Download a published encrypted tenant backup

GET

/api/admin/tenant-backups/{operationId}/download

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/api/admin/tenant-backups/example/download \
  --header 'Authorization: Bearer <token>'

Requires backup read and export permissions and fresh human administrator authentication. Backups containing sensitive logs also require the sensitive-backup permission. Downloads are available only for ready exports within seven days of publication. Each encrypted part is verified before transmission; a failed or expired stream terminates without a complete file. The export-receipt endpoint provides independently authenticated ordered segment sizes and digests for splitting this concatenated response. A download-start audit event must be persisted before transmission.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Path Parameters

operationId

required

string

Responses

200

Encrypted backup attachment. Responses must not be cached.

Media type application/octet-stream

string format: binary

400

Invalid operation identifier

403

Missing permission or fresh administrator authentication

404

Operation not found in the current tenant

409

Export is not ready, has expired, or is unavailable

503

Backup storage or audit persistence is unavailable