Customers

Download a file the shopper bought

Answer 302 with a short-lived link to one file of a delivered digital entry. The response has no body; follow the Location header to receive the file. Each request counts towards the download limit and the access period the merchant set for the product.

Two ways to call it:

Link from the delivery email or the entry’s download_url. Pass the link token as the t query parameter. No API key and no shopper header is sent; the token is the credential, and sending a shopper header with it returns 400. Requests are limited per address and per entry.
Shopper credentials. Omit t, send the API key, and send the shopper’s session token in x-auth-token (or the store’s assertion in x-external-auth, never both). The shopper must be the buyer of the entry. A Connect key needs the fulfilment:read scope.

An entry or file that does not exist, a token that does not match and a shopper who is not the buyer all answer the same 404.

GET

fulfilment

downloads

{fulfilment_id}

{asset_id}

Download a file the shopper bought

curl --request GET \
  --url https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token

string

The signed-in shopper's session token. Must be the buyer of the entry. Send exactly one shopper credential, and only when t is omitted.

x-external-auth

string

Bring-your-own-auth assertion for stores that manage authentication in an external identity provider.

Format: <base64url(JSON)>.<base64url(HMAC-SHA256(JSON))> where the JSON is { "external_id": "...", "iat": <unix>, "exp": <unix> } and the HMAC is keyed on the store's hmac_secret. Claim lifetime capped at 300 seconds. Send exactly one shopper credential, and only when t is omitted.

x-idp-token

string

A raw token from the store's own identity provider, verified through the store's Auth verifier (fail-closed). Resolves the same shopper as x-auth-token. Send exactly one shopper credential, and only when t is omitted.

Path Parameters

fulfilment_id

string<uuid>

required

The entry's id from the list of delivered items.

asset_id

string<uuid>

required

The file's asset_id from the entry's downloads.

Query Parameters

string

The link token from the delivery email or the entry's download_url. 16 to 64 characters of letters, digits, - and _.

Pattern: ^[A-Za-z0-9_-]{16,64}$

Response

Redirect to a short-lived link to the file.

Download a file the shopper bought

curl --request GET \
  --url https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/fulfilment/downloads/{fulfilment_id}/{asset_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

Download a file the shopper bought

Authorizations

Headers

Path Parameters

Query Parameters

Response