Signed Files & Storage

These endpoints deliver content through temporary signed URLs. Only the signing endpoint is called with OAuth; the generated URLs authenticate with their signature query parameters.

Signed URL security

Treat a signed URL as a temporary credential: do not log it, expose it in analytics, or share it beyond the intended consumer. Preserve the complete query string. A changed path, missing signature, or expired timestamp invalidates the link.

Create storage links

Required scope: files:read. {path} may contain nested segments and must be URL-encoded safely; traversal using .. is rejected. The file must already exist. Links expire after five minutes.

{
  "mime_type": "application/pdf",
  "size": 12450,
  "expires_at": "2026-09-11T12:05:00+00:00",
  "view_url": "https://…/api/v1/storage/local/reports/file.pdf?expires=…&signature=…",
  "download_url": "https://…/api/v1/storage/local/reports/file.pdf/download?expires=…&signature=…"
}

View storage content

Requires a valid signature, not an OAuth token. Returns the bytes with the stored MIME type.

Download storage content

Requires a valid signature and returns the file as a download.

Open a file link

Requires a valid signature. {file} is an optional wildcard path in the signed URL generated by Alution; do not assume it is a numeric model ID.

Open an inline image

Requires a valid signature. {path} is a wildcard relative image path.

Open an avatar

Requires a valid signature and returns the avatar selected by the signed query parameters generated by Alution.