Skip to main content
Every accepted upload returns stable links for both generated ESX profiles:
The links are safe to store in your application. The private S3 signatures behind them are not.

Choose a profile

CapOut records the profile_code supplied with your upload. Use the download URL’s profile parameter to select the Contractor or Carrier file.

Download from an authenticated client

Send the same organization-scoped capout-api-key used for upload, status, and document history. Do not put the key in the URL or a query parameter.
The URL alone does not grant access. A valid key for the document’s organization is required each time CapOut issues a fresh signed redirect.

Re-download without another claim

Downloading an existing export is free. Request the same stable .esx URL with a valid API key for the document’s organization whenever you need the file again. Downloading both Contractor and Carrier files does not consume additional claims. If a signed S3 URL expires, request the stable CapOut URL again to receive a fresh signature. This does not start another conversion or charge another claim. Do not re-upload the PDF just to retrieve an existing export. Use the upload response document_id in the URL, not an internal workflow or ESX task ID. A bare browser link cannot authenticate: the request needs the capout-api-key header.

Test-key downloads

New successful test-key exports generate real Contractor and Carrier ESX files with zero claims consumed and no XactNet delivery. Download them through the same authenticated URLs. Historical mock test exports have no generated artifact and may return ESX_PROFILE_NOT_AVAILABLE; they do not become real files retroactively.

How the stable redirect works

  1. Your integration stores the clean api.capout.ai URL returned by CapOut.
  2. The client requests the link with capout-api-key.
  3. CapOut validates the key and verifies that the durable document belongs to its organization.
  4. CapOut prepares a signed download URL for the selected Contractor or Carrier artifact.
  5. The route returns a non-cached 307 redirect to a signed private S3 URL.
  6. The S3 signature expires after 15 minutes, while the original CapOut link remains stable and can issue another fresh redirect later.
Do not copy the redirected S3 URL into your database or send it as the durable link. Always retain the clean CapOut URL.

Readiness and errors

The clean links are returned immediately after upload so you can store them with the job. They become downloadable only after ESX generation completes. Wait for export.completed, or for GET /status/{document_id} to report a completed export, before presenting the link as ready. A client that opens it early can retry after receiving 409. The same stable URLs are available from:
  • POST /upload
  • GET /status/{document_id} under export
  • GET /documents under each document’s export
  • realtime export.completed events
  • CapOut MCP processing, status, and waiting tools