# Download a Report

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

The report's file, through the signed link its read answered — no token needed.

## Overview

- Call `download.url` from [Get a Report](https://docs.aureahub.com/docs/report-get.md) as it is, on `https://api.aureahub.com`, before `download.expiresAt`: `expires` and `signature` are its credential, for that report of your tenant only. No `Authorization` header is needed, and none opens the file without them.
- `200`: the file, as an attachment — `text/csv; charset=utf-8` or `application/json; charset=utf-8`, `content-disposition` naming it `report-<type>-<id>.<format>`, `cache-control: no-store`, and `x-content-sha256`, its SHA-256 in hex.
- `410` `REPORT_LINK_EXPIRED` past its time — read the report for a new link —; `403` `REPORT_LINK_INVALID` for a link changed, or of another report or tenant; `409` `REPORT_NOT_READY`; `410` `REPORT_EXPIRED` or `REPORT_FILE_GONE` once the file is deleted — ask for the report again.
- 30 downloads a minute from one address; more answer `429`. Each download is written to your audit trail as `report.downloaded`, with no signed-in actor (`via` `signed_link`).

The start of a movements report in CSV:

```text
source,id,createdAt,chain,isTestnet,txHash,type,status,direction,from,to,amount,tokenAddress,tokenSymbol,tokenDecimals,fee,blockNumber,blockTime,walletId,accountId,userId
transaction,0b9d4c1e-3f6a-4b8e-9d2c-7a5e1f3b6c90,2026-10-02T09:12:40.511Z,base,false,0x7f3a…,token_transfer,confirmed,sent,0x2f4B…,0x5290…,25000000,0x8335…,USDC,6,21000000000000,36120455,2026-10-02T09:12:51.000Z,7c1e9b24-3f5a-4d8e-9b6c-1a2f3e4d5c6b,3b8f2c6e-1d4a-4e9b-8f7c-2a5d6e9b1c40,5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d
inbound_transfer,a1c3e5f7-2b4d-4f68-9a0c-1e3d5b7f9a2c,2026-10-03T14:01:05.118Z,base,false,0x91d2…,transfer,confirmed,received,0x4b20…,0x2f4B…,1000000000000000,,,,,36163010,2026-10-03T14:00:47.000Z,7c1e9b24-3f5a-4d8e-9b6c-1a2f3e4d5c6b,3b8f2c6e-1d4a-4e9b-8f7c-2a5d6e9b1c40,5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d
```

## Endpoint

### `GET /v1/admin/tenants/{id}/reports/{reportId}/download`

Authentication: none (public endpoint).

The report's file, through its signed link alone.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string (uuid) | yes | Your tenant's id, as in the link |
| `reportId` | string (uuid) | yes | The report's id, as in the link |

**Query parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `expires` | string | yes | As in the link: seconds since the epoch |
| `signature` | string | yes | As in the link: 43 characters of base64url |

**Responses**

`410` Link expired

```json
{
  "statusCode": 410,
  "error": "GoneError",
  "message": "The download link has expired: read the report for a new one",
  "details": { "code": "REPORT_LINK_EXPIRED" }
}
```

`403` Not this report's link

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "Not a download link for this report",
  "details": { "code": "REPORT_LINK_INVALID" }
}
```

**Example request**

```bash
curl -OJ "https://api.aureahub.com/v1/admin/tenants/6f1e2d3c-4b5a-4968-8776-a5b4c3d2e1f0/reports/4c8e2a19-7d3b-4f60-9a1e-5b2d8c6f0e73/download?expires=1791889524&signature=<signature>"
```

---

Web version: https://docs.aureahub.com/#report-download