---
title: "Generate a download URL for a raw file"
method: POST
path: "/raw/download"
tags: ["Raw Search"]
---

# Generate a download URL for a raw file

`POST /raw/download`

Return a short-lived URL that allows downloading a raw file. Either provide the `sha256_original` hash directly or specify both `container_id` and `entry_path` so the hash can be resolved.

You can pass parameters either as query string or in the JSON body. If both are provided, the JSON body values take precedence.

## Query parameters

- `sha256_original` string, nullable — SHA-256 of the original file (alternative to container_id + entry_path).
- `container_id` integer, nullable — Container identifier (with entry_path, resolves the file hash).
- `entry_path` string, nullable — Path of the entry inside the container.
- `expires_in` integer — Download URL lifetime in seconds (60–3600, default 900).

## Request body

- object, nullable — Optional JSON body with `sha256_original`, `container_id`, `entry_path`, `expires_in`. Example: {"sha256_original": "...", "container_id": 123, "entry_path": "path/to/file", "expires_in": 900}

## Response `200`

Download URL generated successfully.

- DownloadSourceResponse
  - `url` string, required — Temporary URL that can be used to download the file.
  - `expires_in` integer — Number of seconds before the download URL expires.
  - `file_name` string, nullable — Suggested file name for the downloaded file.
  - `size_bytes` integer, nullable — Size of the file in bytes, when known.
  - `mime` string, nullable — MIME type of the file, when available.
  - `already_unlocked` boolean — True when the user had an active unlock for the file prior to this request.
  - `downloaded_before` boolean — Indicates whether the user has successfully downloaded this file in the past.

## Other responses

- `400` — Missing or invalid identifier (container_id / expires_in).
- `401` — Authentication required, or invalid/expired API key.
- `402` — Insufficient GB quota to unlock the file.
- `403` — Raw download requires an active raw plan, account banned, or pending email verification.
- `404` — File not found, sha256 unknown, or raw file not registered.
- `422` — Validation Error
- `429` — Rate limit exceeded. See Retry-After / X-RateLimit-* headers.
- `500` — Storage or search error.
- `503` — Raw search under maintenance, or public API temporarily disabled.

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) · [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leakradar/leakradar-io-api/revisions/eb219e94d077/schema)