Hello,
See my other response here: Open a WFG approved, by its request number - #7 by jianan.hsu
As mentioned, the URL below will open the specific request attachment file (FORM_ARCHIVE in this example) by verifying the user’s highest access permissions.
https://yourserver/wfgen/show.aspx?QUERY=DOWNLOAD&DATA_NAME=FORM_ARCHIVE&ID_PROCESS_INST=123
Your user must have the right permission to access the specific request (e.g. performed an action as a requester/actor or is a requester/supervisor/manager/administrator of the request).
So, if your user is not the requester nor an actor in the request then yes, you will need to add him as Process Supervisor in the process.
Best regards