---
title: "Download a file through its signed URL"
method: GET
path: "/v2/pens/{id}/download/{path}"
tags: ["Files"]
---

# Download a file through its signed URL

`GET /v2/pens/{id}/download/{path}`

## Request

- Base URL: `https://api.codepen.io`
- URL: `https://api.codepen.io/v2/pens/{id}/download/{path}`
- Auth: none required

The route a file's `download_url` points at. The URL names one file's
exact bytes (the Pen, the content `hash` and the path) and carries an
expiry and a signature over all of it, so anyone holding it fetches
the file for an hour with no API key, session or Referer. Read the
file through the API for a URL; the parameters are not meant to be
built by hand. The bytes are served as an attachment with the file's
`content_type`. A URL for a Pen that has since been moved to the
trash answers `404`.

## Query parameters

- `hash` string, required
- `expires` string, required
- `sig` string, required

## Response `200`

The file's bytes, as an attachment.

## Other responses

- `400`: `BAD_USER_INPUT`: an invalid parameter, body, path, setting, access level or role. `field` names the argument when known, and `details` carries structured detail (the misses of `PATCH /v2/pens/{id}/files`).
- `403`: `FORBIDDEN`: the URL has expired. Read the file again for a new one.
- `404`: `NOT_FOUND`: the signature does not match the Pen, hash and path, or the Pen or its owner is gone.
- `500`: `INTERNAL`: unexpected, and reported; the message is generic.

---

[API](https://skmtc.dev/codepen/apis/codepen-api.md) - [All operations](https://skmtc.dev/codepen/apis/codepen-api/llms.txt) - [OpenAPI document](https://skmtc.dev/codepen/apis/codepen-api/revisions/108fe91e3ef5?raw)