Skip to main content
GET
Preview. This endpoint is available to organisations in the Wordsmith MCP and files pilot. Other organisations receive 403 mcp_not_enabled. See the preview overview.
Returns a signed link to the file’s original bytes. The response is JSON, not a redirect. Download the file with a plain GET to url and no Authorization header. The URL is already signed, and the storage host refuses a request that carries your API key. The link lasts at most 5 minutes, until expires_at, so fetch it straight away. Call this endpoint again for a fresh link. A file is served only once its malware scan is clean. While the scan is still running, the response is 409 scan_in_progress; retry shortly. A file the scan flagged returns 404, as a missing file does.

​
Authentication

Send an API key, or an OAuth access token with the files:read scope, as a bearer token in the Authorization header. files:write does not include files:read. A token without the scope gets 403 with "error": "insufficient_scope".

​
Path parameters

​
string (uuid)
required
The file’s id.

​
Response

​
string (uuid)
The file’s id.
​
string
The signed download link. Fetch it without an Authorization header.
​
string | null
The file’s name.
​
string | null
The file’s MIME type.
​
string
When url stops working. ISO 8601 UTC, at most 5 minutes after the request.

​
Errors

See Errors for the error format.