file_id or the id of a complete fileRef returned by the workflow’s final output as the file_id query parameter. References may be nested, including CDJ attachments and source originals. The response contains a signed download URL valid for ten minutes. Fetch the URL without an API token and follow redirects, and treat the URL as a temporary credential.
Authentication and scope
Requiresworkflow-runs-output-read for files in the final output of a completed run, or workflows-read for general runtime file access. The token owner must be a workspace administrator, and any workspace restriction on the token must match. The permission does not restrict access to runs created by that particular token or to one workflow within the authorized workspace. With a known run ID, an ERP token needs only workflows-execute and workflow-runs-output-read for the webhook/status/output/file flow. These abilities do not allow listing runs or reading their internal details, inputs, steps or diagnostics.
Temporary output ZIPs, PDFs and other fileRef values do not need to be persisted as workspace documents. Persisted documentRef values use the separate workspace document API and its permissions.
Availability
For output-only access, an unfinished run or an unknown file or a file whose ID is not present in the final output returns404. Files from another run require a validated internal alias; including an arbitrary file reference in JSON does not grant access.
An expired signed link returns 401. Request a new URL through this endpoint while the stored file remains available, without starting another run. The download can return 404 if the file has been removed; issuing a link does not extend file retention.
Completed run outputs automatically include download links for authorized file references. This endpoint remains available to renew one link. Both paths issue ten-minute links; storage redirects retain the original expiry. Link responses and redirects use Cache-Control: private, no-store.