Create a release download

GET/api/v2/releases/{id}/artifacts/{artifactId}/download

Authentication. Signed-in customer session (browser cookies), not an API key. The caller must be an organization member.

Path parameters

id string (uuid) required
artifactId string (uuid) required

Query parameters

organizationId string (uuid) required
environmentId string (uuid) required
artifactHash string (sha256) required
profileVerification boolean optional: Persisted profile bindings are always enforced. When true, also reject an unbound legacy release.

Response

200 OK Short-lived signed URL. The JSON authority response itself is never cacheable.

Headers

Cache-Control const "private, no-store, max-age=0" optional

Body

url string (uri) required
expires_at string (date-time) required
content_type string required
byte_length integer required
artifact_hash string (sha256) required
release_hash string (sha256) required
required_profile object optional
verification_report_hash string (sha256) optional
evidence_expires_at string (date-time) optional

Errors

Status	When
`400`	Invalid strict authority request.
`401`	An authenticated customer session is required.
`403`	Organization, role, hosted entitlement, or authority check failed.
`404`	An exact authority-bound resource was not found.
`409`	The supplied immutable identity conflicts with current authority state.
`410`	The released artifact passed its published retention window and is no longer downloadable.
`500`	Review/release authority failed closed.
`503`	The relevant launch control is held or signing authority is unavailable.

# Sent by the signed-in console; the browser supplies the session cookies.
curl \
https://runstamp.com/api/v2/releases/8f4fa0a3-f907-41f5-babe-5762f974cb83/artifacts/8f4fa0a3-f907-41f5-babe-5762f974cb83/download?organizationId=8f4fa0a3-f907-41f5-babe-5762f974cb83&environmentId=8f4fa0a3-f907-41f5-babe-5762f974cb83&artifactHash=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

Response 200 OK

JSON

{
  "url": "https://…",
  "expires_at": "2026-10-12T09:30:00.000Z",
  "content_type": "CONTENT_TYPE",
  "byte_length": 1,
  "artifact_hash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "release_hash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
}

Response

200 OK Short-lived signed URL. The JSON authority response itself is never cacheable.

Headers

Cache-Control const "private, no-store, max-age=0" optional

Body

url string (uri) required

expires_at string (date-time) required

content_type string required

byte_length integer required

artifact_hash string (sha256) required

release_hash string (sha256) required

required_profile object optional

verification_report_hash string (sha256) optional

evidence_expires_at string (date-time) optional

Errors

Status	When
`400`	Invalid strict authority request.
`401`	An authenticated customer session is required.
`403`	Organization, role, hosted entitlement, or authority check failed.
`404`	An exact authority-bound resource was not found.
`409`	The supplied immutable identity conflicts with current authority state.
`410`	The released artifact passed its published retention window and is no longer downloadable.
`500`	Review/release authority failed closed.
`503`	The relevant launch control is held or signing authority is unavailable.

# Sent by the signed-in console; the browser supplies the session cookies. curl \ https://runstamp.com/api/v2/releases/8f4fa0a3-f907-41f5-babe-5762f974cb83/artifacts/8f4fa0a3-f907-41f5-babe-5762f974cb83/download?organizationId=8f4fa0a3-f907-41f5-babe-5762f974cb83&environmentId=8f4fa0a3-f907-41f5-babe-5762f974cb83&artifactHash=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

{ "url": "https://…", "expires_at": "2026-10-12T09:30:00.000Z", "content_type": "CONTENT_TYPE", "byte_length": 1, "artifact_hash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "release_hash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" }