Concepts
Files
Files in responses
A file_upload answer lists its files. Each carries fileId and apiUrl, the API address of that file.
In exports, a file is a permanent link into the app, <app>/files/<fileId>, that asks for sign-in. That way a forwarded export gives nobody the files. The fileId is the end of that link.
Downloading a file
Call GET /v1/files/{fileId}, which is the apiUrl, with your API key. It answers with the file's name, size and type, and a url that works for 5 minutes. The url needs no API key. Fetch it right away, or call again for a fresh one.
GET /v1/submissions/{submissionId}/file-urls gives links for all of one response's files at once. Each works for 1 hour.
Webhook deliveries carry a url that works for 1 hour next to the apiUrl. That's long enough to fetch the file when the delivery arrives. After that, use the apiUrl.
Links stop working once the response is deleted.
curl "$AYEFORM_API/v1/files/$FILE_ID" \
-H "Authorization: Bearer $AYEFORM_KEY"