File download endpoints require files.download and are always tenant/environment scoped.
Endpoint familyScopePurpose
Signed download endpoints under /v1/files (with legacy /v1/s3 aliases)files.downloadDownload files that the authenticated tenant and environment can access.
File contents may include KYC documents, contracts, or other sensitive PII. Do not store downloaded files outside approved tenant retention and data-residency controls.