Original File Downloads

Original file downloads are disabled at the project level until an authorized administrator explicitly enables them. This setting controls access from both the Fastevo dashboard and the API.

⚠️

Original files are unprotected source assets. Enabling downloads allows project owners and administrators using 2FA, as well as every active project API key, to generate temporary download links. Review and revoke API keys that no longer need access before enabling this setting.

Storage and Download Access Are Different Settings

The original-download setting does not determine whether Fastevo keeps source files:

isStoringOriginalCopiesEnabled in the transcoding configuration controls whether original files are retained after processing.
originalDownloads.isEnabled controls whether retained originals can be downloaded.

Enabling download access cannot restore an original that was not retained. Disabling download access does not delete retained files.

Configure Downloads in the Dashboard

Project owners, organization administrators, and authorized Fastevo system administrators can manage the setting from:

Project → Configuration → Content settings → Original files

The dashboard opens this section with the ?tab=original-downloads query parameter.

Review the Security Warning

The confirmation identifies who will gain access, including all active project API keys.

Enable Two-Factor Authentication

Enabling original downloads is a critical action. The administrator must have 2FA configured and provide a current one-time password (OTP).

Enable Original File Downloads

Confirm the change and enter the OTP when prompted. Once enabled, authorized human users and project API keys can use the original file endpoint.

You can disable access immediately from the same screen without an OTP. After it is disabled, neither users nor project API keys can generate new download links.

ℹ️

Disabling downloads does not revoke signed URLs that have already been generated. Existing links remain usable until their one-hour expiration time.

Retrieve the Current Setting

GET https://api.fastevo.net/api/v1/projects/mediaProtection/configurations/general/originalDownloads

Example response:

{
  "isEnabled": false
}

Update the Setting

Only an authorized human project owner, organization administrator, or Fastevo system administrator can update this setting. Project API keys cannot enable or disable original downloads.

PUT https://api.fastevo.net/api/v1/projects/mediaProtection/configurations/general/originalDownloads
Content-Type: application/json
Authorization: Bearer USER_TOKEN||PROJECT_ID
X-OTP-Code: 123456
 
{
  "isEnabled": true
}

For these human-only project endpoints, use the project-scoped credential in the form USER_TOKEN||PROJECT_ID.

An OTP is always required whenever isEnabled is submitted as true. If 2FA is not configured, the API returns 428 Precondition Required with code OTP_SETUP_REQUIRED. If 2FA is configured but the request omits the OTP, it returns 428 Precondition Required with code OTP_CODE_REQUIRED. A malformed OTP returns 400, while an incorrect six-digit OTP returns 401.

To disable downloads in an emergency, send the same request with isEnabled set to false. Disabling does not require an OTP, but it still requires an authorized human user:

PUT https://api.fastevo.net/api/v1/projects/mediaProtection/configurations/general/originalDownloads
Content-Type: application/json
Authorization: Bearer USER_TOKEN||PROJECT_ID
 
{
  "isEnabled": false
}

The API returns the saved value:

{
  "isEnabled": false
}

Authorization Summary

Action	Human project owner, organization administrator, or Fastevo system administrator	Project API key
Read the current setting	Allowed	Not allowed
Enable original downloads	Allowed with 2FA and OTP	Not allowed
Disable original downloads	Allowed	Not allowed
Download an original while enabled	Allowed with 2FA and OTP	Allowed without OTP
Download an original while disabled	Not allowed	Not allowed

Configuration Errors

Status code	Meaning
`400`	The request body is invalid, or `X-OTP-Code` is present but is not exactly six digits.
`401`	Authentication is missing or invalid, or the submitted six-digit OTP is incorrect.
`403`	The authenticated identity is not allowed to read or change this project setting.
`428`	A required 2FA precondition is missing while enabling downloads: `OTP_SETUP_REQUIRED` means the user has not configured 2FA; `OTP_CODE_REQUIRED` means 2FA is configured but `X-OTP-Code` was omitted.

Audit Trail

Fastevo records changes to this setting, including the project, acting user, source IP, previous value, and new value. Original download requests are also audited. For project API keys, the audit record identifies the API key without storing or exposing the key secret.

Transcoding Apple FairPlay