> ## Documentation Index > Fetch the complete documentation index at: https://docs.go.aiinsurance.io/llms.txt > Use this file to discover all available pages before exploring further. # Batch Download URLs > Mints short-lived signed read URLs for a batch of `ready` files in one round trip — the batch counterpart of `GET /files/{fileId}/download-url`, for fetching an entity's whole document set at once. Fetch each file's bytes with a plain `GET` of its `url`; the bytes come straight from cloud storage, never through this API. Each URL is signed with the requested content `disposition` and expires at `expiresAt` (15 minutes) — request fresh ones instead of caching. This is a `POST` because the id list is a request body, not a query string, but it is a read: it mints nothing durable and records no audit entry. **All-or-nothing.** If any requested file is missing, belongs to another company, or is not `ready` (a pending upload), the WHOLE request is rejected and NO URLs are returned — a mixed batch can never partially leak. A missing or cross-company id is a `404`; a not-ready file is a `409`. **Batch size is capped at 100 ids.** More than 100, or an empty `fileIds` array, is a `400`. Always serves each file's current version — this endpoint does not expose per-version pinning. **Required permission:** `company.file:download` ## OpenAPI ````yaml /openapi/generated-external-api.yaml post /api/v1/companies/{companyId}/files/download-urls openapi: 3.0.3 info: title: AI Insurance External API description: External API for AI Insurance platform version: 1.0.0 contact: email: support@aiinsurance.io servers: - url: https://go.aiinsurance.io description: Production security: - ApiKeyAuth: [] paths: /api/v1/companies/{companyId}/files/download-urls: post: tags: - Company Files summary: Batch Download URLs description: > Mints short-lived signed read URLs for a batch of `ready` files in one round trip — the batch counterpart of `GET /files/{fileId}/download-url`, for fetching an entity's whole document set at once. Fetch each file's bytes with a plain `GET` of its `url`; the bytes come straight from cloud storage, never through this API. Each URL is signed with the requested content `disposition` and expires at `expiresAt` (15 minutes) — request fresh ones instead of caching. This is a `POST` because the id list is a request body, not a query string, but it is a read: it mints nothing durable and records no audit entry. **All-or-nothing.** If any requested file is missing, belongs to another company, or is not `ready` (a pending upload), the WHOLE request is rejected and NO URLs are returned — a mixed batch can never partially leak. A missing or cross-company id is a `404`; a not-ready file is a `409`. **Batch size is capped at 100 ids.** More than 100, or an empty `fileIds` array, is a `400`. Always serves each file's current version — this endpoint does not expose per-version pinning. **Required permission:** `company.file:download` operationId: createCompanyFileDownloadUrls parameters: - $ref: '#/components/parameters/companyId' requestBody: required: true content: application/json: schema: type: object required: - fileIds properties: fileIds: type: array minItems: 1 maxItems: 100 items: type: string format: uuid description: >- The files to mint URLs for. 1–100 ids; duplicates are minted once. disposition: type: string enum: - attachment - inline default: attachment description: >- Content disposition signed into every URL. `attachment` (default) prompts a download with the original filename; `inline` lets the browser render the file (PDF viewer, images). examples: download: summary: Download a set of files value: fileIds: - 550e8400-e29b-41d4-a716-446655440001 - 550e8400-e29b-41d4-a716-446655440002 preview: summary: Preview a set of files inline value: fileIds: - 550e8400-e29b-41d4-a716-446655440001 disposition: inline responses: '200': description: One signed download URL per requested file content: application/json: schema: type: object properties: downloadUrls: type: array items: type: object properties: fileId: type: string format: uuid description: The requested file this URL is for url: type: string description: Short-lived signed URL to GET the file bytes from expiresAt: type: string format: date-time description: ISO instant the URL stops working fileName: type: string description: >- The version's original filename (also signed into the URL's content disposition) contentType: type: string description: MIME type of the file byteSize: type: integer description: Size of the file in bytes examples: success: summary: Two download URLs value: downloadUrls: - fileId: 550e8400-e29b-41d4-a716-446655440001 url: >- https://storage.googleapis.com/bucket/companies/.../files/...?X-Goog-Expires=900&X-Goog-Signature=... expiresAt: '2026-07-23T09:30:00.000Z' fileName: master-agreement.pdf contentType: application/pdf byteSize: 482133 - fileId: 550e8400-e29b-41d4-a716-446655440002 url: >- https://storage.googleapis.com/bucket/companies/.../files/...?X-Goog-Expires=900&X-Goog-Signature=... expiresAt: '2026-07-23T09:30:00.000Z' fileName: loss-runs.pdf contentType: application/pdf byteSize: 118220 '400': description: Empty `fileIds`, more than 100 ids, or a malformed body content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: tooMany: summary: Batch exceeds the 100-id cap value: error: code: BadRequest message: 'Too big: expected array to have <=100 items' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: >- All-or-nothing — a requested file does not exist or belongs to another company content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: notFound: summary: >- One id in the batch does not exist (whole request rejected, no URLs returned) value: error: code: NotFound message: 'File not found: 550e8400-e29b-41d4-a716-446655440020' '409': description: All-or-nothing — a requested file is not ready for download content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: notReady: summary: >- One file in the batch is a pending upload (whole request rejected, no URLs returned) value: error: code: Conflict message: >- File is not ready for download: 550e8400-e29b-41d4-a716-446655440020 '500': $ref: '#/components/responses/InternalServerError' components: parameters: companyId: name: companyId in: path required: true schema: type: string format: uuid description: Company identifier schemas: ErrorResponse: type: object description: Standard error response for all external API endpoints required: - error properties: error: type: object required: - code - message properties: code: type: string description: Machine-readable error code example: VALIDATION_ERROR message: type: string description: Human-readable error message example: 'submissionId: Required field is missing' userMessages: type: array description: >- Clean, verbatim-displayable messages — one entry per failure, free of error-code tags, field paths, and internal noise. Suitable for showing to end users as-is. items: type: string example: - Exposures of type 'company' require an address details: type: array description: Additional details for validation errors (field-level errors) items: type: object properties: field: type: string description: The field that caused the error example: submissionId message: type: string description: Description of the field error example: Required field is missing responses: Unauthorized: description: Unauthorized - Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingApiKey: summary: Missing API key value: error: code: AuthenticationError message: API key authentication required userMessages: - API key authentication required invalidApiKey: summary: >- Invalid API key (e.g. unknown key, or a Bearer token used instead of an API key) value: error: code: AuthenticationError message: Invalid API key userMessages: - Invalid API key Forbidden: description: Forbidden - Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: insufficientPermissions: summary: Insufficient permissions value: error: code: AuthorizationError message: User is not authorized to perform the requested action userMessages: - User is not authorized to perform the requested action companyMismatch: summary: A valid API key naming another company in the URL value: error: code: AuthorizationError message: API key is not scoped to the requested company userMessages: - API key is not scoped to the requested company InternalServerError: description: Internal Server Error - Unexpected error occurred content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internalError: summary: Unexpected server error value: error: code: UncaughtActionError message: Uncaught error occurred in userMessages: - An unexpected error occurred. Please try again later. securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization description: >- API key authentication. Send your raw API key as the `Authorization` header value with NO scheme prefix — `Authorization: YOUR-API-KEY`. Do NOT prefix it with `Bearer ` or `ApiKey `, and do not use an `X-API-Key` header; those are not accepted. ````