---
title: "Public Download File"
method: GET
path: "/api/files/public/download/{file_id}"
tags: ["files"]
---

# Public Download File

`GET /api/files/public/download/{file_id}`

## Request

- The document declares no server URL.
- Auth: none declared
- TypeScript: <https://skmtc.dev/xorbitsai/apis/xagent/docs/api/files/public/download/:file_id/get.ts> (a function with typed inputs; its response is checked against the schema)

Public source-download endpoint for the chat file-card 'Open' link.

Mirrors ``public_preview_file`` for resolution (UUID file id or
legacy cross-user path) but always returns
``Content-Disposition: attachment; filename="..."`` so the browser
saves under the source filename instead of trying to render the
bytes inline. Used by ``InlineFilePreview`` 'Open' affordances
that render as plain ``<a href>``: those clicks — plus middle-
click / right-click "open in new tab" / "copy link" — don't carry
the frontend's bearer token, so the auth'd
``/api/files/download/{file_id}`` route would 401 every plain
browser navigation.

The ``file_id`` is the only required capability, matching the
existing ``public/preview`` contract. ``relative_path`` is
intentionally NOT supported: 'Open' always targets the registered
source artifact, never a sub-path inside it.

## Path parameters

- `file_id` string, required

## Query parameters

- `token` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

## Changes

- **2026-06-13** `33e4ba4936ad`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xorbitsai/apis/xagent/changes/api/files/public/download/:file_id/get.md)

---

[API](https://skmtc.dev/xorbitsai/apis/xagent.md) - [All operations](https://skmtc.dev/xorbitsai/apis/xagent/llms.txt) - [OpenAPI document](https://skmtc.dev/xorbitsai/apis/xagent/revisions/8646de810cc2?raw)