> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blobhub.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Download Session File

Download the bytes of a `file` session object, along with its envelope.

## **POST** `/revisions/:id/data/query` (Command: `download_session_file`)

<Note>
  This is a binary response: pass `Accept: application/octet-stream` and the bytes come back as the
  response body, with the JSON envelope serialized into the `X-Response-Body` header instead of the
  body. `Access-Control-Expose-Headers` names `X-Response-Body`, so a browser client can read it.
</Note>

### Request Body

| Parameter    | Type   | Required | Description                           |
| :----------- | :----- | :------- | :------------------------------------ |
| `engine`     | string | Yes      | Must be `workflow_blobhub`.           |
| `command`    | string | Yes      | Must be `download_session_file`.      |
| `session_id` | string | Yes      | The ID of the session.                |
| `alias`      | string | Yes      | Alias of the file object to download. |

### Response

The bytes themselves, as `application/octet-stream` — there is no presigned URL to follow. The JSON
envelope travels in the `X-Response-Body` header instead of the body:

| Header            | Value                                                                       |
| :---------------- | :-------------------------------------------------------------------------- |
| `Content-Type`    | `application/octet-stream`                                                  |
| `X-Response-Body` | `{"status": "success", "object": {...}}` — the file object's full envelope. |

### Errors

* `forbidden` (403) — the alias does not exist, belongs to another revision, or its bytes are gone; a
  missing and an inaccessible file are deliberately indistinguishable, matching the platform's read-access
  convention for session objects.
* `invalid_file_object` — the alias names a session object that exists and is not a `file`.

### Example

<CodeGroup>
  ```bash Request theme={null}
  curl -X POST https://api.blobhub.io/v1/revisions/rev_001/data/query \
    -H "X-API-Key: $BLOB_API_KEY" \
    -H "Content-Type: application/json" \
    -H "Accept: application/octet-stream" \
    -d '{"engine":"workflow_blobhub","command":"download_session_file","session_id":"sess_001","alias":"report"}' \
    -o report.pdf -D -
  ```

  ```json Response theme={null}
  {
    "status": "success",
    "object": {
      "revision_id": "rev_001",
      "session_id": "sess_001",
      "alias": "report",
      "updated_at": "2026-07-12T10:00:00.000000Z",
      "value": {
        "type": "file",
        "file": {
          "name": "report.pdf",
          "content_type": "application/pdf",
          "size": 154829,
          "sha256": "bc3863f758932818eedbdaa783c4f7b62e5119c87cbd94725e2ce483c5623fe7"
        }
      }
    }
  }
  ```
</CodeGroup>

The bytes land in `report.pdf`; the JSON above is what `-D -` prints as the `X-Response-Body` header.

### See also

* [File session object](/blob-types/workflow/session-objects/file/introduction) — envelope shape and
  limits.
* [Upload Session File](/blob-types/workflow/operations/upload-session-file) — create or replace the
  file.