File Transfer Authorization
Agent file data can travel through Files.com's standard connection or directly between a client and the Agent. The Agent needs a way to verify the authorized operation in either case. Files.com supplies that authorization in a signed, expiring transfer URL.
Checks Before File Access
Files.com checks the requesting user's identity and applicable permissions before issuing an upload or download URL. The URL contains a JSON Web Token (JWT) that carries the authorization to the Agent.
The Agent verifies the signature, expiration, permitted operation, and resource type, then uses the authorized path. A URL for one operation and path does not grant general access to the Files.com site or arbitrary Agent files.
The Agent's file-access configuration and host permissions remain applicable. A valid transfer authorization does not grant the service account operating-system access it lacks.
Who Can Present the URL
The complete URL is the credential for that transfer. Anyone who holds it can present it until it expires, subject to the connection's network restrictions. The Agent does not require the presenter to sign in as the user who originally requested it.
Treat complete transfer URLs as confidential. Avoid placing them in shared tickets, analytics, or logs available to people who should not receive the file access they authorize.
The authorization identifies the transfer's site and Remote Server. Upload authorizations also record the requesting client's address. Those contextual values do not bind use of the URL to that user or address; download authorizations do not include a client address.
Connection Restrictions
When Direct Transfers are enabled, the Agent's client-address allow and block lists provide a separate check on who may connect. A valid URL does not override those restrictions.
Conversely, an allowed address does not authorize file access by itself. The client still needs a valid transfer URL for the operation and path.
Expiration and Access Removal
The lifetimes in Transfer URL Expiration apply to Agent URLs. Expiration determines when a request may start. A transfer accepted before expiration can continue afterward.
Removing a user's access prevents new authorizations but leaves already issued URLs usable until they expire. Do not treat a user permission change as immediate cancellation of all pending or active transfers.
If access to the host must stop immediately, coordinate withdrawal of the Agent service and its network access across every active host. Access Removal & Recovery explains how that differs from revoking one Files.com user's access.