Private files and retention

Infinity Flow retains outputs for 24 hours from readyAt. Generation responses include expiresAt and download availability. Long processing does not consume the download window before an output becomes ready.

Route	Purpose
GET /generations/{id}/outputs/0/download	Authorize ownership and redirect to a private download
GET /generations/{id}/outputs/0/download-ticket	Return { "url": "..." } with a temporary URL
GET /generations/{id}/outputs/0/play	Authorized inline playback
GET /generations/{id}/outputs/0/thumbnail	Private thumbnail when available

All require media:read, valid account/automation access and ownership. Output index is currently 0 because each job produces one result.

Two different expiry windows

A delivery URL normally lasts up to 90 seconds, capped by remaining retention. The media itself has a 24-hour window. If the link expires while the output remains available, request another ticket; that does not extend retention.

Never store temporary delivery URLs as permanent public links or expose them in logs, analytics or public support tickets. Anyone holding one can access the file during its short validity.

Do not forward your Bearer

The simplest flow calls download-ticket from your backend with Authorization, then downloads its returned URL in a second request without the API key. HTTP clients following redirects must strip Authorization when the host changes. Do not enable credential forwarding to other destinations.

Save the result to your operation’s storage before expiresAt. Expired output is never regenerated automatically, and replaying an old request key does not create a new video.