Play or download a recording

Redirects to a signed link to one recording's audio. A record's media_url and download_url point here.

Use it:

  1. In a player (an <audio> element, a phone's media player): request the endpoint with your Authorization header without following the redirect, and give the Location link to the player. The player fetches it without your Authorization header (storage refuses a request that carries it) and seeks with range requests, so a long call plays to its end.
  2. Server-side download: follow the redirect. Most HTTP clients drop Authorization on a redirect to another host; if yours does not, read Location and fetch it yourself.
  3. The link works for one hour. Store the record's and the recording's ids, never the link, and request the endpoint again for a fresh one.

Response: 302 with Location. With download=true, the link serves the file as an attachment named for the call (call-2026-10-06_1003-15195550142.mp3).

Notes:

  • The redirect and the audio carry Cache-Control: private, no-store: don't keep audio on devices.
  • HEAD answers the same redirect to a link that answers HEAD only, for the audio's Content-Type and Content-Length.

Logged: each GET is recorded in the call's access log as play (download with download=true) before the link is handed over. Replays of the same link within its hour are not recorded again. HEAD is never recorded.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
uuid
required

The call record's id (a record's id).

uuid
required

The recording's id: the id of one of the record's recordings.

Query Params
boolean
Defaults to false

true: the link serves the audio as a file download (Content-Disposition: attachment) named for the call. false (the default): for playback. A recording's download_url is its media_url with download=true.

uuid

The one account to read, by its id (account.id). Only a caller that may choose the account (EMAK support) sends it, and must; everyone else reads the account they belong to. Absent for a caller that must name it: 400 parameter_missing. Empty or not an account id: 400 parameter_invalid. Given twice: 400 parameter_invalid for any caller. Sent by a caller that reads its own account: 403 forbidden. An account that does not exist or is disabled: 404 reference_not_found. Each names account_id in param. The account is named this way only: a request that sends the legacy account header X-Tenant-Domain-Uuid is refused (400 parameter_unknown).

Responses

Language
Credentials
Bearer
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
*/*
application/json