---
title: "Redeem a signed raw-evidence URL (no auth)"
method: GET
path: "/v1/evidence/redeem/{token}"
tags: ["Evidence"]
---

# Redeem a signed raw-evidence URL (no auth)

`GET /v1/evidence/redeem/{token}`

## Request

- Base URL: `https://brain.inite.ai`
- URL: `https://brain.inite.ai/v1/evidence/redeem/{token}`
- Auth: HTTP bearer

Unauthenticated by design — the token IS the capability. No ABAC/consent/PII re-run; fail-closed re-checks only: signature, expiry, the token’s own tenant, availability still 'hot', and at least one live grant (revocation backstop). Bad, expired and revoked tokens all answer the same bare 404. 404 until EVIDENCE_RAW_READ_ENABLED=1.

## Path parameters

- `token` string, required

## Response `200`

The original bytes (Content-Type = the registered mediaType), with X-Content-Type-Options: nosniff, Cache-Control: no-store and Content-Disposition: attachment.

## Other responses

- `404`: No such resource in this tenant.

---

[API](https://skmtc.dev/inite/apis/inite-brain-platform-api.md) · [All operations](https://skmtc.dev/inite/apis/inite-brain-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/inite/apis/inite-brain-platform-api/revisions/c7c3eb5e304b?raw)