# Error with Retrieve attachment (A042, FHIR R4)

**URL:** <https://developer.community.nhs.uk/t/error-with-retrieve-attachment-a042-fhir-r4/9873>\
**Category:** e-Referral Service FHIR API\
**Tags:** fhir\
**Created:** [6 January 2026 10:23 UTC](https://developer.community.nhs.uk/t/error-with-retrieve-attachment-a042-fhir-r4/9873 "2026-01-06T10:23:46Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Petko\_Petkov](https://avatars.discourse-cdn.com/v4/letter/p/ad7895/32.png) [@Petko\_Petkov](https://developer.community.nhs.uk/u/Petko_Petkov)\
**Post date:** [20 January 2026 17:07 UTC](https://developer.community.nhs.uk/t/error-with-retrieve-attachment-a042-fhir-r4/9873/2 "2026-01-20T17:07:23Z")

</div>

> [@devendra.soni](#):
>
> `InvalidArgument`Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specifiedAuthorizationBearer hM18ZkAmUaH9ndgMKehmKoMTbzLm2TE850YR0YTC5TA3

Hi Devendra,

This error is happening because this endpoint uses a 307 Temporary Redirect to a pre-signed S3 download URL.

Your initial call to A042 (/R4/Binary/{id}) should include the normal e-RS header, as you’ve said:

Authorization: Bearer

However, when the client follows the 307 redirect and makes the second request to the Location URL, it is still sending the same Authorization: Bearer header. Since the redirect URL already contains its own authentication details (for example X-Amz-Algorithm and the signature), S3 sees two authentication mechanisms and returns:

InvalidArgument: Only one auth mechanism allowed…

To resolve this, keep the Bearer token on the first request to e-RS, but ensure the follow-up request to the redirected Location URL is made without the Authorization header.

Hope this helps,  
Petko

---

_[View the full topic](https://developer.community.nhs.uk/t/error-with-retrieve-attachment-a042-fhir-r4/9873)._