# Accessing files with "hidden\_sensitive" access via API

**URL:** <https://community.hubspot.com/t/accessing-files-with-hidden-sensitive-access-via-api/143291>\
**Category:** APIs & Integrations\
**Tags:** developer-tools\
**Created:** [November 24, 2025, 6:37pm UTC](https://community.hubspot.com/t/accessing-files-with-hidden-sensitive-access-via-api/143291 "2025-11-24T18:37:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RWatkins](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/rwatkins/32/35493_2.png) [@RWatkins](https://community.hubspot.com/u/RWatkins)\
**Post date:** [November 24, 2025, 6:37pm UTC](https://community.hubspot.com/t/accessing-files-with-hidden-sensitive-access-via-api/143291/1 "2025-11-24T18:37:11Z")

</div>

Hello!

We use the /files/v3/files/{fileId}/signed-url to allow users to view some of our files. I’ve discovered recently that some of our files have access set to “hidden\_private”, and others “hidden\_sensitive”. We’re able to get the signed URL just fine for the “hidden\_private” files, but “hidden\_sensitive” files return an error with the message, “Cannot access sensitive file”.  
Is there a way to get a publicly accessible URL via API for files with access set to “hidden\_sensitive”?

---

<div class="post-metadata">

**Author:** ![stassey](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/stassey/32/36_2.png) [@stassey](https://community.hubspot.com/u/stassey)\
**Post date:** [November 24, 2025, 9:43pm UTC](https://community.hubspot.com/t/accessing-files-with-hidden-sensitive-access-via-api/143291/2 "2025-11-24T21:43:23Z")

</div>

Hi @RWatkins!  
Thanks for posting this! This could definitely be useful for others in the future!

Sensitive files still cannot be exposed through a publicly accessible signed URL, but privately distributed apps can now download sensitive file attachments through the File Manager API. Use `GET /v3/files/{fileId}/download` with the `FILE_MANAGER_SENSITIVE_ACCESS` scope.

_Moderator Note: this post was reviewed for relevancy and optimized for clarity on September 29, 2026. Thank you for your contributions to the HubSpot Community!_

###

---

<div class="post-metadata">

**Author:** ![GRajput](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/grajput/32/102020_2.png) [@GRajput](https://community.hubspot.com/u/GRajput)\
**Post date:** [December 3, 2025, 12:18pm UTC](https://community.hubspot.com/t/accessing-files-with-hidden-sensitive-access-via-api/143291/3 "2025-12-03T12:18:37Z")

</div>

Hi @RWatkins

There still isn’t a supported way to turn a sensitive HubSpot file into a publicly accessible URL. However, as of now, privately distributed apps can download sensitive file attachments directly using `GET /v3/files/{fileId}/download` with the `FILE_MANAGER_SENSITIVE_ACCESS` scope.

> **[Files API - HubSpot docs](https://developers.hubspot.com/docs/api-reference/latest/files/guide)**
>
> Learn how to upload and manage files in your HubSpot account using the files API.

HubSpot now provides a direct download endpoint for sensitive file attachments when using an authorized privately distributed app with the required sensitive-file scope.

You generally shouldn’t need to change the file’s access level just to retrieve it. If your integration meets the requirements, use the sensitive-file download endpoint instead so the file can remain protected

I hope this will help you out. Please mark it as **Solution Accepted and upvote** to help another Community member.

Thanks!

_Moderator Note: this post was reviewed for relevancy and optimized for clarity on September 29, 2026. Thank you for your contributions to the HubSpot Community!_