beta.skills.versions.download() returns 404 "Skill not found" for an existing skill (server-side /content endpoint bug)

[Anton-Honda]

Summary

client.beta.skills.versions.download(version, { skill_id }) consistently returns 404 not_found_error: "Skill not found" for a skill that demonstrably exists. retrieve(), list(), and delete() on the same skill + version all succeed. The failing route is GET /v1/skills/{skill_id}/versions/{version}/content. It reproduces with a raw fetch(), so this appears to be a server-side bug on the /content endpoint, not an SDK issue — filing here since this is where the Skills SDK surface is tracked (cf. #1000, which added this capability).

Environment

• @anthropic-ai/sdk@0.99.0
• Node v26.2.0
• Beta: skills-2025-10-02

Repro

import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const BETA = "skills-2025-10-02";

// create a skill (zip with <dir>/SKILL.md containing name + description frontmatter)
const skill = await client.beta.skills.create({ display_title: "repro", files: [zip], betas: [BETA] });
const version = skill.latest_version;          // e.g. "1780037113576845"

await client.beta.skills.versions.retrieve(version, { skill_id: skill.id, betas: [BETA] }); // ✅ 200
await client.beta.skills.versions.download(version, { skill_id: skill.id, betas: [BETA] }); // ❌ 404 "Skill not found"

Observed

On one and the same freshly-created skill (skill_id + version timestamp), polled over 35s:

Request	Result
GET /v1/skills/{id}/versions/{ts} (retrieve)	200 OK
GET /v1/skills/{id}/versions/{ts}/content (download)	404 not_found_error: "Skill not found: skill_…"
download with the version id (skill_version_…) instead of the timestamp	400 "Version must be a numeric timestamp"
raw fetch of the /content URL (no SDK)	404 (identical)
/content with ?beta=true removed / Accept: */* / Accept: application/zip	404 (identical)

The 400 on the non-timestamp form confirms the timestamp is the identifier the endpoint expects — yet the timestamp form 404s. retrieve proves the skill + version exist. So /content is the only route in the family that can't find a skill its sibling routes resolve fine.

Expected

download() returns the version's zip archive (200) for a skill that retrieve()/list() resolve.

Example failing request IDs: req_011CbWQcBACDzpS5i8k4uzSG, req_011CbWQgBNCryS2mGHNu25Dx.

[dtmeadows-ant]

Hi @Anton-Honda — sorry for the delay, and thanks for the thorough matrix. You were right that this was server-side rather than the SDK: GET /v1/skills/{id}/versions/{version}/content is currently only served to the credentials a self-hosted environment worker runs with (it's the route workers use to pull a session's skills — see self-hosted sandboxes), not to a regular API key, and at the time that denial came back as the same masked 404 as a genuinely missing skill. The API has since been changed to say so explicitly — the same call with an API key now returns 403 permission_error: "Downloading skill content is not supported with this credential type." — while create/retrieve/list/delete continue to work with API keys as you observed.