Download a backup file

GET 
/api/admin/settings/backups/download

Streams a single backup file to the caller as an attachment. System administrators only. A database dump contains the entire database (password hashes and all PII), so the download is always recorded as a SECURITY audit event. The filename is checked against a strict allow-list and the resolved path must stay inside the backup directory: two independent guards against path traversal.

View source

Request

Responses

200

The backup file as an octet-stream attachment.

400

Filename failed the allow-list or path check.

403

Caller is not a system administrator.

404

The backup file does not exist.