# GET /api/payment-tokenization/apple-pay/domain-association-file/download

Download the domain association file (admin).

Streams the stored file as an attachment named exactly
`apple-developer-merchantid-domain-association` (no extension), matching the file
Apple issues. Served as `application/octet-stream` with an explicit attachment
filename so the browser does not append a `.txt` suffix; the public
`text/plain` well-known route is for Apple's crawler, not the operator's download.
Returns 404 when no file is configured.
            


Gated on `PaymentTokenizations` to match the admin-download intent. The same
bytes are already served publicly at the well-known route, so this gate is about
matching operator-surface expectations, not protecting secret content.

**Operation ID:** `GET_api_payment-tokenization_apple-pay_domain-association-file_download`

## Authorization

Requires: PaymentTokenization.PaymentTokenizations, merchant scope.

Required permissions:
- `PaymentTokenization.PaymentTokenizations`

## Parameters

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| suppressNulls | query | no | boolean | If true, omit properties with null values. |

## Responses

### 200

OK

### default

The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. See the error-code reference in this document's description for the values `error.code` can take.

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

## See also

- [All documentation](https://docs.winkpg.io/llms.txt): the machine-readable index of every public page on this site.