Sign in
latestOpenAPI 3.1.02026-08-194237902.5 MB

563848e0ecc0

Storage

Generate a time-limited presigned GCS download URL

Returns a presigned URL that grants direct, unauthenticated read access to a single GCS object for up to 1 hour.

When to use: Choose this endpoint when the file consumer cannot present API credentials at download time — for example, a browser-side redirect or a third-party client. For server-to-server transfers where credentials are available, use GET /storage/download instead.

Preconditions: Requires the STORAGE_READ permission in addition to a valid JWT. The filePath parameter accepts either a plain relative path (e.g. documents/report.pdf) or a full GCS URI (gs://bucket-name/documents/report.pdf); both forms are supported here. Paths undergo sanitization: values containing path-traversal sequences (../), leading slashes, backslashes, repeated slashes (//), or the characters <>:"|?* are rejected with 400. Multi-segment paths are also rejected with 400 when the first path segment contains a dot or is exactly "file" (e.g. reports.q1/data.csv, file/report.pdf).

Response: On success, returns a presigned URL and an expiresAtTimestamp indicating when the URL expires. The URL requires no further API authentication — share it directly with the consumer. No files are modified; this operation has no side effects.

get/storage/presigned-url

Query parameters

filePathstring required

GCS object path of the file to sign. Accepts a plain relative path (e.g. documents/report.pdf) or a full GCS URI (gs://bucket-name/documents/report.pdf). Path-traversal sequences, leading slashes, backslashes, repeated slashes (//), and the characters <>:"|?* are rejected. Multi-segment paths are also rejected when the first segment contains a dot or is exactly "file" (e.g. reports.q1/data.csv, file/report.pdf). Required; no default.

Headers

tenant-idstring required

Tenant ID

Response

Presigned download URL and its expiry timestamp. The URL grants direct GCS read access with no further API authentication required.

presignedUrlstring

Presigned URL for downloading the file

expiresInHoursinteger

Number of hours until the URL expires

expiresAtTimestampinteger

Unix timestamp when the URL expires

Example response

{
  "presignedUrl": "https://storage.googleapis.com/bucket/file.pdf?X-Goog-Signature=...",
  "expiresInHours": 1,
  "expiresAtTimestamp": 1698412800000
}