Download File

Serve one local-store object named by a verified download token.

token defaults to empty so a missing token takes the same 403 path as a bad one (presigned-URL parity), not FastAPI's 422.

file and content_manifest tokens are not checked for revocation, by design (CON-70): such a token is a bearer HMAC grant that names no key or client, like the presigned S3 URLs it stands in for. Revoking a key or disabling a tenant or partner stops minting new tokens, but one already issued stays valid until it expires. Its TTL is the whole bound on that exposure: JOB_DOWNLOAD_LINK_TTL_SECONDS (300s) for job links, DOWNLOAD_URL_TTL_SECONDS (900s) for get_file, and NDI_PRESIGN_TTL_SECONDS (3600s by default) for previews.

Customer workspace grants are the exception: each request rechecks the tenant and its parent, the binding, the connection and the granted object or document job, so revocation, replacement, deletion or expiry stops an issued link. Past the signature check those refusals are typed platform errors.