---
title: "Stream one allowed file while computing its SHA-256."
method: GET
path: "/api/downloads/{id}/{path}/verified"
tags: ["Downloads"]
---

# Stream one allowed file while computing its SHA-256.

`GET /api/downloads/{id}/{path}/verified`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/downloads/{id}/{path}/verified`
- Auth: none required

This GET transfers bytes. It requires current Postgres serving authority and the usual license/download checks. HEAD returns 405. Completion evidence is created only after the transfer is checked; starting a response is not proof of completion.

**Inputs.** Path, query and header fields are listed below. No request body is required.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.

**Example setup.** Use an identifier returned by the matching list, search or create operation. Sample identifiers are not a promise that a record exists.

## Path parameters

- `id` string, required
- `path` string, required

## Query parameters

- `ticket` string

## Response `200`

File byte stream.

## Other responses

- `403`: License acceptance is required.
- `404`: No current allowed file.
- `409`: Current binding or manifest checks failed.
- `503`: Transfer authority or storage is unavailable.

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/63c474bf0fe4?raw)