> ## Documentation Index > Fetch the complete documentation index at: https://www.sapientpriors.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Download an agent source ## OpenAPI ````yaml /openapi.yaml get /v1/agents/{agent_id}/sources/{source_id} openapi: 3.0.3 info: title: Priors API description: > Priors gives you memory agents. An agent learns from the observations you send it and answers from what it learned. You call this API from your own backend with a partner API key. The key identifies your organization, which owns every agent, thread, observation, source, and memory it creates. Another organization receives 404 for those identifiers. Send `X-SP-End-User` alongside the key to act for one named person on your side. version: 0.1.0 servers: - url: https://app.sapientpriors.com/api description: Production security: - partnerKey: [] tags: - name: Agents description: Create, read, update, and delete memory agents. - name: Threads description: 'Conversations under an agent: create them, teach them, and ask them.' - name: Sources description: Files an agent learned from, and the citations that point back to them. - name: Authentication description: What your key resolves to, and the limits that apply to it. - name: Billing description: Your organization's credits and charges. paths: /v1/agents/{agent_id}/sources/{source_id}: get: tags: - Sources summary: Download an agent source operationId: download_agent_source parameters: - $ref: '#/components/parameters/AgentId' - $ref: '#/components/parameters/SourceId' responses: '200': description: Original source bytes headers: Cache-Control: schema: type: string content: application/octet-stream: schema: type: string format: binary '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' '503': $ref: '#/components/responses/ServiceUnavailable' components: parameters: AgentId: name: agent_id in: path required: true description: Unique managed memory-agent identifier. schema: type: string maxLength: 32 pattern: ^agent_[0-9A-HJKMNP-TV-Z]{26}$ SourceId: name: source_id in: path required: true description: Identifier of an uploaded source owned by the agent. schema: $ref: '#/components/schemas/SourceId' responses: BadRequest: description: > The request is not one this route can act on, and sending it again unchanged does not help. Usually the payload: a field missing, or a value out of range. It is also the credential and the headers around it, and each of these is refused rather than ignored: `X-SP-End-User` sent empty, or longer than 255 characters; and a key on a request that carries `Sec-Fetch-Site`, which only a browser sets. `code` is `invalid_request` throughout. `error` says which of these it was. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid credentials content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: > No such id, or it is not one this key reaches. It is never a 403, so a key cannot be used to learn which ids exist. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServiceUnavailable: description: > A required dependency could not complete the request. Distinct from a 500 by design: the body's `code` is `service_unavailable`, which says the request may succeed on a later attempt, where `internal_error` says it will not. Check the code before retrying. The same 503 carries `service_not_configured` when a feature this route needs is not switched on for your organization. The transport failure is identical and the wait is not: that one answers the same on every attempt until we change the configuration. Contact us. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' schemas: SourceId: type: string pattern: ^(?:img|src)_[0-9a-f]{32}$ description: Server-generated uploaded-source identifier. ErrorResponse: type: object required: - error - code - request_id properties: error: type: string code: type: string description: > Machine-readable condition. Branch on this rather than on the status where the two differ. All three of these can arrive as a 5xx and they want different handling: `service_unavailable` (503) is a dependency outage worth retrying, `service_not_configured` (503) is the same transport failure that retrying will NEVER clear because a feature is not switched on for your organization, and `internal_error` (500) is a defect that will fail the same way again. Known values: invalid_request, unauthorized, forbidden, payment_required, not_found, agent_not_found, thread_not_found, conflict, agent_quota_exceeded, duplicate_upload_in_progress, document_already_ingested, document_uploaded_elsewhere, agent_not_ready, payload_too_large, rate_limit_exceeded, service_unavailable, service_not_configured, answer_model_unavailable, internal_error, and the document codes an upload can return (unsupported_document, document_needs_ocr, encrypted_document, malformed_document, empty_document, document_too_large, document_too_complex, document_too_many_turns, document_too_many_pages, document_too_large_for_ocr, document_pages_unexpected, document_service_unavailable, ocr_busy, ocr_failed, ingestion_failed). answer_model_unavailable is a narrower `service_unavailable` (503): the model that writes the visible reply could not be reached after retries. It is worth its own code because it is the one dependency whose outage a caller may want to word differently -- the turn produced no answer at all, and retrying shortly is the right advice. agent_not_found and thread_not_found are narrower `not_found`s, sent so a client can tell WHICH resource vanished and recover accordingly without matching on the English message. Treat any unrecognised value as the status code's default meaning rather than rejecting the response. request_id: type: string description: > Server-issued identifier for this request. Include it when reporting a problem so the call can be correlated with server logs. details: type: string description: | Present on a 429. Names which control refused the request: `user` Your per-subject window, counted against `X-SP-End-User`. `organization` Your organization's ceiling, across every key you hold. `capacity` The service is at capacity. Retry. `ingestion-organization` Too much of your own document work is already running. `ingestion-capacity` As above, service-wide. additionalProperties: false securitySchemes: partnerKey: type: http scheme: bearer description: > Your API key, shaped `sp__`, sent as `Authorization: Bearer sp_...`. It identifies your organization, not a person. Your organization owns the agents, holds the credit, and is billed. Every key your organization holds reaches the same things, so you rotate a key by minting the new one, deploying it, and revoking the old one. Keep the key on your server. A request that carries a `Sec-Fetch-Site` header is refused with 400, because only a browser sets that header. Priors sends no CORS headers, so a browser blocks the call before it leaves the page. The secret is shown once when the key is minted and is stored only as a hash. A lost secret is replaced, never recovered. An administrator of your organization mints and revokes keys in the Priors application, under Settings. There is no endpoint for it: a key reaches your whole organization, so issuing one is an act of administration. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.