diff --git a/docs/docs/spec/data-types.yaml b/docs/docs/spec/data-types.yaml
index 8fd141d7..89b9d7ab 100644
--- a/docs/docs/spec/data-types.yaml
+++ b/docs/docs/spec/data-types.yaml
@@ -132,6 +132,9 @@ components:
         description:
           type: string
           nullable: true
+        download_url:
+          type: string
+          nullable: true
         duration:
           type: number
           nullable: true
@@ -172,6 +175,7 @@ components:
         - id
         - accession_number
         - description
+        - download_url
         - duration
         - height
         - label
@@ -489,6 +493,9 @@ components:
           description: An account of the resource.
           items:
             type: string
+        download_url:
+          type: string
+          nullable: true
         file_sets:
           type: array
           description: File sets associated with the resource.
@@ -749,6 +756,7 @@ components:
         - cultural_context
         - date_created
         - description
+        - download_url
         - file_sets
         - folder_name
         - folder_number
diff --git a/node/src/handlers/get-file-set-download.js b/node/src/handlers/get-file-set-download.js
index ad694e33..c11c0610 100644
--- a/node/src/handlers/get-file-set-download.js
+++ b/node/src/handlers/get-file-set-download.js
@@ -8,7 +8,7 @@ const { apiTokenName } = require("../environment");
 const ApiToken = require("../api/api-token");
 const axios = require("axios").default;
 const cookie = require("cookie");
-
+const mime = require("mime-types");
 const opensearchResponse = require("../api/response/opensearch");
 const path = require("path");
 
@@ -18,9 +18,6 @@ const path = require("path");
 exports.handler = wrap(async (event) => {
   const id = event.pathParameters.id;
   const email = event.queryStringParameters?.email;
-  if (!email) {
-    return invalidRequest(400, "Query string must include email address");
-  }
 
   const allowPrivate =
     event.userToken.isSuperUser() ||
@@ -36,6 +33,9 @@ exports.handler = wrap(async (event) => {
   if (esResponse.statusCode == "200") {
     const doc = JSON.parse(esResponse.body);
     if (isVideoDownload(doc)) {
+      if (!email) {
+        return invalidRequest(400, "Query string must include email address");
+      }
       if (!event.userToken.isSuperUser()) {
         return invalidRequest(401, "Unauthorized");
       }
@@ -104,14 +104,6 @@ function derivativeKey(doc) {
   return "derivatives/" + prefix + "/" + id;
 }
 
-function extensionFromMimeType(mimeType) {
-  const parts = mimeType.split("/");
-  if (parts.length > 1) {
-    return parts[1];
-  }
-  return "";
-}
-
 async function getDownloadLink(doc) {
   const clientParams = {};
   const bucket = process.env.PYRAMID_BUCKET;
@@ -122,7 +114,7 @@ async function getDownloadLink(doc) {
     Key: key,
     ResponseContentDisposition: `attachment; filename=${
       doc._source.label
-    }.${extensionFromMimeType(doc._source.mime_type)}`,
+    }.${mime.extension(doc._source.mime_type)}`,
   };
 
   const client = new S3Client(clientParams);