# Get files

URL: https://docs.hanzo.ai/docs/openapi/team/get-team-files-by-space-by-filename

> Streams one blob's raw BYTES back — this is the read side of the space file store, not a JSON envelope around it.

`GET /v1/team/files/{space}/{filename}`

> [Team →](https://docs.hanzo.ai/docs/openapi/team) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                                         |
| ------------- | ------------------------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/team/files/{space}/{filename}` |
| **Method**    | `GET`                                                   |
| **Operation** | `get_team_files_by_space_by_filename`                   |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`                  |

Streams one blob's raw BYTES back — this is the read side of the space file store, not a JSON envelope around it.

THE BLOB IS NAMED BY THE `file` QUERY PARAMETER, NOT BY :filename. The path segment is only the name a browser saves the download under; a request without ?file= is a 400 no matter what the path says.

The Content-Type is derived from the STORED BYTES, never from the name: only png, jpeg, gif and webp, recognized by their magic bytes, are served inline under their true type, and everything else is served inert as application/octet-stream with an attachment disposition. Every response carries nosniff, so a file uploaded under an .svg or .html name cannot be talked into executing in a viewer's origin. Blobs are immutable, so a hit caches privately for a year.

Same gate as the upload: verified token, membership of the space. A genuine miss, another tenant's space, a space the caller is not in, and a blob id belonging to a different space are ONE answer — 404 — because the physical key is org- and space-scoped and a foreign id is simply a key that does not exist. An unavailable backend is a 502, never an empty 200.

## Request

2 fields.

| Field      | In   | Type   | Required | Description |
| ---------- | ---- | ------ | -------- | ----------- |
| `space`    | path | string | yes      |             |
| `filename` | path | string | yes      |             |

## Response

| Status | Body   | Meaning |
| ------ | ------ | ------- |
| `2XX`  | string | Success |

`2XX` body — 1 field.

| Field    | In   | Type            | Always | Description |
| -------- | ---- | --------------- | ------ | ----------- |
| `(body)` | body | string (binary) | yes    |             |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo team files space get <space> <filename>
```

**SDK**

**.ts**

```ts
import { Configuration, TeamApi } from 'hanzoai';

const api = new TeamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getTeamFilesBySpaceByFilename({ space: 'space', filename: 'filename' });
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import TeamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = TeamApi(client).get_team_files_by_space_by_filename(space='space', filename='filename')
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.TeamAPI.GetTeamFilesBySpaceByFilename(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, team_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = team_api::get_team_files_by_space_by_filename(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.TeamApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new TeamApi(client).getTeamFilesBySpaceByFilename();
```

**HTTP**

```bash
curl https://api.hanzo.ai/v1/team/files/<space>/<filename> \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

MCP reaches **team** through the `team` tool, which names its 33 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list_team_account_providers"
         }
       }
     }'
```

---

[Team API](https://docs.hanzo.ai/docs/openapi/team) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)