Direct Downloads

Introduction

Using direct downloads, it will be possible to request a direct URL to the original or preview representation of any item.

Contract

A new endpoint without authentication is available as

Rights management

• When the URL is not signed (see below), then the following rights apply

  • The object must be published, formally this means that its https://mediahaven.atlassian.net/wiki/spaces/CS/pages/4082958355/MediaHaven+Record+Status#Record-Phase is “Published”

  • The object must have a read-right on the public group of the organisation, see https://mediahaven.atlassian.net/wiki/x/MwDF6g

• A signed URL is only delivered when the user has read rights on the object

Parameters

Response

When sending a GET request with optional parameters, the gateway service responds with a temporary redirect 302 Found to the appropriate storage URL. We use a temporary redirect because we want the browser to keep using the representation endpoint to count future statistics. When the parameter type is not provided, it is assumed to be Original.

Examples

Variants

Download with the original filename instead of redirect 24.3

An optional parameter action=Download can be provided to download the representation directly. This will start a download with the original filename. (no 302 redirect).

Consultation 25.2

An optional parameter action=Consultcan be provided to indicate this is a consultation instead of a download and generate as event type CONSULATION instead.

Direct Download via Signed URL 25.3

The ‘Direct Download via Signed URL’ module enhances the existing direct download functionality by embedding a secure, time-limited signed URL into the record data. This enables clients to share original files directly from storage.

When this module is active:

• Fetching records via the rest api (e.g., via GET /records/) will include a signed URL in the field Internal.PathToOriginal.

  • Also see https://mediahaven.atlassian.net/wiki/spaces/CS/pages/3708682241/Direct+Downloads#Configuration below

• The signed URL provides temporary access to the original file

An example of what this can look like (Record example abbreviated to just the relevant metadata):

Security features and considerations:

• The signed URL expires when the access token of the API user that fetched the record expires.

• The signed url will expire after a period, depending on the configuration of the installation. By default this is set to 24 hours.

• Users with the function VIEW_BACKEND_SERVICES can disable signing on record request by providing the query parameter applySigning=false on the /mediahaven-rest-api/v2/records endpoint

Statistics

To store the events, we log them as Premis https://mediahaven.atlassian.net/wiki/spaces/CS/pages/1490485332 on the (flat) data object with types

Configuration

• The direct download is done using two https://mediahaven.atlassian.net/wiki/spaces/CS/pages/42074134

  • PathToOriginal for the original representation

    • This field is available on the following types of records:

      • Structural.RecordStructure = Representation and Administrative.IsOriginal = true

      • Structural.RecordStructure = DataFlat

      • Structural.RecordStructure = Data

  • PathToPreview for the access representation

• By default, the original is not accessible directly by any means and the response for type=Original will be 403 Forbidden

• Upon a service request, the original storage can be made publicly available with the caveat that the knowledge of the RecordId is sufficient to download any original