## Public access to an object

`GET /v1/public-storage/:portalId/:objectId`

Returns the content of a publicly accessible object as a redirect (302) to a temporary link. No API key is required — the endpoint is anonymous. Anonymous access is enabled separately at the Bitrix24 account level; off by default.

## Parameters

| Parameter | Type | Req. | Description |
|----------|-----|:-----:|---------|
| `portalId` (path) | string (UUID) | yes | The Bitrix24 portal identifier in Vibecode. Format: `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Obtain via `GET /v1/me` with a management key — the `data.portals[n].id` field |
| `objectId` (path) | string (CUID) | yes | Internal object identifier (the `id` field from write and list responses) |

## Examples

**No key required.** Both examples are sent without authorization headers — this is an anonymous endpoint.

### curl

```bash
curl -L "https://vibecode.bitrix24.com/v1/public-storage/YOUR_PORTAL_ID/YOUR_OBJECT_ID"
```

### JavaScript

```javascript
const res = await fetch(
  'https://vibecode.bitrix24.com/v1/public-storage/YOUR_PORTAL_ID/YOUR_OBJECT_ID',
  { redirect: 'follow' }
)
if (!res.ok) {
  const body = await res.json()
  console.error(body.error.code, body.error.message)
  return
}
// res.url — the final file URL
```

## Response

The behavior depends on the state of anonymous access in the Bitrix24 account:

**Anonymous access enabled in the Bitrix24 account.** The server returns `302 Found` with a `Location` header pointing to a temporary storage link. The link is valid for 10 minutes. Response header: `Cache-Control: private, no-store`.

**Anonymous access disabled in the Bitrix24 account** (the default value for a new Bitrix24 account): `503 STORAGE_PUBLIC_GET_DISABLED_FOR_PORTAL`. Enabled by the Bitrix24 account administrator.

## Error response example

503 — anonymous access disabled in the Bitrix24 account:

```json
{
  "success": false,
  "error": {
    "code": "STORAGE_PUBLIC_GET_DISABLED_FOR_PORTAL",
    "message": "Public storage GET is disabled for this portal"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|---------|
| 404 | `STORAGE_OBJECT_NOT_FOUND` | Object not found, has `PRIVATE` visibility, belongs to another portal, or `objectId` does not match any object |
| 410 | `STORAGE_OBJECT_DELETED` | The object was deleted |
| 429 | `STORAGE_RATE_LIMIT_EXCEEDED` | Exceeded the limit of 60 requests per minute from a single IP address |
| 503 | `STORAGE_PUBLIC_GET_DISABLED_FOR_PORTAL` | Anonymous access is disabled for this portal |
| 503 | `STORAGE_FEATURE_DISABLED` | Storage is temporarily unavailable on the platform |

The full list of general API errors — [Errors](/docs/errors).

## Known specifics

- **Anonymous access is enabled separately.** An object with `PUBLIC` visibility does not automatically become available through this endpoint — the Bitrix24 account administrator must enable anonymous access in the storage settings.
- **`objectId` is the internal identifier, not the logical key.** Use the `id` field from the upload response ([`POST /v1/storage/objects/upload`](/docs/storage/upload)) or from the [object list](/docs/storage/objects/list).
- **Do not cache the redirect address** — a new temporary link is generated on each request.

## See also

- [Public access HEAD](/docs/storage/objects/public-head) — `HEAD /v1/public-storage/:portalId/:objectId`
- [Download object (authorized)](/docs/storage/objects/get) — `GET /v1/storage/objects/:key`
- [List objects](/docs/storage/objects/list) — `GET /v1/storage/objects`
- [Delete object](/docs/storage/objects/delete) — `DELETE /v1/storage/objects/:key`