Signed URLs

Mint download URLs for a completed artifact, manage the long-lived ones, and audit what has been minted against it.

  • Mint Signed URLs (POST /artifacts/:id/signed-urls) — one download URL per file in the artifact. Requires artifacts:sign.
  • List Signed URL Audit (GET /artifacts/:id/signed-urls) — history of what has been minted, and the live state of any persistent links. Requires artifacts:read.
  • Retune Download Link (PATCH /artifacts/:id/signed-urls/:token) — move a persistent link's expiry later or earlier. Requires artifacts:write.
  • Revoke Download Link (DELETE /artifacts/:id/signed-urls/:token) — kill a persistent link immediately. Requires artifacts:write.

Signing is all-or-nothing: every file in the artifact is covered in a single batch with a shared expires_at.

Short-lived vs. persistent

The lifetime you request at minting decides which kind of URL you get:

  • ≤ 7 days — a time-limited signed URL per file, plus links.dashboard_url. Nothing is stored; once it expires, mint again.
  • > 7 days, up to 180 — a persistent download link per file. It stays valid for its whole lifetime, re-issuing a fresh short-lived URL behind the scenes on each hit, and it can be retuned or revoked. links.dashboard_url is tied to it.

Persistent links are the ones the PATCH and DELETE endpoints act on, addressed by the token embedded in the link URL. That token is returned only at minting — Epoch stores just a hash of it — so keep the URL if you intend to manage the link later.

A download link is a bearer credential. Anyone holding it can download the artifact with no authentication until it expires or is revoked. Treat it like a password: share it deliberately, and revoke it if it leaks.

artifacts:sign is intentionally separate from artifacts:write — a key that can read or generate artifacts does not implicitly receive the ability to mint download URLs.

See the Artifacts overview for the full lifecycle, consumption recipes (DuckDB, GeoPandas, QGIS), and why the webhook payload deliberately omits download URLs.