Hi Tom,
Due to the way in which Front processes inbound messages, we create a message with a UID quickly and return that response to you, while we work on creating a new conversation, or threading the new message into an appropriate existing conversation, so the conversation ID does not exist at the time you receive the API response.
You can use resource aliases after receiving the message UID to fetch the message from the API;
GET /messages/alt:uid:<MESSAGE_UID>
This will return the message details, including the conversation ID that has now been assigned.
Regarding attachments, the requests to fetch attachments from Front’s API must be authenticated. If you want to fetch them unauthenticated, you’ll need to configure some kind of proxy service to perform an authenticated fetch (you hit your service unauthenticated, which fetches the attachment from Front with an authenticated request, and returns it)