Download an Origin Repo Tarball via the API

Download a gzip-compressed tar of the repository tree at a ref with GET https://api.cursor.com/v1/origin/repos/{ownerSlug}/{repoName}/tarball/{ref}. Official reference: Origin API → Get Repo Tarball.

Origin is in Early Beta and subject to change. Authenticate with an installation access token or a Cursor user access token. Required scope: repository:contents:read. Availability: Early Beta per the API overview.

Origin keys the archive on the repository and the commit ref resolves to. The first request for a given commit responds 200 with Content-Type: application/gzip and streams the archive as the response body. Later requests for the same commit respond 302 with an empty body and a signed download URL in Location, valid for 15 minutes; follow the redirect to fetch the bytes.

The archive contains a single top-level directory named {ownerSlug}-{repoName}-{shortSha}/, where shortSha is the first 7 hex characters of the resolved commit.

For refs that contain /, send the ref as a query parameter instead of a path segment: GET /v1/origin/repos/{ownerSlug}/{repoName}/tarball?ref=refs/heads/main. Omit ref to archive the repository's default branch.

You can also address by stable repository ID: send _ as the owner slug and the repository ID as the name.

Cost: 5 points against the principal budget (heavier read: Get Repo Tarball).

Path parameters

Param	Required	Meaning
ownerSlug	yes	Owning entity slug, or _ when using the repository ID form
repoName	yes	Repo name unique to the owner, or the repository ID when ownerSlug is _
ref	yes (path form)	Commit SHA (full or abbreviated hex), bare branch or tag name, fully qualified refs/heads/... or refs/tags/..., or symbolic HEAD. Globs and revspecs (for example main~3) are rejected. Empty uses the repository default branch.

Query form

Param	Required	Meaning
ref	no	Same ref values as the path form. Prefer this when the ref contains /. Omit to archive the default branch.

curl --request GET --location --output repo.tar.gz \
  --url 'https://api.cursor.com/v1/origin/repos/OWNER_SLUG/REPO_NAME/tarball/HEAD' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

Query-form example for a ref with slashes:

curl --request GET --location --output repo.tar.gz \
  --url 'https://api.cursor.com/v1/origin/repos/OWNER_SLUG/REPO_NAME/tarball?ref=refs/heads/main' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

Errors and Connect/JSON fields

Condition	Result
Empty repository	ABORTED (HTTP 409 Conflict)
Ref does not resolve	404

Connect and JSON callers may also see sha (resolved commit OID) and downloadUrl (short-lived signed URL, empty when the response streams the archive inline). Over REST, read the SHA from the archive filename or the signed URL, and follow Location on a 302.

Use --location so curl follows the signed URL when Origin returns 302.

For interactive or scripted user calls, prefer origin api after origin auth login (or CURSOR_API_KEY) so the CLI exchanges a personal user API key for a short-lived user access token. App integrations should mint installation tokens just in time. Do not put a Cursor API key directly in the Origin Authorization header.

Base URL: https://api.cursor.com/v1/origin.