> ## Documentation Index > Fetch the complete documentation index at: https://docs.go.aiinsurance.io/llms.txt > Use this file to discover all available pages before exploring further. # Download Form > Returns a short-lived signed URL to download a form's **current version** original uploaded file, addressed by its stable `FM-XXXX` `number`. Works for both DOCX templates and static PDF forms — the file you get back is the DOCX (templates) or PDF (static forms) exactly as it was uploaded. Fetch the bytes with a plain `GET` of `downloadUrl` — they come straight from cloud storage, never through this API. The URL is signed with an `attachment; filename=""` content disposition and expires at `expiresAt` (15 minutes); request a fresh one instead of caching it. Pair this with [List Forms](./list-forms) to discover a form's number. **Required permission:** `forms:read` ## OpenAPI ````yaml /openapi/generated-external-api.yaml get /api/v1/companies/{companyId}/forms/{number} openapi: 3.0.3 info: title: AI Insurance External API description: External API for AI Insurance platform version: 1.0.0 contact: email: support@aiinsurance.io servers: - url: https://go.aiinsurance.io description: Production security: - ApiKeyAuth: [] paths: /api/v1/companies/{companyId}/forms/{number}: get: tags: - Forms summary: Download Form description: > Returns a short-lived signed URL to download a form's **current version** original uploaded file, addressed by its stable `FM-XXXX` `number`. Works for both DOCX templates and static PDF forms — the file you get back is the DOCX (templates) or PDF (static forms) exactly as it was uploaded. Fetch the bytes with a plain `GET` of `downloadUrl` — they come straight from cloud storage, never through this API. The URL is signed with an `attachment; filename=""` content disposition and expires at `expiresAt` (15 minutes); request a fresh one instead of caching it. Pair this with [List Forms](./list-forms) to discover a form's number. **Required permission:** `forms:read` operationId: downloadForm parameters: - $ref: '#/components/parameters/companyId' - $ref: '#/components/parameters/formTemplateNumber' responses: '200': description: Signed download URL for the form's current-version file content: application/json: schema: $ref: '#/components/schemas/Fmv1FormDownloadUrl' examples: success: summary: Download URL value: downloadUrl: >- https://storage.googleapis.com/bucket/acme/.../formTemplates/.../V-001/....docx?X-Goog-Expires=900&X-Goog-Signature=... fileName: Certificate of Insurance.docx contentType: >- application/vnd.openxmlformats-officedocument.wordprocessingml.document expiresAt: '2026-07-02T09:30:00.000Z' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: > No live form carries the given number (it never existed, or was already deleted). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: notFound: summary: Unknown or already-deleted number value: error: code: form-template-not-found message: No form template with number FM-0010 was found. userMessages: - No form template with number FM-0010 was found. '500': $ref: '#/components/responses/InternalServerError' components: parameters: companyId: name: companyId in: path required: true schema: type: string format: uuid description: Company identifier formTemplateNumber: name: number in: path required: true schema: type: string description: > The form template's stable `FM-XXXX` number (as returned by the Upload Form Template endpoint). It identifies the template across all of its versions and is the same value forms-logic rules reference. schemas: Fmv1FormDownloadUrl: type: object description: >- A short-lived signed URL to download a form's current-version file, plus the metadata a caller needs to save it. required: - downloadUrl - fileName - contentType - expiresAt properties: downloadUrl: type: string description: >- Short-lived signed URL to GET the file bytes from cloud storage directly (they never pass through this API). fileName: type: string description: >- The download filename (also signed into the URL's `attachment` content disposition), e.g. `Certificate of Insurance.docx`. contentType: type: string description: >- MIME type of the file — the DOCX Office type for templates, `application/pdf` for static forms. expiresAt: type: string format: date-time description: >- ISO instant the URL stops working (15 minutes out). Request a fresh one instead of caching it. ErrorResponse: type: object description: Standard error response for all external API endpoints required: - error properties: error: type: object required: - code - message properties: code: type: string description: Machine-readable error code example: VALIDATION_ERROR message: type: string description: Human-readable error message example: 'submissionId: Required field is missing' userMessages: type: array description: >- Clean, verbatim-displayable messages — one entry per failure, free of error-code tags, field paths, and internal noise. Suitable for showing to end users as-is. items: type: string example: - Exposures of type 'company' require an address details: type: array description: Additional details for validation errors (field-level errors) items: type: object properties: field: type: string description: The field that caused the error example: submissionId message: type: string description: Description of the field error example: Required field is missing responses: Unauthorized: description: Unauthorized - Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingApiKey: summary: Missing API key value: error: code: AuthenticationError message: API key authentication required userMessages: - API key authentication required invalidApiKey: summary: >- Invalid API key (e.g. unknown key, or a Bearer token used instead of an API key) value: error: code: AuthenticationError message: Invalid API key userMessages: - Invalid API key Forbidden: description: Forbidden - Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: insufficientPermissions: summary: Insufficient permissions value: error: code: AuthorizationError message: User is not authorized to perform the requested action userMessages: - User is not authorized to perform the requested action companyMismatch: summary: A valid API key naming another company in the URL value: error: code: AuthorizationError message: API key is not scoped to the requested company userMessages: - API key is not scoped to the requested company InternalServerError: description: Internal Server Error - Unexpected error occurred content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internalError: summary: Unexpected server error value: error: code: UncaughtActionError message: Uncaught error occurred in userMessages: - An unexpected error occurred. Please try again later. securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization description: >- API key authentication. Send your raw API key as the `Authorization` header value with NO scheme prefix — `Authorization: YOUR-API-KEY`. Do NOT prefix it with `Bearer ` or `ApiKey `, and do not use an `X-API-Key` header; those are not accepted. ````