---
title: "The window sticker PDF, through the signed link a read returns"
method: GET
path: "/v2/window-sticker/{sha}"
tags: ["vin"]
---

# The window sticker PDF, through the signed link a read returns

`GET /v2/window-sticker/{sha}`

## Request

- Base URL: `https://api.cardog.app`
- URL: `https://api.cardog.app/v2/window-sticker/{sha}`
- Auth: none required

The PDF behind `label.document.downloadUrl` from `GET /v2/vin/{vin}/window-sticker`. Open that link exactly as printed. It is signed and good for 24 hours; it needs no API key or session, and it costs 0 credits. The body is served inline, so a browser tab displays it. `HEAD` returns the headers only. A single `Range: bytes=N-M` is honoured with a 206. An invalid or expired link is 403 `forbidden`: request the VIN read again for a fresh link, billed as a held label. 404 when no document is held under that hash; 503 when the file could not be fetched right now, retry with backoff.

## Path parameters

- `sha` string, required

## Query parameters

- `exp` integer, required
- `sig` string, required

## Response `200`

The window sticker, as the manufacturer's service produced it

## Other responses

- `400`: Invalid request — grammar failure or unknown-but-well-formed refs, NAMED in `refs`/`details`, with nearest-ref `suggestions` where computable. Never a fuzzy fallback.
- `403`: The link is invalid or expired (`forbidden`); request `GET /v2/vin/{vin}/window-sticker` again for a fresh one
- `404`: Resource not found
- `429`: Per-minute rate limit exceeded
- `500`: Internal error
- `503`: Temporarily unavailable (`unavailable`); retry with backoff

---

[API](https://skmtc.dev/cardog/apis/cardog-api-v2.md) · [All operations](https://skmtc.dev/cardog/apis/cardog-api-v2/llms.txt) · [OpenAPI document](https://skmtc.dev/cardog/apis/cardog-api-v2/revisions/b9d48193126f?raw)