> ## Documentation Index
> Fetch the complete documentation index at: https://docs.haau3.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Direct file request (GET)

> Retrieve the encrypted SHLink payload directly with an HTTP GET when the U flag is present.

Use this retrieval method when the decoded SMART Health Link (SHLink) payload contains the `U`
flag. In this mode, the receiving system retrieves the encrypted payload directly using an HTTP
GET request.

The retrieval URL is provided inside the decoded SHLink payload. The receiving system performs
a GET request to that URL and must include the `recipient` query parameter identifying the
requesting organization. This follows the
[SMART Health Link direct file retrieval protocol (U flag)](https://build.fhir.org/ig/HL7/smart-health-cards-and-links/links-specification.html#smart-health-link-direct-file-request-with-u-flag).

## Endpoint

```http theme={null}
GET {SHLink URL}?recipient={organization-name}
```

The SHLink URL comes from the decoded SHLink payload's `url` field. The receiving system
appends the required `recipient` query parameter when making the request.

## Example SHLink payload

After decoding the SHLink, the EHR receives a JSON payload containing the retrieval URL and
encryption metadata.

```json theme={null}
{
  "url": "https://haau3.com/api/shl/d/NkXSIk-jfAINlAP41k8LShDGcHd6dfLgXYZUj53Gkps",
  "flag": "U",
  "key": "rxTgYlOaKJPFtcEd0qcceN8wEU4p94SqAwIWQe6uX7Q",
  "label": "Health summary"
}
```

The EHR extracts the `url` value and performs a GET request to retrieve the encrypted payload.

## Query parameters

<ParamField query="recipient" type="string" required>
  Name of the healthcare organization requesting the payload. This value is recorded in the
  patient application's audit log.
</ParamField>

## cURL example

```bash theme={null}
curl \
  --request GET \
  --url "https://haau3.com/api/shl/d/NkXSIk-jfAINlAP41k8LShDGcHd6dfLgXYZUj53Gkps?recipient=Verona+Health+System" \
  --header "Accept: application/jose"
```

## Responses

<Tabs>
  <Tab title="200">
    ```http theme={null}
    HTTP/1.1 200 OK
    Content-Type: application/jose
    Cache-Control: no-store

    <encrypted JWE compact serialization>
    ```
  </Tab>

  <Tab title="400">
    ```http theme={null}
    HTTP/1.1 400 Bad Request
    Missing required query parameter: recipient
    ```
  </Tab>

  <Tab title="404">
    ```http theme={null}
    HTTP/1.1 404 Not Found
    Not found
    ```
  </Tab>

  <Tab title="410">
    ```http theme={null}
    HTTP/1.1 410 Gone
    Gone or Expired
    ```
  </Tab>
</Tabs>

The `200` response body is an encrypted JWE. Decrypt it with the `key` from the SHLink payload
to obtain the FHIR bundle. See
[Bundle & artifact reference](/app/provider-integration/bundle-and-artifacts).