Autodesk Distribute an OSS Object via Signed URL

arazzo: 1.0.1
info:
  title: Autodesk Distribute an OSS Object via Signed URL
  summary: Confirm a bucket, locate an object, read its details, and mint a time-limited signed download URL.
  description: >-
    How you hand an Autodesk-hosted file to someone who has no APS credentials. The
    workflow confirms the bucket and its retention policy, finds the object by key
    prefix, reads its size and checksum so the recipient can verify the download, and
    creates a read-only signed URL that expires. Every step spells out its request
    inline so the flow can be read and executed without opening the underlying OpenAPI
    description.
  version: 1.0.0
sourceDescriptions:
- name: dataManagementApi
  url: ../openapi/autodesk-data-management-openapi.yml
  type: openapi
workflows:
- workflowId: distribute-object-signed-url
  summary: Produce an expiring, credential-free download link for a stored object.
  description: >-
    Reads bucket details, lists objects matching a key prefix, retrieves the object's
    metadata, and signs a read-access URL with an explicit expiry.
  inputs:
    type: object
    required:
    - bucketKey
    - objectKeyPrefix
    properties:
      bucketKey:
        type: string
        description: The OSS bucket holding the object.
      objectKeyPrefix:
        type: string
        description: >-
          Key prefix used to locate the object within the bucket (e.g. "renders/").
      minutesExpiration:
        type: integer
        description: How long the signed URL stays valid, in minutes.
        default: 60
  steps:
  - stepId: confirmBucket
    description: >-
      Read the bucket details to confirm it exists and to surface its retention
      policy, which determines how long objects in it survive.
    operationId: getBucketDetails
    parameters:
    - name: bucketKey
      in: path
      value: $inputs.bucketKey
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      bucketKey: $response.body#/bucketKey
      bucketOwner: $response.body#/bucketOwner
      policyKey: $response.body#/policyKey
  - stepId: locateObject
    description: >-
      List the objects in the bucket whose key begins with the supplied prefix and
      take the first match.
    operationId: getObjects
    parameters:
    - name: bucketKey
      in: path
      value: $steps.confirmBucket.outputs.bucketKey
    - name: beginsWith
      in: query
      value: $inputs.objectKeyPrefix
    - name: limit
      in: query
      value: 50
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      objectKey: $response.body#/items/0/objectKey
      objects: $response.body#/items
  - stepId: readObjectDetails
    description: >-
      Read the object's metadata. The sha1 and size let the recipient verify the file
      after downloading it through the signed URL.
    operationId: getObjectDetails
    parameters:
    - name: bucketKey
      in: path
      value: $steps.confirmBucket.outputs.bucketKey
    - name: objectKey
      in: path
      value: $steps.locateObject.outputs.objectKey
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      objectId: $response.body#/objectId
      size: $response.body#/size
      sha1: $response.body#/sha1
      contentType: $response.body#/contentType
  - stepId: signDownloadUrl
    description: >-
      Create a read-only signed URL for the object. The URL carries its own
      authorization, so the recipient needs no APS token, and it stops working when
      the expiry passes.
    operationId: createSignedUrl
    parameters:
    - name: bucketKey
      in: path
      value: $steps.confirmBucket.outputs.bucketKey
    - name: objectKey
      in: path
      value: $steps.locateObject.outputs.objectKey
    - name: access
      in: query
      value: read
    requestBody:
      contentType: application/json
      payload:
        minutesExpiration: $inputs.minutesExpiration
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      signedUrl: $response.body#/signedUrl
      expiration: $response.body#/expiration
  outputs:
    signedUrl: $steps.signDownloadUrl.outputs.signedUrl
    expiration: $steps.signDownloadUrl.outputs.expiration
    objectId: $steps.readObjectDetails.outputs.objectId
    sha1: $steps.readObjectDetails.outputs.sha1