---
title: "Sign every hosted file of one artifact in one call: one authorization and one live eligibility re-check for all files. Each URL keeps the single-file lifetime (at most 300 s) and generation pin."
method: POST
path: "/api/v1/artifacts/{id}/download-lease"
tags: ["Downloads"]
---

# Sign every hosted file of one artifact in one call: one authorization and one live eligibility re-check for all files. Each URL keeps the single-file lifetime (at most 300 s) and generation pin.

`POST /api/v1/artifacts/{id}/download-lease`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/v1/artifacts/{id}/download-lease`
- Auth: none declared

Sign every hosted file of one artifact in one call: one authorization and one live eligibility re-check for all files. Each URL keeps the single-file lifetime (at most 300 s) and generation pin.

**Inputs.** Path, query and header fields are listed below. The request body schema lists accepted fields and required values.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Write and protocol operations can have separate route-specific limits. Read Retry-After and retry_after_s when present; do not infer a write allowance from the public read budget.

**Example setup.** Use an identifier returned by the matching list, search or create operation. Sample identifiers are not a promise that a record exists. This example is not executed by documentation checks. Review the operation and obtain any required user consent before sending it.

## Path parameters

- `id` string, required

## Request body

- object
  - `paths` string[]

## Response `200`

Lease: per file url + expiresAt + sha256 + sizeBytes, or a per-file error

- object

## Other responses

- `404`: Not found, not authorized, or no hosted files
- `410`: The artifact's files are not currently offered
- `503`: Authority unavailable; retry after retryAfterSeconds

## Changes

- **2026-10-20** `ea7ba26b1e27`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/changes/api/v1/artifacts/:id/download-lease/post.md)

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/ea7ba26b1e27?raw)