---
title: "Create Export Download Token"
method: POST
path: "/exports/{export_id}/download-token"
---

# Create Export Download Token

`POST /exports/{export_id}/download-token`

## Request

- Base URL: `https://api.xhostd.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.xhostd.com/exports/{export_id}/download-token`
- Auth: none declared

Mint an on-demand ``exports:read`` token for a ready, owned export.

Ownership + readiness are enforced by :func:`resolve_export_download`
(404 on non-owner / not-ready), mirroring the download routes. The
scope gate follows them, exactly as on the download routes, so a
stranger reads 404 before any 403. The caller must hold
``exports:read`` itself: a mint never grants more than the caller
already holds, so a ``snapshots:read`` or ``blobs:read`` download
token cannot rotate into this artifact. The plaintext is returned once
and never persisted or logged; the token carries the same label the
builder's ``_finalize`` uses, so the sweeper's existing revocation
covers it.

The mint never outlives the caller either, so ``bounded_expiry``
holds the token to the earlier of the export's expiry and the
caller's own. That also answers the export row whose ``expires_at``
is NULL: the token takes the caller's expiry instead of living
forever. The clamp is silent, because the request carries no lifetime
field. The response reports the token's expiry, which is what governs
the download the caller is about to run.

## Path parameters

- `export_id` string, uuid, required

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- DownloadTokenResponse
  - `token` string, required
  - `download_url` string, required
  - `blobs_download_url` string, required
  - `expires_at` string, nullable, required
  - `blobs_included` boolean, required
  - `blobs_reason` string, nullable, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/xhostd/apis/xhostd-public.md) · [All operations](https://skmtc.dev/xhostd/apis/xhostd-public/llms.txt) · [OpenAPI document](https://skmtc.dev/xhostd/apis/xhostd-public/revisions/bf439c4d1789?raw)