---
title: "Get a link to an envelope’s PDF or its attestation"
method: GET
path: "/api/v1/rest/firme/envelopes/{id}/download-link"
tags: ["Signatures"]
---

# Get a link to an envelope’s PDF or its attestation

`GET /api/v1/rest/firme/envelopes/{id}/download-link`

## Request

- Base URL: `https://api.custodo.ai`
- URL: `https://api.custodo.ai/api/v1/rest/firme/envelopes/{id}/download-link`
- Auth: HTTP bearer

A signed URL valid for 300 seconds. `which`: `signed` — the signed PDF, once the first signature is on it; `source` — the original; `certificate` — the «Attestazione di firma», the proof of how every signer was reached and signed, available once the envelope was sent. Use it only when the USER asked for the file; handing out a link is recorded in the activity log.

**Examples**

- Send me the signed Rossi contract
  `GET /api/v1/rest/firme/envelopes/11111111-2222-4333-8444-555555555555/download-link?which=signed`
- I need the proof of signature for the Rossi contract
  `GET /api/v1/rest/firme/envelopes/11111111-2222-4333-8444-555555555555/download-link?which=certificate`

## Path parameters

- `id` string, uuid, required

## Query parameters

- `which` 'signed' | 'source' | 'certificate'
- `lang` 'it' | 'en'

## Headers

- `X-Tenant-Id` string, uuid

## Response `200`

Done. `data` is the tool’s own answer.

- RestResult
  - `ok` true, required
  - `data` unknown, required

## Other responses

- `400`: The arguments did not validate: `error.message` names the field, what it expects and what arrived.
- `401`: No API key, or one that is malformed, unknown, revoked or expired.
- `403`: The call never ran: the module is off for this organisation, the credential lacks the permission or the module, the tier does not cover it, or the tool is destructive and the key was not minted for that.
- `404`: Nothing with that id in this organisation.
- `422`: The tool ran and refused, in a sentence of its own (`TOOL_REFUSED`): the message says what to change. Retrying the same call will not help.
- `429`: The API key has spent its minute, or its day. Every request a key makes counts. See `Retry-After`.

---

[API](https://skmtc.dev/custodo/apis/custodo-integrazioni.md) · [All operations](https://skmtc.dev/custodo/apis/custodo-integrazioni/llms.txt) · [OpenAPI document](https://skmtc.dev/custodo/apis/custodo-integrazioni/revisions/16d336d3ec2a?raw)