Name
Download link
A temporary link to download a file.
HTTP method and path
/https:
What happens when you run it
- Read only: it does not change your organization’s data.
- The call is not charged.
- Your organization’s audit log records that a download link was requested for that file.
What it does
Returns a signed link to download the file, valid until expiresAt (15 minutes by default, 60 at most) and never beyond when the file is deleted. Each link is recorded with the API key that asked for it and the IP you called from. A file being deleted cannot be downloaded: it answers 404.
The link is a short-lived secret: do not store or share it. Ask for a new one every time you need it.
Availability and prerequisites
- Published and available in the production API v6.
- Every path starts at
https:./ / developers. hablame. co - You need a Hablame API key to call it.
Authentication and permissions
- Send your API key in the
Authorizationheader with the Bearer scheme.
Who can call it: An API key with the storage service enabled.
Limits and operational notes
Usage limit: 2 requests per second.
- Its own per-organization quota, separate from the queries.
Path parameters
| Name | Type | Description and rules |
|---|---|---|
idRequired | string | File identifier, as it comes in the list. Pattern: |
Query parameters
| Name | Type | Description and rules |
|---|---|---|
minutesOptional | integer | Minutes the link is valid. Default value: |
HTTP headers
| Name | Type | Description and rules |
|---|---|---|
AuthorizationRequired | string | Your API key with the Bearer scheme. Example: |
Request body
This endpoint takes no request body.
Successful responses
200
The link and its expiry.
{
"success": true,
"data": {
"url": "https://storage.hablame.co/cloud/v1/...?Expires=1790000000&KeyName=...&Signature=...",
"expiresAt": "2026-10-19T10:45:00.000-05:00"
},
"meta": {
"requestId": "5d0f3a9c7b2e41a8",
"clientIp": "203.0.113.10",
"timestamp": "2026-10-19T15:30:00+00:00",
"responseTimeMs": 12.4
}
}The example values are illustrative.
Response fields
| Name | Type | Description and rules |
|---|---|---|
successAlways present | boolean | |
dataAlways present | object | |
data.Always present | string | Signed download link. Format: |
data.Always present | string | Until when it works. Format: |
metaAlways present | object | Response metadata. |
meta.Always present | string | Unique request identifier (16 hexadecimal characters). It matches the Example: |
meta.Always present | string | IP the API saw your request come from. Useful if your API key only accepts certain networks. Example: |
meta.Always present | string | Date and time the response was built (ISO 8601 with offset). Format: |
meta.Always present | number | Time (ms) the server took to process the request. Example: |
Error codes
Every error response has the same shape: success set to false and an error object whose code says what happened. They are grouped here by kind, with the codes this endpoint can return.
Shape of an error response
| Name | Type | Description and rules |
|---|---|---|
successAlways present | boolean | Fixed value: |
metaAlways present | object | Response metadata. |
meta.Always present | string | Unique request identifier (16 hexadecimal characters). It matches the Example: |
meta.Always present | string | IP the API saw your request come from. Useful if your API key only accepts certain networks. Example: |
meta.Always present | string | Date and time the response was built (ISO 8601 with offset). Format: |
meta.Always present | number | Time (ms) the server took to process the request. Example: |
errorAlways present | object | |
error.Always present | string | Stable UPPER_SNAKE_CASE identifier. Clients branch on this value. Example: |
error. | integer | Legacy v5 numeric code, only when a bridge exists. Omitted for codes born in v6. Example: |
error.Always present | string | URL to the error documentation. Format: |
error.Always present | string | Human readable text, in English. It is for the developer log, not the end user: do not parse it. |
error.Always present | array<object> | Structured context (validation issues, affected resource). Empty array when there is no extra context. |
Authentication
- 401Invalid or missing credentials.
No Bearer token was sent, and every call requires one.
Message the API returns: Authentication is required. Send your API key as `Authorization: Bearer <token>`.
The API key is not recognized: wrong format, revoked or expired.
Message the API returns: The provided API key is invalid or has expired. Please verify the value sent in the `Authorization: Bearer` header.
Permissions
- 403The API key does not have the Storage service (
storage), cannot be used from the request network, or the organization is not active.
The key is not allowed to use the service behind this endpoint.
Message the API returns: This API key is not authorized to use the requested service.
The key only works from certain networks and your IP is not one of them.
Message the API returns: This API key cannot be used from this IP address. The address we saw is in `meta.clientIp`: call from one of the networks allowed for the key, or use a key that allows this one.
Your organization is suspended or closed.
Message the API returns: The organization associated with this API key is not active. Please contact support.
Usage limits
- 429Request limit exceeded.
You exceeded your organization quota for this endpoint.
Message the API returns: You have exceeded the allowed request rate for this endpoint. Please wait before retrying.
Resource not found
- 404The file does not exist for your organization. It is the same answer for a file that never existed, one from another organization, one already deleted or a malformed
id.
The file does not exist for your organization.
Internal errors and availability
- 503Storage is not responding right now. Retry after
Retry-After.
Generic 503: a service we depend on is not responding.
Other responses
This endpoint does not declare responses of this kind.
Special considerations
Files require a key with Storage
Files may be call recordings, audio or documents of your organization. Any API key with the Storage service (storage) can see them, and only the owner of your organization creates keys. Without the service, the key gets 403 AUTH_SERVICE_NOT_ALLOWED here and on every other Storage endpoint.