Download the signed module zip

GET 
/module-releases/:module/:version/download

Returns the zip from the manifest as a binary stream (NO JSON envelope). The client must not install before verifying the body's SHA-256 digest against X-Content-SHA256 / latest.sha256 and the ed25519 signature against latest.signature. No release or invalid manifest → 404 release_not_found (JSON).

Default rate limit bucket (default, 60/min).

Request

Responses

200

Zip file

Response Headers

Content-Length

Zip size (bytes)

Content-Disposition

Download file name

X-Content-SHA256

SHA-256 digest of the zip bytes (lowercase hex)

Cache-Control
X-RateLimit-Limit

The per-minute limit defined for this key

X-RateLimit-Remaining

Number of requests remaining in the current window

X-RateLimit-Reset

Unix epoch of the start of the next window (UTC seconds)

401

Authentication failed — missing header, wrong credential, outside the IP whitelist, or a revoked key. No detail is leaked; all cases return a single message.

Response Headers

WWW-Authenticate

RFC 7617 Basic Auth challenge

404

No valid release (release_not_found) — no module directory, no manifest or invalid manifest. The reason is not distinguished in the public response.

429

Per-minute limit exceeded

Response Headers

Retry-After

Seconds to wait before retrying after a 429 (RFC 7231 §7.1.3)

X-RateLimit-Limit

The per-minute limit defined for this key

X-RateLimit-Remaining
X-RateLimit-Reset

Unix epoch of the start of the next window (UTC seconds)