Exchanges the export-ready token for a fresh short-lived presigned download URL.
POST/gdpr/data/export/download
Validates the caller owns the token, the build hasn't expired, and the user isn't already deleted (which also nukes the ZIP). Returns the URL in JSON so the FE can trigger a download.
Request
Responses
- 200
- 401
- 403
OK
Unauthorized - missing or invalid credentials.
Forbidden - authenticated but missing required role or policy.