RFIs

Get a download link for a file

Returns { download_url, expires_at } — a link, not the bytes, and a JSON body rather than a 302 so your own code decides what to do next and the expiry is visible.

The link is a bearer credential and is deliberately short-lived (minutes): a URL survives in browser history, proxy logs and Referer headers. Do not store or log it, and request a new one instead of retrying an expired one — an expired link is refused by the storage layer, not by this API. The file downloads under its own file_name, because the Content-Disposition is inside the signature.

A file of a closed RFI is still readable: it is the answer that is frozen, not the file.

GET

rfis

{rfi_id}

items

{item_id}

documents

{document_id}

Get a download link for a file

curl --request GET \
  --url https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'x-api-key: <api-key>'

import requests

url = "https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}"

headers = {
    "Authorization": "Bearer <token>",
    "x-api-key": "<api-key>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {Authorization: 'Bearer <token>', 'x-api-key': '<api-key>'}
};

fetch('https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}")
  .header("Authorization", "Bearer <token>")
  .header("x-api-key", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "download_url": "<string>",
  "expires_at": "2023-11-07T05:31:56Z"
}

{
  "code": "<string>",
  "message": "<string>",
  "error": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ],
  "details": "<array>"
}

{
  "message": "<string>",
  "code": "<string>",
  "statusCode": 123,
  "error": "<string>",
  "timestamp": "<string>",
  "path": "<string>",
  "details": "<unknown>"
}

{
  "message": "<string>",
  "code": "<string>",
  "statusCode": 123,
  "error": "<string>",
  "timestamp": "<string>",
  "path": "<string>",
  "details": "<unknown>"
}

Stable since 2025-01-01 — unchanged in 2026-06-01.

Authorizations

Authorization

string

header

required

Access token from POST /auth (the data.access_token value).

x-api-key

string

header

required

API key issued by Kira. Required on every request, including /auth.

Headers

X-Api-Version

string

Optional. The date-versioned API version to apply for this request (e.g. 2026-04-14). When sent it always wins, even over your pinned account default. When omitted, the API uses your account's pinned version if set, otherwise a baseline default.

Example:

"2026-06-01"

Path Parameters

rfi_id

string<uuid>

required

RFI UUID.

item_id

string<uuid>

required

Item UUID. The item must be a document item of this RFI.

document_id

string<uuid>

required

The file's own id, as returned in documents[].

Response

A pre-signed link and when it expires.

A short-lived link to the file, not the bytes. A JSON body rather than a 302 so your own code decides what to do next and the expiry is readable. The URL is a bearer credential until expires_at — do not store it, log it, or embed it in a page; request a new one when you need the file again.

download_url

string<uri>

required

Pre-signed URL. Downloads under the file's own file_name.

expires_at

string<date-time>

required

When the link stops working. Minutes away, deliberately.

Get a download link for a file

curl --request GET \
  --url https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'x-api-key: <api-key>'

import requests

url = "https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}"

headers = {
    "Authorization": "Bearer <token>",
    "x-api-key": "<api-key>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {Authorization: 'Bearer <token>', 'x-api-key': '<api-key>'}
};

fetch('https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}")
  .header("Authorization", "Bearer <token>")
  .header("x-api-key", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.balampay.com/v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "download_url": "<string>",
  "expires_at": "2023-11-07T05:31:56Z"
}

{
  "code": "<string>",
  "message": "<string>",
  "error": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ],
  "details": "<array>"
}

{
  "message": "<string>",
  "code": "<string>",
  "statusCode": 123,
  "error": "<string>",
  "timestamp": "<string>",
  "path": "<string>",
  "details": "<unknown>"
}

{
  "message": "<string>",
  "code": "<string>",
  "statusCode": 123,
  "error": "<string>",
  "timestamp": "<string>",
  "path": "<string>",
  "details": "<unknown>"
}

Authentication

Versioning

Users

Virtual Accounts

Quotations

Payouts

Recipients

Reference

RFIs

Get a download link for a file

Authorizations

Headers

Path Parameters

Response