---
title: "Download one original or signed file"
method: GET
path: "/api/v1/firme/envelopes/{id}/files/{key}"
tags: ["Signatures (app routes)"]
---

# Download one original or signed file

`GET /api/v1/firme/envelopes/{id}/files/{key}`

## Request

- Base URL: `https://api.custodo.ai`
- URL: `https://api.custodo.ai/api/v1/firme/envelopes/{id}/files/{key}`
- Auth: HTTP bearer

which=source|signed; optional preview=true returns an inline URL and records a preview in the audit log (default false downloads as an attachment). Unsigned attachments in historical envelopes return their original bytes. Every file in a new envelope is signed by every signer. CAdES signed files use .p7m.

## Path parameters

- `id` string, uuid, required
- `key` string, required

## Query parameters

- `which` 'source' | 'signed'
- `preview` 'true' | 'false'

## Headers

- `X-Tenant-Id` string, uuid

## Response `200`

Five-minute download ticket.

- object
  - `ok` true, required
  - `data` FirmeDownloadTicket, required
    - `url` string, required: Works without authentication for 300 seconds.
    - `filename` string, required
    - `expiresIn` number, required

## Other responses

- `400`: The request did not validate: `error.details` names the fields.
- `401`: No API key, or one that is malformed, unknown, revoked or expired.
- `403`: The module is off for this organisation, the credential lacks the permission, or the tier does not cover it.
- `404`: Nothing with that id in this organisation.
- `429`: The API key has spent its minute, or its day. See `Retry-After`.

---

[API](https://skmtc.dev/custodo/apis/custodo-integrazioni.md) · [All operations](https://skmtc.dev/custodo/apis/custodo-integrazioni/llms.txt) · [OpenAPI document](https://skmtc.dev/custodo/apis/custodo-integrazioni/revisions/16d336d3ec2a?raw)