---
title: "Get a download URL for an uploaded file"
method: GET
path: "/workspaces/{workspaceId}/consultations/{consultationId}/uploaded-files/{fileName}/download-url"
tags: ["uploaded-files"]
---

# Get a download URL for an uploaded file

`GET /workspaces/{workspaceId}/consultations/{consultationId}/uploaded-files/{fileName}/download-url`

## Request

- Base URL: `https://vetnio.com/api/v2`
- URL: `https://vetnio.com/api/v2/workspaces/{workspaceId}/consultations/{consultationId}/uploaded-files/{fileName}/download-url`
- Auth: HTTP bearer

Returns a short-lived presigned URL the client can use to download the file directly from S3, bypassing the Vetnio API. Prefer this over streaming the file through the API — it keeps latency low and avoids large-payload bandwidth on our servers.

## Path parameters

- `workspaceId` string, required: Opaque identifier of the Vetnio workspace (veterinary clinic) that owns the resource. Scopes every request — callers can only access files under workspaces they are a member of.
- `consultationId` string, required: Identifier of the consultation (a single veterinary visit) the file is attached to. The consultation must belong to the same workspace as the authenticated caller.
- `fileName` string, required: Stable internal identifier for the file — a server-generated UUID returned by `initUpload`. Used in every subsequent endpoint (finalize, download, delete). Not intended for display; use `originalFileName` for that.

## Response `200`

Presigned download URL with display metadata.

- UploadedFileDownload: Presigned download URL plus the display metadata a browser needs to save the file under its original name and render it with the correct content type.
  - `url` string, uri, required: Presigned S3 URL valid for 1 hour that lets the client `GET` the original file bytes. Call this endpoint again to obtain a fresh URL if it expires.
  - `originalFileName` string, required: The file name as it was on the uploader's device. Shown to users in the UI. May contain characters that are unsafe for object-storage keys, which is why it is never used as a storage identifier.
  - `mimeType` string, required: MIME type as recorded at upload time — use this for the `Content-Type` response header when serving the download to the end user.

## Other responses

- `400`: Invalid input data
- `401`: Authorization not provided
- `403`: Insufficient access
- `404`: Not found
- `500`: Internal server error

---

[API](https://skmtc.dev/vetnio/apis/vetnio-api.md) - [All operations](https://skmtc.dev/vetnio/apis/vetnio-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vetnio/apis/vetnio-api/revisions/d004afd5617d?raw)