Skip to main content

Stream a file

The response body is the decrypted file content. It is a binary response, not JSON.

Response headers

A full download returns 200. A range request returns 206.

Range requests

Send a standard Range header:
Use this for resumable downloads, media seeking, and partial inspection. If you proxy the response, preserve both the 206 status and the Content-Range header. Converting a partial response into 200 corrupts resumable clients.

Delivery path

GET /files/{fileId}/stream is the documented way to fetch content. The backend may serve the bytes through an internal cache or directly from origin; that choice is server-side and not part of the contract. Do not build client logic that depends on a specific delivery route. If you need a short-lived URL to hand to a browser or a third-party service, proxy the stream from your server instead of exposing your API keys.

Download a specific version

This streams the bytes of an archived version. Use it for audit, comparison, or recovery workflows. Version downloads have the same binary semantics and headers as current-file downloads.

Streaming in application code

Errors

A decryption failure caused by rotated or missing owner keys is a server-side state issue, not something a retry fixes. Contact support with the X-File-Id value and the timestamp.

Safety notes

  • Do not load large files fully into memory.
  • Do not expose signed URLs to untrusted users.
  • Do not cache decrypted content longer than your application requires.
  • Validate the downloaded bytes if they will be executed, parsed, or rendered.
  • Close response bodies. Leaked connections exhaust your client pool before the API rate limit becomes relevant.