id=cid).all()
+    data = [{"id": a.id, "filename": a.filename} for a in atts]
+    db.close()
+    return jsonify(data)
+
+
+@app.route("/api/download/<att_id>")
+@login_required
+def download(att_id):
+    db = SessionLocal()
+    att = db.query(Attachment).filter_by(id=att_id).first()
+    db.close()
+
+    if not att:
+        return "Not found", 404
+
+    return send_file(att.path, as_attachment=True, download_name=att.filename)
+
+
 @app.route("/api/stream")
 @login_required
 def stream():