The format for the link for an attachment is:
Where KINETIC_SERVER, SPACE_SLUG, SUBMISSION_ID, FIELD_NAME, FILE_INDEX, and FILE_NAME are replace with the appropriate values for the attachment in question. So to display an image the user has upload in the submission back to them, it could be:
Note The original permissions for the submission are applied. This could be problematic when, for example, you want to make an attachment accessible from one task to the next in a workflow. For this, it might be better to use the copy attachment handler to actually copy the attachment into the new item and make it read-only.