> ## Documentation Index
> Fetch the complete documentation index at: https://developers.paylinedata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Download a signed file

> Download an available signed Application PDF or signature certificate.

Use a finalized version and either `signed_pdf` or `esignature_certificate`. This endpoint streams the existing immutable PDF directly: it does not regenerate a file, redirect to storage or expose a storage URL/key. Authenticate with your API key, not a merchant cookie. No query parameters or range delivery are supported; the object limit is 20 MiB.

Scope, lineage, size and checksum are verified and access audit commits before bytes are released. Inaccessible versions return `404`, unfinished files `409 artifact_not_ready`, and storage/integrity failures `503 artifact_unavailable`. Save privately and check the HTTP result before opening the output. See [download instructions](https://developers.paylinedata.com/retrieve-applications.md#download-signed-files).

```text 200
Binary PDF bytes, saved to signed-application.pdf.
Check the HTTP result before opening the file.
```

```json 400
{
  "error": {
    "code": "invalid_request",
    "message": "The request is invalid.",
    "fields": [],
    "retryable": false
  },
  "supportReference": "c01b0f09-68f5-43e7-8685-a1994c07ed91"
}
```

```json 401
{
  "error": {
    "code": "unauthenticated",
    "message": "Authentication is required.",
    "fields": [],
    "retryable": false
  },
  "supportReference": "c01b0f09-68f5-43e7-8685-a1994c07ed91"
}
```

```json 403
{
  "error": {
    "code": "capability_denied",
    "message": "This operation is unavailable.",
    "fields": [],
    "retryable": false
  },
  "supportReference": "c01b0f09-68f5-43e7-8685-a1994c07ed91"
}
```

```json 404
{
  "error": {
    "code": "not_found",
    "message": "Application not found.",
    "fields": [],
    "retryable": false
  },
  "supportReference": "c01b0f09-68f5-43e7-8685-a1994c07ed91"
}
```

```json 409
{
  "error": {
    "code": "artifact_not_ready",
    "message": "The artifact is not ready.",
    "fields": [],
    "retryable": false
  },
  "supportReference": "c01b0f09-68f5-43e7-8685-a1994c07ed91"
}
```

```json 429
{
  "error": {
    "code": "rate_limited",
    "message": "The request rate limit was reached.",
    "fields": [],
    "retryable": true
  },
  "supportReference": "c01b0f09-68f5-43e7-8685-a1994c07ed91"
}
```

```json 503
{
  "error": {
    "code": "service_unavailable",
    "message": "The service is temporarily unavailable.",
    "fields": [],
    "retryable": true
  },
  "supportReference": "c01b0f09-68f5-43e7-8685-a1994c07ed91"
}
```


## OpenAPI

````yaml /openapi/applications-v1.json get /applications/{applicationId}/artifacts/{artifactVersionId}/{kind}
openapi: 3.1.0
info:
  title: Applications API — creation, recovery, retrieval and explicit reissue
  version: 1.0.0
  description: >-
    10N-909/910/911. Current answers and signed evidence are separate; retrieval
    and downloads require a committed sensitive-access audit. Artifact objects
    are bounded to 20 MiB, checksum/size verified before audit commit, then
    streamed without exposing storage URLs. GET status contains no protected
    values or merchant credential URL. Unreadable current authority returns
    protected_data_unavailable; no snapshot fallback. Artifact lookup is 404 if
    inaccessible, 409 artifact_not_ready before completion, or 503
    artifact_unavailable for integrity/storage failure. Clerk organization API
    keys and current local capabilities required. Tenant/environment/stable
    caller come from verified authority. 30 create attempts, 30 separate reissue
    attempts and 120 shared GET attempts per 60-second fixed window per stable
    caller; key replacement does not reset counters. Create body cap 65,536
    UTF-8 bytes; reissue body cap 1,024 UTF-8 bytes with 8-second read deadline,
    strings 2,048 characters, numeric pricing overrides 128 characters. Unknown
    fields rejected. Every implemented response is no-store. Persist requestId
    before the first attempt; after network failure/503 retry the original
    request, never generate a new ID. Schema defaults intentionally absent.
    Existing UI and signing remain unchanged. Protected values must never be
    logged by clients.
servers:
  - url: https://sandbox.paylinedata.com/api/v1
    description: Isolated Sandbox
  - url: https://dashboard.paylinedata.com/api/v1
    description: Production; separate activation required
security:
  - PartnerApiKey: []
paths:
  /applications/{applicationId}/artifacts/{artifactVersionId}/{kind}:
    get:
      summary: Download an existing immutable signed artifact
      description: >-
        Current authorization and exact Application/version/kind are rechecked
        on every download. Private PDF size/checksum and immutable lineage must
        pass before audit commit and streamed byte release. No regeneration,
        redirect, Blob URL/key, merchant cookie, query parameters or range
        delivery. Maximum object size 20 MiB. Audit/commit failure releases no
        PDF bytes.
      operationId: downloadApplicationArtifact
      parameters:
        - in: path
          name: applicationId
          required: true
          schema:
            type: string
            format: uuid
        - in: path
          name: artifactVersionId
          required: true
          schema:
            type: string
            format: uuid
        - in: path
          name: kind
          required: true
          schema:
            enum:
              - signed_pdf
              - esignature_certificate
      responses:
        '200':
          description: >-
            Binary PDF bytes (application/pdf), not JSON. Saved by the request
            example to signed-application.pdf after committed access audit.
          headers:
            Cache-Control:
              schema:
                const: no-store
            Content-Disposition:
              schema:
                type: string
          content:
            application/pdf:
              schema:
                type: string
                format: binary
        '400':
          description: Safe 400 error. No submitted values or credentials.
          headers:
            Cache-Control:
              schema:
                const: no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                error:
                  summary: Illustrative error; support reference is synthetic
                  value:
                    error:
                      code: invalid_request
                      message: The request is invalid.
                      fields: []
                      retryable: false
                    supportReference: c01b0f09-68f5-43e7-8685-a1994c07ed91
        '401':
          description: Safe 401 error. No submitted values or credentials.
          headers:
            Cache-Control:
              schema:
                const: no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                error:
                  summary: Illustrative error; support reference is synthetic
                  value:
                    error:
                      code: unauthenticated
                      message: Authentication is required.
                      fields: []
                      retryable: false
                    supportReference: c01b0f09-68f5-43e7-8685-a1994c07ed91
        '403':
          description: Safe 403 error. No submitted values or credentials.
          headers:
            Cache-Control:
              schema:
                const: no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                error:
                  summary: Illustrative error; support reference is synthetic
                  value:
                    error:
                      code: capability_denied
                      message: This operation is unavailable.
                      fields: []
                      retryable: false
                    supportReference: c01b0f09-68f5-43e7-8685-a1994c07ed91
        '404':
          description: Safe 404 error. No submitted values or credentials.
          headers:
            Cache-Control:
              schema:
                const: no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                error:
                  summary: Illustrative error; support reference is synthetic
                  value:
                    error:
                      code: not_found
                      message: Application not found.
                      fields: []
                      retryable: false
                    supportReference: c01b0f09-68f5-43e7-8685-a1994c07ed91
        '409':
          description: Safe 409 error. No submitted values or credentials.
          headers:
            Cache-Control:
              schema:
                const: no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                error:
                  summary: Illustrative error; support reference is synthetic
                  value:
                    error:
                      code: artifact_not_ready
                      message: The artifact is not ready.
                      fields: []
                      retryable: false
                    supportReference: c01b0f09-68f5-43e7-8685-a1994c07ed91
        '429':
          description: Safe 429 error. No submitted values or credentials.
          headers:
            Cache-Control:
              schema:
                const: no-store
            Retry-After:
              schema:
                type: integer
                minimum: 1
                maximum: 60
              example: 30
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                error:
                  summary: Illustrative error; support reference is synthetic
                  value:
                    error:
                      code: rate_limited
                      message: The request rate limit was reached.
                      fields: []
                      retryable: true
                    supportReference: c01b0f09-68f5-43e7-8685-a1994c07ed91
        '503':
          description: Safe 503 error. No submitted values or credentials.
          headers:
            Cache-Control:
              schema:
                const: no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                error:
                  summary: Illustrative error; support reference is synthetic
                  value:
                    error:
                      code: service_unavailable
                      message: The service is temporarily unavailable.
                      fields: []
                      retryable: true
                    supportReference: c01b0f09-68f5-43e7-8685-a1994c07ed91
      x-codeSamples:
        - lang: curl
          label: Server request · private output
          source: >-
            set +x

            umask 077

            : "${PAYLINE_API_BASE:?Use the trusted API base from Developer
            Settings}"

            : "${PAYLINE_API_KEY:?Load your Test key through your secret
            manager}"

            : "${APPLICATION_ID:?Use the ID from successful creation}"

            : "${ARTIFACT_VERSION_ID:?Use a finalized version from status}"

            curl --silent --show-error --fail-with-body --request GET \
              --url "$PAYLINE_API_BASE/applications/$APPLICATION_ID/artifacts/$ARTIFACT_VERSION_ID/signed_pdf" \
              --header "Authorization: Bearer $PAYLINE_API_KEY" \
              --output signed-application.pdf
components:
  schemas:
    Error:
      type: object
      additionalProperties: false
      properties:
        error:
          type: object
          additionalProperties: false
          properties:
            code:
              enum:
                - invalid_request
                - unauthenticated
                - capability_denied
                - not_found
                - request_conflict
                - handoff_changed
                - signing_input_locked
                - already_signed
                - reissue_ineligible
                - payload_too_large
                - unsupported_media_type
                - validation_failed
                - rate_limited
                - operation_unconfirmed
                - protected_data_unavailable
                - artifact_not_ready
                - artifact_unavailable
                - service_unavailable
            message:
              type: string
            fields:
              type: array
              items:
                type: object
                additionalProperties: false
                properties:
                  path:
                    type: string
                  code:
                    type: string
                required:
                  - path
                  - code
            retryable:
              type: boolean
          required:
            - code
            - message
            - fields
            - retryable
        supportReference:
          type: string
          format: uuid
      required:
        - error
        - supportReference
  securitySchemes:
    PartnerApiKey:
      type: http
      scheme: bearer
      bearerFormat: Clerk organization API key

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.