Read a blob's bytes back, whole, streamed (D6)

GET

/api/blobs/{id}

Maintainer:Not configured

OperationId:get_blob

Visibility gates on the blob's own home via
blob_readable_by_profile — not visible renders as 404, the same not-found an unknown id
gets, so a probe learns nothing either way. The response speaks the STORED media type and
carries the byte count plus Cache-Control: private, immutable — content addressing is what earns
immutable (D1), and private because the bytes are per-caller authorized (a shared cache
is never licensed to store them); and Content-Disposition: attachment — a blob read is a
bytes fetch, never a rendering invitation (the F10 ruling: the posture survives the
operational changes — cookie auth, CSP relaxation, a commit-time-only allowlist — that
would otherwise turn stored active content into stored XSS). The provider address never
appears anywhere in the response (D6: the API is the only reader of the provider).

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Path Params

Header Params

Responses

🟢200OK

application/octet-stream

The blob's bytes, streamed; content type is the stored media type, Cache-Control is private, immutable, Content-Disposition is attachment

🟠401Unauthorized

🟠404Record Not Found

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/blobs/' \
--header 'X-Temper-Surface;' \
--header 'Authorization: Bearer <token>'

Response Example

401 - Example 1

{
    "error": {
        "code": "string",
        "details": null,
        "message": "string"
    }
}

Modified at 2026-10-06 12:32:37

Append one segment to a staged upload — raw bytes as the request body

Delete one blob — the ordinary delete act's ruled door