Access a file by its hash

Serves the file identified by hash. Access is granted when:

• the caller is authenticated (session cookie or bearer token) and the file belongs to a space they are a member of, or
• a valid key query parameter is supplied (public/shared-link access), or
• the file has been shared to the public space.

The response is the raw file bytes with the original Content-Type and Content-Disposition headers. Pass ?redirect=1 to receive a 302 redirect to the underlying signed S3 URL instead.

Path Parameters
hash string — REQUIRED SHA-256 hash of the file, base64url-encoded (returned by the upload endpoint as the hash field). Example: 47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU

Query Parameters
download string When present (any value), sets Content-Disposition: attachment to force a browser download.
redirect string When present, returns a 302 redirect to the signed S3 URL instead of proxying the file.
key string Public share key. Allows unauthenticated access when the file has been shared with a key.
chunk uuid Chunk/card ID to verify the file belongs to a specific card.

Responses
200 File content with original MIME type. Schema — OPTIONAL string
302 Redirect to signed S3 URL (only when ?redirect is set).
404 File not found or access denied. Schema — OPTIONAL error string — OPTIONAL