Theme

Downloading a shared WebClient! file from a script ​

Syncplify Server! is, at its core, security software. So even when you use its WebClient! to create a public shared object (one that is not password protected), downloading it is not as simple as pasting its URL into Invoke-WebRequest or curl. The security measures of the server make the operation indirect, in three steps:

  1. Call the URL of the shared object and read the token from the JSON it returns.
  2. With that token as a bearer, POST a download request for the file. The server answers with a one time, short lived download grant, bound to your session, to that file and to your IP address, and with the path to fetch it from.
  3. GET that path. No token travels with the bytes; the grant itself is the credential, and it is consumed on first use.

The endpoints are documented in the WebClient! API definition at openapi.syncplify.com/v8/webclient: GET /share/{share_id}, POST /shr/down/{path} and GET /fetch/{grant}, all under /api/v1.

PowerShell ​

A ready made script to customize with your own URLs. It downloads the shared file test.txt from the shared object with ID 2retezypuhQdpEXRD5fNguyMbgI, which must not be password protected, to a local file of the same name:

powershell
$base = "https://webclient.example.com:6444"
$share = "2retezypuhQdpEXRD5fNguyMbgI"

# 1. read the share token
$token = (Invoke-RestMethod -Uri "$base/api/v1/share/$share").token
$headers = @{ "Authorization" = "Bearer $token" }

# 2. ask for a one time download grant for the file
$grant = Invoke-RestMethod -Uri "$base/api/v1/shr/down/test.txt" -Method Post -Headers $headers

# 3. fetch the bytes from the path the grant names
Invoke-WebRequest -Uri "$base$($grant.fetchPath)" -OutFile ./test.txt

If the server uses a self signed certificate, add -SkipCertificateCheck to every call (PowerShell 7 and later), after verifying the certificate's fingerprint once.

bash ​

The same flow in bash (it also works in zsh and any other POSIX shell) with curl and jq:

bash
#!/bin/bash
base="https://webclient.example.com:6444"
share="2retezypuhQdpEXRD5fNguyMbgI"

# 1. read the share token
token=$(curl -s "$base/api/v1/share/$share" | jq -r '.token')

# 2. ask for a one time download grant for the file
fetch=$(curl -s -X POST -H "Authorization: Bearer $token" "$base/api/v1/shr/down/test.txt" | jq -r '.fetchPath')

# 3. fetch the bytes from the path the grant names
curl -s -o ./test.txt "$base$fetch"

INFO

In versions before the download grant was introduced, the POST to /shr/down/{path} returned the file itself. If your server still answers the second step with the file's bytes instead of a JSON document, save that response and skip the third step.