---
title: "Issue a signed URL for the mission-zip download"
method: POST
path: "/media/download-url"
tags: ["Media"]
---

# Issue a signed URL for the mission-zip download

`POST /media/download-url`

Returns a short-lived HMAC-signed URL pointing at /media/download.zip
that carries its own auth proof in the query string, so a plain
`<a href download>` click in the browser can trigger the download
without forging an Authorization header.

## Request body

- CreateMediaDownloadUrlRequest
  - `missionId` string, uuid, required
  - `siteId` string, uuid — Optional — narrows the download to a single site.
  - `mediaIds` string[] — Optional — narrows the download to a specific list of media rows. When present, takes precedence over `siteId`.
  - `includeEvidenceCrops` boolean — Optional — opts the zip into the annotated evidence-crop pass (mirrors `includeEvidenceCrops` on /media/download.zip). Folded into the signed URL's HMAC claims.

## Response `200`

Success

- object
  - `data` object, required
    - `url` string, required
    - `expiresAt` string, date-time, required

## Other responses

- `400` — Bad request or validation error
- `401` — Authentication required
- `403` — Insufficient permissions
- `500` — Internal server error

---

[API](https://skmtc.net/voltairlabs/apis/voltair-api.md) · [All operations](https://skmtc.net/voltairlabs/apis/voltair-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/voltairlabs/voltair-api/revisions/be08f4f706f5/schema)