Bundles

GET /skills/bundle/{skill_id}/{sha}

The whole skill directory as a zip: SKILL.md plus every bundle file, with assets fetched from storage. This is what pm-skills pull writes to disk. Available on SaaS and on-prem.

It is the one endpoint on this surface that returns application/zip rather than JSON, and the one that authorises differently from everything else.

Request

curl -s -o skill.zip \
  "$IM_URL/skills/bundle/a0132e30-e7c4-4b78-8719-d8e20cbe44bb/a28b804cda57" \
  -H "X-API-Key: $IM_KEY"

Parameter	Required	Notes
skill_id	yes	path segment — the id, not the name
sha	yes	path segment; must belong to that skill

Both forms of the key work here, as on the read endpoints.

Addressed by id, not by name

Every other read endpoint takes a project_id and a name, and resolves within that project. This one takes the skill's own id — so get the skill_id and sha from resolve or by-name first.

Response

HTTP/1.1 200 OK
content-type: application/zip
content-disposition: attachment; filename="test-a28b804cda57.zip"
x-content-type-options: nosniff

The filename is <skill-name>-<sha>.zip. Inside, everything sits under a single directory named after the skill:

test/
└── SKILL.md

SKILL.md is the frontmatter and body recombined into the on-disk format, with empty fields dropped:

---
name: test
description: aad
---

adfasdf

A skill carrying resources gets them alongside, at the paths recorded in its resources manifest — scripts/, references/, assets/ — with binary assets pulled from object storage as the archive is built.

Authorization

This endpoint does not check project membership. It authorises on read access to the skill itself, so it also serves organisation-tier and global-tier skills, which do not belong to any single project.

That is why it takes no project_id: there is no project context to resolve in.

	Authorises on
resolve, by-name, diff, GET /skills	membership of the project
bundle	read access to the skill

Practically: a skill_id you obtained from a project you can reach will download. One you guessed will not.

Errors

Status	When
401	key missing, invalid or revoked
403	the owner may not read that skill
404	no such skill_id, or the sha belongs to a different skill

The last case matters when you are iterating over several skills: pairing skill A's id with skill B's sha is a 404 rather than a wrong download.

Next

Reading skills

Where the skill_id and sha come from.

→

Pull via the CLI

The supported path — this endpoint, wrapped.

→