Updated Oct 23, 2026

Create Storage Signed URL

Use this action when a later step needs a short-lived download URL for a file that already exists in your company storage.

Best for

• Turning a stored file reference (for example contactMessage.body.file or an earlier step's workflow.step(N).file) into a downloadable URL
• Feeding a stored image to an LLM vision input, guarded by the image media kind
• Re-sharing an already uploaded file in a later step without uploading it again

In agent runs, the incoming message is contactMessage. A document hook uses its own doc scope (for example doc.body.file); a manual/workflow run must declare the file as an explicit input.

Main fields

Field	What it does
File	CEL expression resolving to a storage file reference with bucket and fullPath, such as contactMessage.body.file or workflow.step(0).file. When set, the two fields below are ignored
bucket	CEL expression resolving to the storage bucket. Use only when File is not provided
full_path	CEL expression resolving to the storage object path. Use only when File is not provided
media_kind	Optional content-type guard: any (default), image, audio, video, pdf, text, or document. When the stored file's type does not match, the step fails instead of returning a URL. Choose image when the URL will be sent to an LLM image input
expires_in_seconds	Signed URL lifetime in seconds. Defaults to 900 (15 minutes) and is capped at 3600 (1 hour)
Purpose	Optional label for what the URL is for, shown in logs

What later steps can use

• workflow.step(N).signedUrl
• workflow.step(N).contentType
• workflow.step(N).size
• workflow.step(N).mediaKind
• workflow.step(N).bucket
• workflow.step(N).fullPath
• workflow.step(N).name
• workflow.step(N).expiresAt
• workflow.step(N).file — a ready-to-reuse file object (bucket, fullPath, name, metadata) for later media steps

Tips

• The file must already exist and belong to your company: objects in another tenant's storage area are always denied (storage_media_acl_denied), and missing objects fail with storage_media_not_found.
• Keep the lifetime as short as the consuming system allows — the URL stops working at expiresAt.
• Use the media-kind guard when the next step assumes a specific file type; a mismatch fails with storage_media_unsupported_type instead of passing the wrong file forward.
• Pair with Upload to Storage or Download to Storage (actions/network/http/download-to-storage) when the file is not in storage yet.