---
title: "Get a one-time download link for a backup"
method: POST
path: "/clusters/{cluster_id}/backups/{backup_id}/download-link"
tags: ["Cluster Backups"]
---

# Get a one-time download link for a backup

`POST /clusters/{cluster_id}/backups/{backup_id}/download-link`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/backups/{backup_id}/download-link`
- Auth: API key in header `API-Key`

Issues a link that downloads a completed backup once, within about 15 minutes. The
download is the PostgreSQL custom-format archive of the cluster's database; restore it
with `pg_restore`. Every download is recorded in the audit log.

A managed backup always contains credentials, so `include_credentials` must be `true`
(it defaults to `false`); otherwise the request is refused with `422`. Returns `409`
for a backup that is not completed or has expired.

Required scope: `clusters:backups:write`

## Path parameters

- `cluster_id` string, uuid, required
- `backup_id` string, required: Backup identifier: `auto-<yyyymmddhhmm>` for an automatic backup, `manual-<timestamp>-<suffix>` for an on-demand one.

## Headers

- `API-Version` '2026-06-01.beta', required

## Request body

- CreateBackupDownloadLinkRequest
  - `include_credentials` boolean: A managed backup is a complete database backup, so it always contains credentials (user password hashes, client secrets). Must be `true` to download; defaults to `false` like the export option.

## Response `201`

The request has succeeded and a new resource has been created as a result.

- BackupDownloadLink
  - `url` string, uri, required: One-time download URL. It works once and expires at `expires_at`, about 15 minutes after it is issued. The download is the PostgreSQL custom-format archive (`pg_restore`).
  - `expires_at` string, date-time, required

## Other responses

- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `409`: The request conflicts with the current state of the server.
- `422`: Client error
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)