# Download a file

Source: https://api-docs.magicdoor.com/api-reference/files/download-file

Fetches the file itself. The response is not the bytes but a 302 redirect to a short-lived signed storage URL, so any HTTP client that follows redirects gets the content.

`GET https://files.magicdoor.com/files/{fileId}/{filename}`

**Authentication:** bearer token in the `Authorization` header, as `Bearer <token>`.

## Path parameters

- `fileId` (string, required) — The file to fetch, as a Snowflake id in decimal-string form. Must be a positive whole number. Example: `1831208734196891648`.
- `filename` (string) — An optional trailing segment that renames the file for this download only — nothing is renamed in MagicDoor. Leave the whole segment off and the stored name is used. When you do send it, it must be 3 to 200 characters, and it must be URL-escaped. Example: `lease-agreement.pdf`.

## Query parameters

- `download` (boolean) — `true` makes the storage URL send `Content-Disposition: attachment`, so a browser saves the file instead of displaying it. Leave it off and browsers show what they can inline. Default: `false`. Example: `false`.

## Example request

```bash
# --location follows the redirect; --remote-name writes the file to disk
curl --location --remote-name \
  --url 'https://files.magicdoor.com/files/1831208734196891648/lease-agreement.pdf?download=true' \
  --header 'Authorization: Bearer ACCESS_TOKEN'
```

## Responses

### 302 — Redirect to the signed storage URL that holds the content

- `Location` (string) — The signed storage URL. It is valid for seven days and needs no MagicDoor access token of its own, so treat it as a secret. There is no response body.

### 401 — The access token is missing, expired, or invalid

### 404 — No such file, the file has been deleted, or it belongs to another company

```json
{
  "type": "https://httpstatuses.com/404",
  "title": "Not Found",
  "status": 404,
  "detail": "File not found.",
  "instance": "/files/1831208734196891648/lease-agreement.pdf",
  "traceId": "0HN7GK9C2M4PQ",
  "entityType": "File",
  "entityId": "1831208734196891648"
}
```

> **Note: Two requests, two credentials**
>
> The first request is to MagicDoor and needs your access token. The second is to storage and is authorised by the signature in the URL. Most clients handle both for you — cURL needs `--location`, and `fetch` follows redirects by default.
>
> Do not send your MagicDoor `Authorization` header on to the storage URL. Some clients strip it across hosts and some do not; storage does not want it either way.

## Renaming the download

The trailing filename segment is a display name for this one download. With `download=true` it becomes the name the browser saves the file under; without it, it mostly just makes the URL readable. It never changes anything stored in MagicDoor, and the file is still found by its id whatever you put there.