diff --git a/sandbox/src/mocks/r4/NHSDigital-OperationOutcome-422.json b/sandbox/src/mocks/r4/NHSDigital-OperationOutcome-422.json
new file mode 100755
index 000000000..a7475c324
--- /dev/null
+++ b/sandbox/src/mocks/r4/NHSDigital-OperationOutcome-422.json
@@ -0,0 +1,21 @@
+{
+  "resourceType": "OperationOutcome",
+  "meta": {
+    "lastUpdated": "2022-03-01T10:00:00.42Z"
+  },
+  "issue": [
+    {
+      "severity": "error",
+      "code": "invalid",
+      "details": {
+        "coding": [
+          {
+            "system": "https://fhir.nhs.uk/CodeSystem/ers-error-codes",
+            "code": "PENDING"
+          }
+        ]
+      },
+      "diagnostics": "The file is being scanned and cannot be retrieved. Wait at least 5 minutes before checking its availability again."
+    }
+  ]
+}
diff --git a/specification/components/r4/schemas/endpoints/a042-retrieve-attachment.yaml b/specification/components/r4/schemas/endpoints/a042-retrieve-attachment.yaml
index 96200ee7d..a6327b9b6 100644
--- a/specification/components/r4/schemas/endpoints/a042-retrieve-attachment.yaml
+++ b/specification/components/r4/schemas/endpoints/a042-retrieve-attachment.yaml
@@ -29,7 +29,7 @@ description: |
     - `SERVICE_PROVIDER_CLINICIAN_ADMIN`
 
   ### Attachment availability
-  To use this endpoint, the attachment must be available for download. Attachments are only available after successful validation and malware scans. A request to retrieve an attachment that is not available for download will result in a 400 error. See the Response HTTP 400 section for further information.
+  To use this endpoint, the attachment must be available for download. Attachments are only available after successful validation and malware scans. A request to retrieve an attachment that is not available for download will result in a 422 error. See the Response HTTP 422 section for further information.
   
   The availability status of an attachment can be retrieved via any endpoint that provides details of an attachment in the success response. Details of the availability statuses that may be returned via these endpoints can be found in the specification for [[HYPERLINK_A005]].
   
@@ -100,6 +100,8 @@ responses:
     $ref: '../responses/ForbiddenOrNoLR.yaml'
   '404':
     $ref: '../responses/NotFound.yaml'
+  '422':
+    $ref: '../responses/retrieveAttachment/422Response.yaml'
   '429':
     $ref: '../responses/TooManyRequests.yaml'
   '500':
diff --git a/specification/components/r4/schemas/responses/retrieveAttachment/422Response.yaml b/specification/components/r4/schemas/responses/retrieveAttachment/422Response.yaml
new file mode 100644
index 000000000..e2242c433
--- /dev/null
+++ b/specification/components/r4/schemas/responses/retrieveAttachment/422Response.yaml
@@ -0,0 +1,22 @@
+description: |
+  Where status code 422 (Unprocessable Entity) is returned then an [NHSDigital-OperationOutcome](https://fhir.nhs.uk/StructureDefinition/NHSDigital-OperationOutcome) will be included in the body, as detailed below.
+  Check diagnostics property for specific information regarding the error.
+  
+  | issue.details.coding.code | issue.code | Coding System                                                      | Description                                                                                                                                                                                   |
+  | ------------------------- | ---------- | ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+  | PENDING                   | invalid    | [BaRS Error Code](https://fhir.nhs.uk/CodeSystem/http-error-codes) | The file is being scanned and cannot be retrieved. Wait at least 5 minutes before checking its availability again.                                                                            |
+  | THREATS_FOUND             | invalid    | [BaRS Error Code](https://fhir.nhs.uk/CodeSystem/http-error-codes) | The file has been quarantined after detecting a threat and cannot be retrieved. Contact the organisation that uploaded the file to resolve the issue and get the information you need. Details of who uploaded the file can be retrieved via any endpoint that provides details of an attachment in the success response (via the [[HYPERLINK_A005]] or [[HYPERLINK_A024]] endpoints, for example)|
+  | VALIDATION_FAILED         | invalid    | [BaRS Error Code](https://fhir.nhs.uk/CodeSystem/http-error-codes) | The file has failed validation and cannot be retrieved. Contact the organisation that uploaded the file to resolve the issue and get the information you need. Details of who uploaded a file can be retrieved via any endpoint that provides details of an attachment in the success response (via the [[HYPERLINK_A005]] or [[HYPERLINK_A024]] endpoints, for example)<br>Validation can fail because the:<ul><li>content type of the file is not supported</li><li>content type of the file does not correlate with the file extension</li><li>file provided is too large and is not supported by e-RS. Note, this indicates that the file size is larger than the system supports as a whole, not the 5MB limit associated with this endpoint</ul> |
+headers:
+  x-correlation-id:
+    $ref: '../../headers/response/CorrelationID.yaml'
+  x-request-id:
+    $ref: '../../headers/response/RequestID.yaml'
+  Content-Type:
+    $ref: '../../headers/response/ContentTypeFhirJson.yaml'
+content:
+  application/fhir+json:
+    schema:
+      $ref: '../../NHSDigital-OperationOutcome.yaml'
+    example:
+      $ref: '../../../examples/NHSDigital-OperationOutcome-422.json'