---
title: "One artefact of one published version, streamed, unauthenticated"
method: GET
path: "/v1/update/download/{version}/{file}"
tags: ["update"]
---

# One artefact of one published version, streamed, unauthenticated

`GET /v1/update/download/{version}/{file}`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/update/download/{version}/{file}`
- Auth: none declared

The bytes the manifest's `url` points at, streamed from the private bucket as the runtime service account. The file must be one the version's own `manifest.json` lists, so this route serves nothing we did not publish; `Content-Length` is the size the publisher recorded. Streamed rather than buffered, because Cloud Run cuts a buffered response at 32 MiB. An installer (an `installers` entry) is served the same way; `via=latest` marks the redirect from the latest route, for the count alone.

## Path parameters

- `version` string, required
- `file` string, required

## Query parameters

- `via` string

## Response `200`

The artefact's bytes.

## Other responses

- `404`: No such row for this tenant.
- `503`: A capability this service was not configured with, or a practice system that could not be reached; the `type` says which.

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)