Download a hosted artifact

OpenAPI contract

Method

GET

Path

/api/v1/hosted/{hostingPath}

Security

jwtBearer (bearer) OR automationKey (bearer)

Response status

200 400 401 403 404 429 500

Request and response schemas

JSON

{
  "requestBody": {},
  "responses": {
    "200": {
      "description": "Hosted artifact",
      "content": {
        "application/java-archive": {
          "format": "binary",
          "type": "string"
        }
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "404": {
      "description": "Hosted artifact was not found, has expired, or is not visible to the caller",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

Fetch a successful build's hosted output with a dashboard JWT or an nfy_ key carrying artifact:read. Authentication is necessary but not sufficient: the server authorizes the exact task immediately before returning bytes. A project task requires effective artifact:output:read (including an ARTIFACT_CONSUMER grant); a legacy or ad-hoc task uses its exact-owner fallback. Hosted downloads use the task's hostingPath; the default is artifacts/{taskId}/native.jar, and the route is /api/v1/hosted/{hostingPath}.

The route is private and resource-authorized. Its response uses Cache-Control: private, no-store and Content-Disposition: attachment. hostingPath changes the address but never grants access; anonymous requests and paths that are absent, malformed, expired, or outside the caller's authorized resource boundary return the same not-found result. The path resolves only while its task is successful and its output remains stored; unfinished, failed, cancelled, or deleted tasks do not provide an artifact.