---
title: "Read one stored object's exact bytes through the gateway"
method: POST
path: "/vaults/v1/{vault_id}/object-reads/bytes"
tags: ["vault"]
---

# Read one stored object's exact bytes through the gateway

`POST /vaults/v1/{vault_id}/object-reads/bytes`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/object-reads/bytes`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - HTTP bearer

The gateway-mediated sibling of `POST .../object-reads`: instead of a presigned URL, the gateway fetches the object server-side and streams the literal stored bytes back, `X-Run402-Stored-Bytes-Sha256` carrying their digest — immutable, safe to cache privately forever. Exists because the vault object-storage bucket is deliberately unreachable by anything except the gateway task role (the same confidentiality fence `object-reads`'s presigned URLs already depend on) and carries no browser CORS configuration, so a browser cannot fetch a presigned URL directly; this route is the browser-safe path (the SDK/CLI keep using presigned URLs — a non-browser `fetch` is not subject to CORS). Body is ONE object descriptor, the same shape as one entry of `object-reads`'s `objects[]` array. `key_envelope` reads are RECIPIENT-ONLY, identical rule and identical no-oracle refusal as `object-reads`. An object that is absent, of a different kind, or already tombstoned (`DELETING` / `DELETED` / `PRUNE_AUTHORIZED_PRESENT`) is `404 RESOURCE_NOT_FOUND`. Never lifecycle-gated.

## Path parameters

- `vault_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `object_kind` string, required
  - `object_id` string
  - `epoch` string
  - `recipient_fingerprint` string

## Response `200`

The exact stored object bytes

## Other responses

- `403`: Not authorized (VAULT_ACCESS_DENIED)
- `404`: The object is not readable on this vault
- `503`: STORAGE_UNAVAILABLE

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)