Download private complaint evidence

Attachment contract

• GET /api/v1/complaints/{complaintReference}/attachments/primary requires complaints:attachments:read.
• The final primary segment is fixed. Collection routes, attachment UUIDs, storage keys, filenames, signed URLs, and arbitrary object selectors are not accepted.
• The response is one complete image/jpeg, image/png, or image/webp body. Range requests are rejected with 416.
• Missing, cross-account, erased, deletion-pending, deleted, or otherwise inaccessible evidence returns the same 404 behavior.

Privacy and integrity

• Evidence is read only from the dedicated private civic-complaint-evidence bucket by the trusted backend.
• The backend verifies byte length, SHA-256 digest, and image magic bytes, then revalidates active retention state before returning content.
• An erasure request stops new retrievals immediately. A bounded delivery lease delays final erasure completion only until already validated bytes finish or the crash-recovery lease expires.
• Responses include private, no-store caching, nosniff, same-origin resource policy, and a fixed non-identifying filename. Validated retrievals are recorded in immutable access evidence retained for 180 days.

Download example

curl "/api/v1/complaints/CMP-2026-0123456789ABCDEF/attachments/primary"   -H "Authorization: Bearer tus_live_your_key_here"   --output complaint-evidence

Use bounded retrieval

Private evidence downloads allow 12 requests per key and 60 per account each minute. At most two deliveries per account and eight across the service may be in progress; excess requests return 429 before storage download. Honor Retry-After, avoid speculative prefetching, and request evidence only when an authorized operator needs to inspect it.