> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kirafin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a download link for a file

> Returns `{ download_url, expires_at }` — a link, not the bytes, and a JSON body rather than a `302` so your own code decides what to do next and the expiry is visible.

**The link is a bearer credential** and is deliberately short-lived (minutes): a URL survives in browser history, proxy logs and `Referer` headers. Do not store or log it, and request a new one instead of retrying an expired one — an expired link is refused by the storage layer, not by this API. The file downloads under its own `file_name`, because the `Content-Disposition` is inside the signature.

A file of a closed RFI is still readable: it is the answer that is frozen, not the file.

{/* version-stamp:start — generated by scripts/stamp-versions.ts, do not edit */}

<Info>Stable since **2025-01-01** — unchanged in **2026-06-01**.</Info>

{/* version-stamp:end */}


## OpenAPI

````yaml /openapi/kira-api.2026-06-01.json get /v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}
openapi: 3.1.0
info:
  title: Kira API
  version: '2026-06-01'
  description: >-
    REST API for users, KYC/KYB verification, virtual accounts, payouts,
    recipients, and webhooks. Every request requires an `x-api-key` header and a
    bearer access token (see Authentication). Pin your account to version
    `2026-04-14` before integrating.
  contact:
    name: Kira API Support
    email: support@kirafin.ai
servers:
  - url: https://api.balampay.com
    description: Production
  - url: https://api.balampay.com/sandbox
    description: Sandbox
security:
  - bearerAuth: []
    apiKeyAuth: []
tags:
  - name: Authentication
  - name: Versioning
  - name: Users
  - name: Virtual Accounts
  - name: Quotations
  - name: Payouts
  - name: Recipients
  - name: Reference
  - name: RFIs
paths:
  /v1/rfis/{rfi_id}/items/{item_id}/documents/{document_id}:
    get:
      tags:
        - RFIs
      summary: Get a download link for a file
      description: >-
        Returns `{ download_url, expires_at }` — a link, not the bytes, and a
        JSON body rather than a `302` so your own code decides what to do next
        and the expiry is visible.


        **The link is a bearer credential** and is deliberately short-lived
        (minutes): a URL survives in browser history, proxy logs and `Referer`
        headers. Do not store or log it, and request a new one instead of
        retrying an expired one — an expired link is refused by the storage
        layer, not by this API. The file downloads under its own `file_name`,
        because the `Content-Disposition` is inside the signature.


        A file of a closed RFI is still readable: it is the answer that is
        frozen, not the file.
      operationId: get_v1-rfis-rfi-id-items-item-id-documents-document-id
      parameters:
        - in: path
          name: rfi_id
          required: true
          schema:
            type: string
            format: uuid
          description: RFI UUID.
        - in: path
          name: item_id
          required: true
          schema:
            type: string
            format: uuid
          description: Item UUID. The item must be a `document` item of this RFI.
        - in: path
          name: document_id
          required: true
          schema:
            type: string
            format: uuid
          description: The file's own id, as returned in `documents[]`.
        - in: header
          name: X-Api-Version
          required: false
          description: >-
            Optional. The date-versioned API version to apply for this request
            (e.g. `2026-04-14`). When sent it always wins, even over your pinned
            account default. When omitted, the API uses your account's pinned
            version if set, otherwise a baseline default.
          schema:
            type: string
            example: '2026-06-01'
      responses:
        '200':
          description: A pre-signed link and when it expires.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RfiDocumentDownloadResponse'
        '400':
          description: Malformed `rfi_id`, `item_id`, or `document_id`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorResponse'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: >-
            The RFI belongs to another client or is `withdrawn`, the item does
            not belong to this RFI, or the RFI has no such file.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - bearerAuth: []
          apiKeyAuth: []
components:
  schemas:
    RfiDocumentDownloadResponse:
      type: object
      description: >-
        A short-lived link to the file, not the bytes. A JSON body rather than a
        `302` so your own code decides what to do next and the expiry is
        readable. The URL is a bearer credential until `expires_at` — do not
        store it, log it, or embed it in a page; request a new one when you need
        the file again.
      required:
        - download_url
        - expires_at
      properties:
        download_url:
          type: string
          format: uri
          description: Pre-signed URL. Downloads under the file's own `file_name`.
        expires_at:
          type: string
          format: date-time
          description: When the link stops working. Minutes away, deliberately.
    ValidationErrorResponse:
      type: object
      description: >-
        Validation / request error. The body shape is **not uniform** across the
        API — it varies by endpoint and by which validation layer rejects the
        request. The fields below are the union of what may appear; treat them
        all as optional. Observed shapes include `{ code, message }`, `{ code,
        message, errors[] }`, `{ code, error, details[] }`, `{ error, details[]
        }`, and a nested `{ error: { code, message, details } }`. Always branch
        on the HTTP status, not on a fixed body shape.
      properties:
        code:
          type: string
        message:
          type: string
        error:
          type:
            - string
            - object
          description: >-
            A short error label (e.g. `"Invalid data"`), or on some endpoints a
            nested `{ code, message, details }` object.
        errors:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
              message:
                type: string
            required:
              - field
              - message
        details:
          type:
            - array
            - object
          description: >-
            Per-issue detail. Shape varies by endpoint — typically an array of
            `{ message }` or `{ path, message, code }`, occasionally an object.
    ErrorResponse:
      type: object
      properties:
        message:
          type: string
        code:
          type: string
        statusCode:
          type: number
        error:
          type: string
        timestamp:
          type: string
        path:
          type: string
        details: {}
      required:
        - message
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Access token from `POST /auth` (the `data.access_token` value).
    apiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: API key issued by Kira. Required on every request, including `/auth`.

````