---
title: "Deprecated alias of GET /api/v1/artifacts/{id}/download-plan: the per-file download-plan (path, sizeBytes, sha256, downloadUrl) for one artifact."
method: GET
path: "/api/artifacts/{id}/download-plan"
tags: ["Artifacts", "Downloads", "Agent Docs"]
deprecated: true
---

# Deprecated alias of GET /api/v1/artifacts/{id}/download-plan: the per-file download-plan (path, sizeBytes, sha256, downloadUrl) for one artifact.

`GET /api/artifacts/{id}/download-plan`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/artifacts/{id}/download-plan`
- Auth: none declared

> **Deprecated.**

Alias of /api/v1/artifacts/{id}/download-plan (recorded; identical handler). Prefer the recorded path: this one already answers with Deprecation and Sunset headers. Deprecated alias; prefer GET /api/v1/artifacts/{id}/download-plan (identical handler). Returns hosted-only file rows (files[].path, sizeBytes, sha256, downloadUrl), the signed manifest URL and the serve verdict. Agent flow (for one file straight from a model name, GET /api/downloadable-files?q=<model name> returns hosted-file inventory rows with filePath, sha256, downloadUrl and downloadStatus in one call; skip BLOCKED rows and null downloadUrl values): find {id} with GET /api/v1/search?q=<model name> (each row carries its id and serve state) or GET /api/v1/resolve?repo=<owner/name>; GET this plan (license: artifact.license), pick the row in files[] whose path names the file you want (the quant, e.g. Q4_K_M, is in the filename), GET its downloadUrl, then recompute SHA-256 locally (shasum -a 256 <file> or sha256sum <file>) and compare with files[].sha256. downloadStatus / downloadable are the only download authority; a URL appears only when downloadStatus is READY. A matching hash proves the bytes arrived unchanged, not that the file runs: serve.runReady and serve.commandsAvailable stay false until a tested run plan is recorded (reason code no-tested-run-plan), and a GGUF file needs a local runner such as llama.cpp, Ollama or LM Studio. Per-file run.commands, when present, are runner guidance; each command's note says whether that line was checked. External upstream files are explicitly excluded until mirror review approves hosting.

**Inputs.** Path, query and header fields are listed below. No request body is required.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.

**Example setup.** Use an identifier returned by the matching list, search or create operation. Sample identifiers are not a promise that a record exists.

## Path parameters

- `id` string, required

## Query parameters

- `tool` 'ollama' | 'lm-studio' | 'comfyui' | 'transformers' | 'llama.cpp'
- `snapshot` string

## Response `200`

Hosted-file download-plan

- object
  - `schemaVersion` 'hugging-bay.artifact-download-plan.v1', required
  - `artifact` object, required
  - `status` string: DEPRECATED for availability: the recorded STORAGE state (e.g. complete-bytes = bytes are stored) — NOT an obtainability, runnability or verification claim. It stays complete-bytes on a withheld artifact. Read `serve.downloadReady` / `serveExplanation.downloadStatus` instead.
  - `downloadStatus` 'READY' | 'BLOCKED' | 'PENDING' | 'UNKNOWN'
  - `serveExplanation` object: The plain-words twin of `serve`, from the same evaluation (same serveEvaluationId).
    - `downloadable` boolean, required
    - `downloadStatus` 'READY' | 'BLOCKED' | 'PENDING' | 'UNKNOWN', required
    - `reason` string, required
    - `reasonCodes` string[]
    - `serveEvaluatedAt` string, date-time
    - `serveEvaluationId` string
  - `serve` object: The single non-contradictory obtain contract (hugging-bay.serve-contract.nv5). Agrees with every per-file affordance below.
    - `schemaVersion` string
    - `decisionVersion` string
    - `evaluatedAt` string, date-time
    - `downloadReady` boolean, required: TRUE only when at least one hosted file is served right now.
    - `runReady` boolean
    - `bytesStatus` string
    - `byteVerificationStatus` string: Stored-mirror byte verification; separate from localHashAttested (client claim) and serverTransferVerified (one proxied transfer).
    - `commandsAvailable` boolean
    - `reasonCodes` string[], required: Why downloadReady is false (empty when READY), e.g. manifest-not-final, unverified-bytes, no-strictly-downloadable-files, quarantined.
  - `artifactId` string
  - `tool` string
  - `manifest` object, required
  - `verified` object
  - `stats` object
  - `fileIntegrity` object
  - `completionAttestation` object: Contract for closing the honest download-completion loop. After a client downloads a hosted file in full and locally recomputes its SHA-256, it POSTs to /api/download-completions/{id}/{path} with the redirect's single-use X-Hugging-Bay-Completion-Token so the pull is counted. Redirect issuance is an initiation, not a completed pull; probes/HEAD/partial reads and self-reported receipts never count.
  - `files` object[], required
    - `downloadUrlResponse` object
      - `status` unknown, required
      - `followRedirects` unknown, required
    - `downloadUrl` string, nullable: recorded byte-download URL; HTTP 302, follow redirects; null when blocked.
    - `peerFallbacks` ReviewedPeerFallback[]
      - `id` string, required
      - `type` 'magnet' | 'torrent', required
      - `protocol` 'bittorrent', required
      - `status` 'verified', required
      - `verified` boolean, required
      - `publiclyDownloadable` boolean, required
      - `displayName` string
      - `infoHash` string
      - `magnetUri` string, nullable
      - `sourceUrl` string, nullable
      - `sizeBytes` number
      - `fileCount` number
      - `trackerCount` number
      - `submittedAt` string
      - `reviewedAt` string
      - `source` string
      - `note` string
      - `scope` 'file' | 'artifact-release'
      - `filePath` string
      - `appliesToFile` boolean
      - `directDownload` boolean
      - `trustBoundary` string
      - `verificationTarget` object
        - `sha256` string
        - `manifestUrl` string, nullable
        - `distributionUrl` string, nullable
    - `completionAttestationUrl` string, nullable: POST target to attest a locally SHA-256-verified completed pull of this file; null when the file is not individually hashed.
  - `commands` object[], required
  - `actions` object
  - `warnings` string[]

## Other responses

- `403`: Gated terms required
- `409`: External-only artifact is not mirrored
- `423`: Manifest is not public or not final

## Changes

- **2026-10-20** `ea7ba26b1e27`: 1 info
  - added the new optional `query` request parameter `snapshot`

[Operation history](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/changes/api/artifacts/:id/download-plan/get.md)

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/ea7ba26b1e27?raw)