Download Statement File

GET /api/v1/statements/:id/download

Streams the original uploaded file bytes (PDF, CSV, Excel, etc.) for the given statement. The response uses Content-Disposition: attachment so HTTP clients will save the file with the original filename.

The bytes are fetched from object storage by the API server and proxied to the client — no signed URL is exposed.

Authentication

Requires statements:read permission.

Path Parameters

Parameter	Type	Description
`id`	string	Statement ID

Response

200 OK — the response body is the raw file bytes.

Header	Value
`Content-Type`	The statement's stored `mime_type` (e.g. `application/pdf`, `text/csv`). Falls back to `application/octet-stream`.
`Content-Disposition`	`attachment; filename="<original_file_name>"`
`Content-Length`	Byte size (from the statement's `file_size`, or S3's reported length).

Example Request

curl -X GET "https://statements.finopsbricks.com/api/v1/statements/abc123/download" \
  -H "api-key: fob_stm_xxxxxxxxxxxx" \
  -H "api-secret: xxxxxxxxxxxxxxxx" \
  -O -J

The -O -J flags tell curl to honor the server's Content-Disposition filename. Without -J, curl writes to a file named download.

Errors

Code	Description
401	Invalid or missing API credentials
403	API key lacks `statements:read` permission
404	Statement not found (`NOT_FOUND`) or statement has no associated file (`FILE_NOT_AVAILABLE` — e.g. created without an upload)
502	Object storage error fetching the file (`STORAGE_ERROR`)