File system Download
CertifiedDownload a file via SFTP
File system Download
Download a file via SFTP
Fetches a single remote file to internal storage. Defaults: port 22, user home as root, password auth unless a PEM key is provided, host key checking disabled by default.
type: io.kestra.plugin.fs.sftp.DownloadExamples
id: fs_sftp_download
namespace: company.team
tasks:
- id: download
type: io.kestra.plugin.fs.sftp.Download
host: localhost
port: "22"
username: foo
password: "{{ secret('SFTP_PASSWORD') }}"
from: "/in/file.txt"
Properties
from *string
Source URI to download
host *string
Remote host
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150checksumAlgorithm string
SHA_256MD5SHA_1SHA_256SHA_512Checksum algorithm to use
Defaults to SHA_256. The computed checksum is always exposed on the output as checksum. MD5 and SHA_1 are deprecated and considered weak; prefer SHA_256 or SHA_512.
checksumExpected string
Expected checksum value to compare against the downloaded file
Required when validateChecksum is true. Comparison is case-insensitive.
enableSshRsa1 booleanstring
falseEnable the RSA/SHA1 algorithm (disabled by default)
keyExchangeAlgorithm string
Key exchange algorithm
Override the KEX algorithm (e.g. diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha256).
keyfile string
SSH private key (PEM)
PEM-formatted private key for public key auth. Convert OpenSSH keys with ssh-keygen -m PEM.
passphrase string
Passphrase for the SSH key
password string
Password
port string
22Remote port
proxyAddress string
SFTP proxy address
proxyPassword string
SFTP proxy password
proxyPort string
SFTP proxy port
proxyType string
SFTP proxy type
One of SOCKS5, STREAM, or HTTP.
proxyUsername string
SFTP proxy username
rootDir booleanstring
trueTreat path as user home root
If true (default), remote paths are resolved relative to the authenticated user's home directory.
username string
Username
validateChecksum booleanstring
falseValidate the downloaded file against an expected checksum
When enabled, the task fails if the computed checksum does not match checksumExpected. The downloaded file is not stored in internal storage if validation fails.
Outputs
checksum string
Checksum of the downloaded file
Hex-encoded digest computed with checksumAlgorithm. Populated whenever the file is downloaded successfully.
from string
uriThe fully-qualified URIs that point to source data
to string
uriThe fully-qualified URIs that point to destination path
