> ## Documentation index > Fetch the complete documentation index at: https://developer.rhombus.com/llms.txt > Use it to discover all available pages before exploring further. # Get a partner portal asset download url > Mint a short-lived presigned download URL for one piece of Partner Portal collateral, if the authenticated partner organization is entitled to it. ```http POST https://api2.rhombussystems.com/api/partnerportal/getDownloadUrl ``` EU organizations send the same request to `https://api2.eu.rhombussystems.com`. ## Authentication and parameters - `x-auth-apikey` (header, required): Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). - `Authorization` (header): instead of an API key, an OAuth access token (`Bearer `) with the `read` scope. - `x-auth-scheme` (header, string, default: `partner-api-token`): Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters. One of: `api-token`, `api`, `api-oauth-token`, `federated-token`, `partner-api-token`, `partner-api`, `partner-api-oauth-token`. ## Request body Content type: `application/json`. Request object for minting a short-lived presigned download URL for one piece of Partner Portal collateral. Carries the asset uuid only: there is no organization field, because the partner organization is always resolved from the authenticated principal and is never read from the request body, and there is no version field, because the download is always of the currently published version. - `assetUuid` (string | null): base 64 (url-safe) uuid string ## Response 200 OK. Content type: `application/json` - `downloadUrl` (string | null): Short-lived presigned URL the client may GET to fetch the asset's bytes. Null when the request failed or the partner is not entitled to the asset. - `error` (boolean | null) - `errorCode` (string | null): Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. - `errorMsg` (string | null) - `expiresAtMs` (integer | null): Epoch milliseconds at which the presigned URL expires. Null when the request failed or the partner is not entitled to the asset. - `warningMsg` (string | null) ## Errors Also 400, 401, 403, 429, 500, 503 with the standard error body (`errorCode`, `errorMsg`): https://developer.rhombus.com/errors ## OpenAPI ````yaml openapi: 3.0.1 info: title: Rhombus API version: "1.0" servers: - description: Production Server url: https://api2.rhombussystems.com security: - ApiKeyAuth: [] paths: /api/partnerportal/getDownloadUrl: post: description: Mint a short-lived presigned download URL for one piece of Partner Portal collateral, if the authenticated partner organization is entitled to it. operationId: getDownloadUrl parameters: - description: "Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters." example: partner-api-token in: header name: x-auth-scheme required: false schema: default: partner-api-token enum: - api-token - api - api-oauth-token - federated-token - partner-api-token - partner-api - partner-api-oauth-token type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/Partnerportal_GetPartnerPortalAssetDownloadUrlWSRequest" responses: "200": content: application/json: schema: $ref: "#/components/schemas/Partnerportal_GetPartnerPortalAssetDownloadUrlWSResponse" description: OK "400": $ref: "#/components/responses/BadRequest" "401": $ref: "#/components/responses/Unauthorized" "403": $ref: "#/components/responses/Forbidden" "429": $ref: "#/components/responses/TooManyRequests" "500": $ref: "#/components/responses/InternalServerError" "503": $ref: "#/components/responses/ServiceUnavailable" security: - ApiKeyAuth: [] - oauth2: - read summary: Get a partner portal asset download url tags: - Partner Portal Webservice components: schemas: Partnerportal_GetPartnerPortalAssetDownloadUrlWSRequest: description: "Request object for minting a short-lived presigned download URL for one piece of Partner Portal collateral. Carries the asset uuid only: there is no organization field, because the partner organization is always resolved from the authenticated principal and is never read from the request body, and there is no version field, because the download is always of the currently published version." properties: assetUuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string type: object Partnerportal_GetPartnerPortalAssetDownloadUrlWSResponse: description: Response object carrying a short-lived presigned download URL for one piece of Partner Portal collateral, and the epoch millisecond at which that URL stops working. properties: downloadUrl: description: Short-lived presigned URL the client may GET to fetch the asset's bytes. Null when the request failed or the partner is not entitled to the asset. nullable: true type: string error: nullable: true type: boolean errorCode: description: Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. nullable: true type: string errorMsg: nullable: true type: string expiresAtMs: description: Epoch milliseconds at which the presigned URL expires. Null when the request failed or the partner is not entitled to the asset. format: int64 nullable: true type: integer warningMsg: nullable: true type: string type: object securitySchemes: ApiKeyAuth: description: Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). in: header name: x-auth-apikey type: apiKey oauth2: description: 'OAuth 2.0 authorization code flow with PKCE (`S256`). Send the access token as `Authorization: Bearer `. Each operation lists the scopes it requires; a token without them is refused 403 with `WWW-Authenticate: Bearer error="insufficient_scope"`.' flows: authorizationCode: authorizationUrl: https://console.rhombus.com/oauth/authorize refreshUrl: https://auth-web.rhombussystems.com/oauth/token scopes: physical: Unlock doors and elevators, lockdown, alarms, speakers and robots read: View cameras, footage and settings write: Change settings and data tokenUrl: https://auth-web.rhombussystems.com/oauth/token type: oauth2 ````