---
title: "Download a document’s file"
method: GET
path: "/api/v1/documents/{id}/content"
tags: ["Files"]
---

# Download a document’s file

`GET /api/v1/documents/{id}/content`

## Request

- Base URL: `http://localhost:5180`
- URL: `http://localhost:5180/api/v1/documents/{id}/content`
- Auth: API key in cookie `better-auth.session_token`

The bytes themselves, streamed through the API rather than from a signed URL: every read of a file is a request that carried a session, so it can be refused the moment an account is closed and it leaves the same trace every other read leaves. This is the one response in the API that is not the `{ ok, data, meta }` envelope. A refusal still is, unless the request names text/html ahead of JSON, which a browser following a link does: then the refusal is a short page carrying the same sentence and request id, and a way back, so a link never opens a raw envelope. It is served as an attachment whatever the file claims to be, except a PDF asked for with `inline=1`.

## Path parameters

- `id` string, required

## Query parameters

- `variant` 'thumb' | 'display'
- `v` string
- `inline` '1'

## Response `200`

The file, with the content type the upload claimed for it and the request id in the header. A photo filed before it had copies has the one asked for made on the spot.

## Other responses

- `401`: No session. Sign in first.
- `404`: No document with that id belongs to you, or no file was ever uploaded for it.
- `429`: Over the file budget, which is counted per owner and separately from the rest of the API.
- `500`: The account says the file is there and the store does not have it, or the row points outside the owner’s own prefix. Both are a separate answer from the 404 on purpose: they are ours to fix, not a document nobody uploaded.

---

[API](https://skmtc.dev/dardaris/apis/dardaris-api.md) · [All operations](https://skmtc.dev/dardaris/apis/dardaris-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dardaris/apis/dardaris-api/revisions/4aff33835c73?raw)