Loading…
Downloads a media file by its ID.
No authentication required. A bearer token is honoured when present (optional auth). An expired or revoked token is treated exactly like no token: the caller is a guest, so it cannot download sensitive media or media that needs view permission.
You must have view permission for the target attachable resource (except the ones that are accessible without authentication).
Sensitive media. A media row uploaded with a purpose (see POST /api/v1/media) is a private document and is never served publicly, regardless of what it is attached to. Access is decided per purpose, and any purpose without an explicit rule is denied:
| Purpose | Who may download |
|---|---|
trainer_license | The user the license belongs to, or a holder of users.view_all |
gym_license | The gym's owner (), or a holder of |
user_idgyms.view_allAnyone else, including anonymous callers, gets 403.
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| media-id | int | Yes | ID of the media to download | 123 |
| filename | string | Yes | The stored file name, as it appears in the media resource's link. Required by the route, but not used to find the file: the row's own filename is what is served, so a wrong value still downloads media 123. | a1b2c3.jpg |
Build the URL from the media resource's link field rather than by hand: link is exactly
/api/v1/media/{media-id}/{filename}.
GET /api/v1/media/123/a1b2c3.jpg
Authorization: Bearer {token}
The media file will be returned as a binary download.
Never 401: the route uses optional auth, so a missing, expired or revoked token makes the caller a guest, and a
guest who may not see the file gets 403.
| Status | Description | Reference |
|---|---|---|
| 403 | Forbidden (no permission) | Permission error |
| 404 | Not found | Not-found error |