# Download a file (/docs/api-reference/form-submissions/get-form-submission-file)

A file uploaded with the submission, as `application/octet-stream`: whatever its type, treat it as untrusted (a submitter chose it).

`GET https://api.coss.com/v1/forms/{id}/submissions/{submission_id}/files/{file_id}`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `id` (string, required): The form's id.
- `submission_id` (string, required): The submission's id.
- `file_id` (string, required): The file's id (`files[].id` of the submission).

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.forms.submissions.file("form_01kd2m8n3p4q5r6s7t8v9w0x1y", "fsub_01kd2m9a0b1c2d3e4f5g6h7j8k", "ffile_01kd2m9a0b1c2d3e4f5g6h7j8m");
```

HTTP:

```sh
curl -X GET "https://api.coss.com/v1/forms/form_01kd2m8n3p4q5r6s7t8v9w0x1y/submissions/fsub_01kd2m9a0b1c2d3e4f5g6h7j8k/files/ffile_01kd2m9a0b1c2d3e4f5g6h7j8m" \
  -H "Authorization: Bearer $COSS_API_KEY"
```

Python:

```python
from coss import Coss

client = Coss()  # api_key= or COSS_API_KEY

client.forms.submissions.file(
    id="id",
    submission_id="submission_id",
    file_id="file_id",
)
```

Go:

```go
import (
	"context"

	cossclient "github.com/cosscom/coss-go/client"
	forms "github.com/cosscom/coss-go/forms"
)

client := cossclient.NewClient() // option.WithAPIKey(…) or COSS_API_KEY

request := &forms.FileSubmissionsRequest{
    ID: "id",
    SubmissionID: "submission_id",
    FileID: "file_id",
}
client.Forms.Submissions.File(
    context.TODO(),
    request,
)
```

Ruby:

```ruby
require "coss"

client = Coss::Client.new # api_key: or COSS_API_KEY

client.forms.submissions.file(
  id: "id",
  submission_id: "submission_id",
  file_id: "file_id"
)
```

PHP:

```php
<?php

use Coss\Coss;

$client = new Coss(); // apiKey: or COSS_API_KEY

$client->forms->submissions->file(
    'id',
    'submission_id',
    'file_id',
);
```

Java:

```java
import com.coss.Coss;
import com.coss.resources.forms.submissions.requests.FileSubmissionsRequest;

Coss client = Coss.builder().build(); // .apiKey(…) or COSS_API_KEY

client.forms().submissions().file(
    "id",
    "submission_id",
    "file_id",
    FileSubmissionsRequest
        .builder()
        .build()
);
```

.NET:

```csharp
using Coss;
using Coss.Forms;

var client = new CossClient(); // apiKey: or COSS_API_KEY

await client.Forms.Submissions.FileAsync(
    new FileSubmissionsRequest
    {
        Id = "id",
        SubmissionId = "submission_id",
        FileId = "file_id",
    }
);
```

## Response 200

The file's bytes.

Content type: application/octet-stream.

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: No such form, submission or file (`not_found`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: Forms isn't available in this deployment yet (`forms_unavailable`).