curl --request POST \
--url https://go.aiinsurance.io/api/v1/companies/{companyId}/files/download-urls \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"fileIds": [
"550e8400-e29b-41d4-a716-446655440001",
"550e8400-e29b-41d4-a716-446655440002"
]
}
'{
"downloadUrls": [
{
"fileId": "550e8400-e29b-41d4-a716-446655440001",
"url": "https://storage.googleapis.com/bucket/companies/.../files/...?X-Goog-Expires=900&X-Goog-Signature=...",
"expiresAt": "2026-07-23T09:30:00.000Z",
"fileName": "master-agreement.pdf",
"contentType": "application/pdf",
"byteSize": 482133
},
{
"fileId": "550e8400-e29b-41d4-a716-446655440002",
"url": "https://storage.googleapis.com/bucket/companies/.../files/...?X-Goog-Expires=900&X-Goog-Signature=...",
"expiresAt": "2026-07-23T09:30:00.000Z",
"fileName": "loss-runs.pdf",
"contentType": "application/pdf",
"byteSize": 118220
}
]
}Batch Download URLs
Mints short-lived signed read URLs for a batch of ready files in one
round trip — the batch counterpart of
GET /files/{fileId}/download-url, for fetching an entity’s whole document
set at once. Fetch each file’s bytes with a plain GET of its url; the
bytes come straight from cloud storage, never through this API. Each URL is
signed with the requested content disposition and expires at expiresAt
(15 minutes) — request fresh ones instead of caching.
This is a POST because the id list is a request body, not a query string,
but it is a read: it mints nothing durable and records no audit entry.
All-or-nothing. If any requested file is missing, belongs to another
company, or is not ready (a pending upload), the WHOLE request is
rejected and NO URLs are returned — a mixed batch can never partially leak.
A missing or cross-company id is a 404; a not-ready file is a 409.
Batch size is capped at 100 ids. More than 100, or an empty fileIds
array, is a 400.
Always serves each file’s current version — this endpoint does not expose per-version pinning.
Required permission: file.download
curl --request POST \
--url https://go.aiinsurance.io/api/v1/companies/{companyId}/files/download-urls \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"fileIds": [
"550e8400-e29b-41d4-a716-446655440001",
"550e8400-e29b-41d4-a716-446655440002"
]
}
'{
"downloadUrls": [
{
"fileId": "550e8400-e29b-41d4-a716-446655440001",
"url": "https://storage.googleapis.com/bucket/companies/.../files/...?X-Goog-Expires=900&X-Goog-Signature=...",
"expiresAt": "2026-07-23T09:30:00.000Z",
"fileName": "master-agreement.pdf",
"contentType": "application/pdf",
"byteSize": 482133
},
{
"fileId": "550e8400-e29b-41d4-a716-446655440002",
"url": "https://storage.googleapis.com/bucket/companies/.../files/...?X-Goog-Expires=900&X-Goog-Signature=...",
"expiresAt": "2026-07-23T09:30:00.000Z",
"fileName": "loss-runs.pdf",
"contentType": "application/pdf",
"byteSize": 118220
}
]
}Authorizations
API key authentication. Send your raw API key as the Authorization header value with NO scheme prefix — Authorization: YOUR-API-KEY. Do NOT prefix it with Bearer or ApiKey, and do not use an X-API-Key header; those are not accepted.
Path Parameters
Company identifier
Body
The files to mint URLs for. 1–100 ids; duplicates are minted once.
1 - 100 elementsContent disposition signed into every URL. attachment (default) prompts a download with the original filename; inline lets the browser render the file (PDF viewer, images).
attachment, inline Response
One signed download URL per requested file
Show child attributes
Show child attributes