---
title: "Get a short-lived signed download URL for a file on a collection"
method: GET
path: "/api_partner/collections/{collection_slug}/files/{file_id}/download-url"
tags: ["Collections"]
---

# Get a short-lived signed download URL for a file on a collection

`GET /api_partner/collections/{collection_slug}/files/{file_id}/download-url`

## Request

- Base URL: `https://api.scite.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.scite.ai/api_partner/collections/{collection_slug}/files/{file_id}/download-url`
- Auth: HTTP bearer

Hand back a short-lived signed URL for the file's bytes; the caller downloads directly from it.

no_cache is not optional: Kong proxy-caches this service on the Authorization header, so a
signed URL must not be replayable to the next request carrying the same token.

## Path parameters

- `collection_slug` string, required
- `file_id` integer, required

## Query parameters

- `email` string, email, required

## Headers

- `authorization` string: Set to `Bearer <token>` to pass token for authorization.

## Response `200`

Successful Response

- DownloadUrlRS: A short-lived signed URL the client navigates to. Do not turn this route into a redirect. CSP is enforcing for connect-src and re-checks redirect targets, and the browser would replay its Authorization header at S3, which refuses a presigned request carrying one.
  - `url` string, required
  - `filename` string, required
  - `expiresIn` integer, required

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-01** `97e32261f535`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/scite/apis/scite-api/changes/api_partner/collections/:collection_slug/files/:file_id/download-url/get.md)

---

[API](https://skmtc.dev/scite/apis/scite-api.md) - [All operations](https://skmtc.dev/scite/apis/scite-api/llms.txt) - [OpenAPI document](https://skmtc.dev/scite/apis/scite-api/revisions/d34bcc742a26?raw)