The format for the link for an attachment is:
submissions/SUBMISSION_ID/ files/FIELD_NAME/FILE_INDEX/ FILE_NAME
Where KINETIC_SERVER, SPACE_SLUG, SUBMISSION_ID, FIELD_NAME, FILE_INDEX, and FILE_NAME are replace with the appropriate values for the attachment in question. So for an image stored, for example, in a datastore, it could be:
Note that the original permissions for the submission are applied. This could be problematic when, for example, you want to make an attachment accessible from one task to the next in a workflow. For this, it might be better to use the copy attachment handler to actually copy the attachment into the new item and make it read-only.