---
id: CAP-COM-CAT-009
title: Retrieve purchased digital files
feature: FEAT-COM-CAT-02
product_area: commerce
module: catalog
revision: 1
status: draft
product_intent: proposed
implementation_evidence: observed
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
purpose: >-
  Buyers and support staff obtain private files through the download grants
  associated with purchased products.
outcomes:
  - Grant ownership controls member access to purchased files.
  - >-
    Finite capacity remains protected while retries and support preserve
    available uses.
concepts:
  - CON-COM-CAT-003
actors:
  - ACT-COM-005
  - ACT-COM-004
surfaces:
  - portal
  - console
  - api
permissions:
  - key: commerce.downloads.read
    where_checked: api
    scope: tenant
rules:
  - id: BR-CAP-COM-CAT-009-01
    proved_by: [ATS-COM-CAT-009-01, TST-COM-CAT-012]
    statement: >-
      A download is available to its grant’s owner or console support staff,
      while another member is denied access.
    kind: permission
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-commerce:modules/catalog/tests/e2e/downloads.e2e.spec.js#refuses
      an expired grant 409 and another member’s grant 403
    origin: none
  - id: BR-CAP-COM-CAT-009-02
    proved_by: [ATS-COM-CAT-006-14, ATS-COM-CAT-009-02, ATS-COM-CAT-009-04, TST-COM-CAT-012]
    statement: >-
      A limited grant consumes one use for each request key and file, preserves
      the remaining count on retries and refuses further new downloads after
      exhaustion.
    kind: calculation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-commerce:modules/catalog/tests/e2e/downloads.e2e.spec.js#gives
      the grant’s owner a signed link and consumes one use per Idempotency-Key
      (a retry costs nothing), until the grant is exhausted (409)
    origin: none
  - id: BR-CAP-COM-CAT-009-03
    proved_by: []
    statement: Unlimited download grants retain an unlimited remaining count.
    kind: calculation
    enforced_at:
      - service
    must_prove: false
    provenance: test
    source: >-
      services-commerce:modules/catalog/tests/e2e/downloads.e2e.spec.js#never
      counts an unlimited grant
    origin: none
  - id: BR-CAP-COM-CAT-009-04
    proved_by: [ATS-COM-CAT-009-03, TST-COM-CAT-012]
    statement: Support downloads leave the buyer’s remaining uses unchanged.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-commerce:modules/catalog/tests/e2e/downloads.e2e.spec.js#gives a
      console user the link without consuming a use
    origin: none
  - id: BR-CAP-COM-CAT-009-05
    proved_by: [ATS-COM-CAT-006-14, ATS-COM-CAT-009-01, ATS-COM-CAT-009-04, TST-COM-CAT-012]
    statement: >-
      Member downloads reject expired and revoked grants; unknown or wrong-kind
      grants and unrelated files are not found, while staff downloads bypass
      consumption and its expiry checks.
    kind: validation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-commerce:modules/catalog/tests/e2e/downloads.e2e.spec.js#answers
      404 for a grant of another kind, an unknown grant, and a file the product
      does not have
    origin: none
  - id: BR-CAP-COM-CAT-009-06
    proved_by: []
    statement: >-
      Successful download requests return a signed private-file link that
      expires after fifteen minutes.
    kind: policy
    enforced_at:
      - service
    must_prove: false
    provenance: observed
    source: >-
      services-commerce:modules/catalog/services/downloads/downloads.ts:downloadFile
    origin: none
scenarios:
  - id: SC-CAP-COM-CAT-009-01
    given: A member’s download grant has finite capacity
    when: Use distinct keys through its capacity and attempt one further download
    then: Allowed requests receive signed links and the new exhausted request fails
    provenance: test
    source: >-
      services-commerce:modules/catalog/tests/e2e/downloads.e2e.spec.js#gives
      the grant’s owner a signed link and consumes one use per Idempotency-Key
      (a retry costs nothing), until the grant is exhausted (409)
depends_on:
  - CAP-COM-CAT-006
evidence:
  - >-
    Pinned service inputs: modules/catalog/aws/api/storefront.routes.ts
    (download); services/downloads/downloads.ts;
    services/entitlements/entitlements-port.ts; tests/e2e/downloads.e2e.spec.js
controls: [TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-006, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-CRY-001, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-002, TC-PI-005, TC-PRV-001, TC-PRV-002]
exercised_by: [FAS-COM-CAT-02-03, FAS-COM-CAT-02-04]
suites: [TST-COM-CAT-012]
---

# Retrieve purchased digital files

## Purpose

Buyers and support staff obtain private files through the download grants associated with purchased products.

## How It Works

The caller requests a file through a download grant. Commerce resolves the grant and confirms the file belongs to the granted product’s listing. Member requests pass through entitlement consumption and receive a signed link when authorized. Repeated requests retain the entitlement result associated with their request reference. Support requests obtain the link without consuming member capacity. Foreign grants and unavailable files produce access or not-found responses. The product should explicitly review the staff bypass of expiry checks and confirm this deferred download scope.

## Relationships

The prepare and publish product presentations capability supplies related configuration or assessment used in this work.