Authorize a direct download
Authorize a direct download
/api/v1/attachments/{attachment_id}/downloadAuthorizes the caller against the attachment's Workspace at request time and mints a short-lived presigned download URL bound to one method and one object key. Possession of an attachment identifier or an expired URL never grants access.
The URL is minted per request and must never be stored in Document or
comment content, an event payload, a notification, or a webhook. The
object is served from a non-Assign origin with
Content-Disposition: attachment and X-Content-Type-Options: nosniff; attachments are never rendered inline in an Assign origin.
Only an attachment whose scan_state is clean can receive this
credential. This operation is POST because it mints a credential; it is not a
cacheable read.
Path Parameters
Header Parameters
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.