diff --git a/doc/REST-CalDAV-CardDAV/Mail.md b/doc/REST-CalDAV-CardDAV/Mail.md
index 523318d189..b77f32cedc 100644
--- a/doc/REST-CalDAV-CardDAV/Mail.md
+++ b/doc/REST-CalDAV-CardDAV/Mail.md
@@ -124,16 +124,18 @@ to use in further requests, instead of the attachment.
 ```
 curl -i https://example.org/egroupware/groupdav.php/mail/attachments/<filename> --user <user> \
     --data-binary @<file> -H 'Content-Type: <content-type-of-file>'
-HTTP/1.1 302 Found
-Location: https://example.org/egroupware/groupdav.php/mail/attachment/<token>
+HTTP/1.1 201 Created
+Location: https://example.org/egroupware/groupdav.php/mail/attachments/<token>
 
 {
-    "status": 200,
+    "status": 201,
     "message": "Attachment stored",
-    "location": "/mail/attachments/<filename>--xM35lY"
+    "location": "/mail/attachments/<token>"
 }
 ```
 > When using curl to upload attachments it's important to use ```--data-binary```, just ```-d``` or ```--data``` is NOT sufficient!
+
+> Use a `X-No-Location: true` header to get NO `Location: <url>` header with HTTP status `201 Created` back, but a simple `200 Ok`!
 </details>
 
 - ```POST /mail[/<id>]/vacation``` enable or disable vacation message or forwarding
diff --git a/mail/src/ApiHandler.php b/mail/src/ApiHandler.php
index 0c37240576..ff7c535e51 100644
--- a/mail/src/ApiHandler.php
+++ b/mail/src/ApiHandler.php
@@ -283,13 +283,19 @@ class ApiHandler extends Api\CalDAV\Handler
 			file_put_contents($attachment_path, $content))
 		{
 			if (isset($fp)) fclose($fp);
-			header('Location: '.($location = '/mail/attachments/'.substr(basename($attachment_path), 8)));
+			$location = '/mail/attachments/'.substr(basename($attachment_path), 8);
+			// allow to suppress location header with an "X-No-Location: true" header
+			if (($location_header = empty($_SERVER['HTTP_X_NO_LOCATION'])))
+			{
+				header('Location: '.Api\Framework::getUrl(Api\Framework::link('/groupdav.php'.$location)));
+			}
+			$ret = $location_header ? '201 Created' : '200 Ok';
 			echo json_encode([
-				'status'   => 200,
+				'status'   => (int)$ret,
 				'message'  => 'Attachment stored',
 				'location' => $location,
 			], self::JSON_RESPONSE_OPTIONS);
-			return '200 Ok';
+			return $ret;
 		}
 		throw new \Exception('Error storing attachment');
 	}
@@ -469,6 +475,15 @@ class ApiHandler extends Api\CalDAV\Handler
 					$account = self::getMailAccount($user, $matches[2] ?? null);
 					echo json_encode(self::returnVacation(self::getVacation($account->imapServer(), $user)), self::JSON_RESPONSE_OPTIONS);
 					return true;
+
+				case preg_match('#^/mail/attachments/(([^/]+)--[^/.-]{6,})$#', $path, $matches) === 1:
+					if (!file_exists($tmp=$GLOBALS['egw_info']['server']['temp_dir'].'/attach--'.$matches[1]))
+					{
+						throw new \Exception("Attachment $path NOT found", 404);
+					}
+					Api\Header\Content::type($matches[2], '', filesize($tmp));
+					readfile($tmp);
+					exit;
 			}
 		}
 		catch (\Throwable $e) {