---
title: "Download a compliance export"
method: GET
path: "/compliance-exports/{id}/file"
tags: ["Compliance exports"]
---

# Download a compliance export

`GET /compliance-exports/{id}/file`

## Request

- Base URL: `https://api.purplegrain.com/api/v1`
- URL: `https://api.purplegrain.com/api/v1/compliance-exports/{id}/file`
- Auth: one of:
  - HTTP bearer
  - none

The zip, as an attachment named `zip_name`, never cached (`Cache-Control: private, no-store`).
404 while the export is not ready; 410 once its file has expired (30 days). Only the person
who asked for it. First-party web and mobile only.

Two ways in:

* **Bearer** (the web app): `GET /compliance-exports/{id}/file` with the session's token.
* **Signed** (a phone, or anything that opens a URL with no session): the export's
  `file_url`, which is this path with `?sig=<token>`. The token names the export and its
  requester and works without a bearer for 15 minutes from the read that minted it; every
  read of the export (`getComplianceExport`, `listComplianceExports`) mints a fresh one, so
  read the export just before opening it. A forged, altered or another export's `sig` is a
  401 (even beside a valid bearer); one past its 15 minutes is a 410 with `code`
  `download_link_expired`.

## Path parameters

- `id` string, required

## Query parameters

- `sig` string

## Response `200`

The zip, as an attachment.

## Other responses

- `401`: No bearer and no `sig`, or a `sig` that is not valid for this export.
- `403`: Not the person who asked for it, or an assistant / API key.
- `404`: No such export, or not built yet.
- `410`: The file has expired (`code` `export_expired`), or a signed link is past its 15 minutes (`code` `download_link_expired`).

## Changes

- **2026-10-24** `e285768a8f1d`: 36 warning
  - added the new `map_boundaries` enum value to the `_meta/onboarding/completed_steps/items/` response property for the response status `401` (media type: application/json)
  - added the new `map_boundaries` enum value to the `_meta/onboarding/completed_steps/items/` response property for the response status `401` (media type: application/vnd.api+json)
  - added the new `map_boundaries` enum value to the `_meta/onboarding/completed_steps/items/` response property for the response status `403` (media type: application/json)
  - added the new `map_boundaries` enum value to the `_meta/onboarding/completed_steps/items/` response property for the response status `403` (media type: application/vnd.api+json)
  - …32 more
- **2026-10-24** `92f716edc989`: 24 info
  - added the optional property `_meta` to the response with the `401` status (media type: application/json)
  - added the optional property `_meta` to the response with the `401` status (media type: application/vnd.api+json)
  - added the optional property `_meta` to the response with the `403` status (media type: application/json)
  - added the optional property `_meta` to the response with the `403` status (media type: application/vnd.api+json)
  - …20 more
- …earlier changes not shown

[Operation history](https://skmtc.dev/purplegrain/apis/purple-grain-api/changes/compliance-exports/:id/file/get.md)

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) - [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) - [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/7c60f959fec9?raw)