Download a build input

OpenAPI contract

Method

GET

Path

/api/v1/builds/{taskId}/input

Security

jwtBearer (bearer)

Response status

200 400 401 403 404 429 500

Request and response schemas

JSON

{
  "requestBody": {},
  "responses": {
    "200": {
      "description": "Build input archive",
      "content": {
        "application/octet-stream": {
          "format": "binary",
          "type": "string"
        }
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "404": {
      "description": "Requested build was not found",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "429": {
      "description": "HTTP rate limit or API-key NCU usage limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RateLimitError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

GET /api/v1/builds/{taskId}/input is JWT-only. For a project task, the caller must have effective artifact:input:read capability; artifact:output:read alone does not permit source access. A legacy or ad-hoc task uses its exact-owner fallback. Automation keys cannot download build inputs because the API-key scope catalog deliberately grants output access only.

The response is an application/octet-stream attachment using the original input filename and Cache-Control: private, no-store. A task outside the caller's resource boundary and an input that has already been removed are not exposed. Treat downloaded inputs as private source artifacts.

http

GET /api/v1/builds/{taskId}/input
Authorization: Bearer <token>