Read a signed immutable release manifest

Distribution and channel-scoped bearer key required. Verify Ed25519 signatures, monotonic catalog revision, immutable manifest digest and file hashes. No management dependencies. Files use private immutable caching; channel manifests require revalidation.

GET /delivery/v1/distributions/{id}/channels/{channel}/releases/{releaseId}/manifest

Operation: getDeliveryRelease · Download OpenAPI

Access

Requires a distribution and channel-scoped bearer read key. It does not use panel cookies or CSRF. See the delivery protocol.

readKey

{
  "type": "http",
  "scheme": "bearer",
  "description": "A distribution and channel-scoped read key. Never send it in a URL."
}

Parameters

Name	Location	Required	Description
id	path	Yes	See constraints below.
channel	path	Yes	See constraints below.
releaseId	path	Yes	See constraints below.

id

{
  "type": "string",
  "format": "uuid"
}

channel

{
  "type": "string",
  "enum": [
    "preview",
    "production"
  ]
}

releaseId

{
  "type": "string",
  "format": "uuid"
}

Request body

No request body.

Responses

200

Verified content.

Response headers:

{
  "ETag": {
    "schema": {
      "type": "string"
    }
  }
}

Content type: application/jose Schema reference: SignedDocument.

{
  "$ref": "#/components/schemas/SignedDocument"
}

400

Invalid path or request.

401

Invalid key, channel scope or web origin.

404

Not published or no accessible immutable release.

429

Request rate limit exceeded.

500

Unexpected delivery failure; X-Request-ID identifies the safe event.

503

Local storage or dependency unavailable; X-Request-ID identifies the safe event.

Related guidance

Request errors and safe retries · Troubleshooting