Resolve Presigned Download
Backs downloads the api presigns on a bucket's own hostname with the platform signing key (UPL-146). The worker verifies the signature, then calls this with the bucket hostname and the storage key the URL names. The api looks the object up in the bucket's storage and returns the bucket id, the object size and a presigned storage URL for method that lives five minutes; the worker records the request and redirects the client there. An unknown bucket or a missing object returns denied with REASON_NOT_FOUND. No grant is checked: a valid platform signature means the api already authorised the read when it signed.
Access: internal only — the portal worker, authenticated by the shared X-Upl-Internal-Token header matching S3_CREDENTIALS_INTERNAL_TOKEN (FailedPrecondition when unset, Unauthenticated on mismatch). No user authentication.
JWT access token obtained via OAuth2 flow or service account
In: header
Header Parameters
Define the version of the Connect protocol
Define the timeout, in ms
Request Body
application/json
The storage key the URL was signed for, without a leading slash.
1 <= length <= 1024The method the storage URL is minted for: a presigned URL is bound to it.
"GET" | "HEAD"Response Body
application/json
application/json
curl -X POST "https://uploads-api.xeonr.io/uplim.api.v1.InternalPortalService/ResolvePresignedDownload" \ -H "Connect-Protocol-Version: 1" \ -H "Connect-Timeout-Ms: 1000" \ -H "Content-Type: application/json" \ -d '{}'{
"denied": {
"reason": "REASON_UNSPECIFIED"
},
"bucketId": "string",
"sizeBytes": "string",
"storageUrl": "string"
}{
"code": "not_found",
"message": "string",
"details": [
{
"type": "string",
"value": "string",
"debug": {}
}
]
}