---
title: "Download a file (legacy path)"
method: GET
path: "/files/download/{uuid}"
tags: ["Files"]
---

# Download a file (legacy path)

`GET /files/download/{uuid}`

## Request

- Base URL: `https://contentmaschine.ai/api`
- URL: `https://contentmaschine.ai/api/files/download/{uuid}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://contentmaschine.ai/api/oauth/authorize`, token URL `https://contentmaschine.ai/api/oauth/token`)

The OLDER download path, kept because existing callers and the product's own file
flows use it. It accepts the same Bearer token.

**It does NOT authorize the same way as `GET /v1/files/{uuid}/download`, and the
difference is stated here rather than left to be discovered.** This route is
owner-checked but carries NO SCOPE CHECK AT ALL: any valid token belonging to the
owner is served the file, including one holding neither `files:read` nor the
file's container read scope. The `/v1/` route requires both. Prefer the `/v1/`
route; this one is documented for accuracy, not recommended.

This is the only non-`/v1/` path in this document.

## Path parameters

- `uuid` string, uuid, required

## Response `200`

Binary image file

## Other responses

- `401`: Missing or invalid API key
- `404`: File not found
- `default`: Any other error. Every failure this API emits uses the same envelope; branch on `error.type`, never on `error.message`, and quote `error.correlation_id` to support.

---

[API](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api.md) · [All operations](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api/revisions/28c74f46051c?raw)