diff --git a/ruby/lib/jam_ruby/models/artifact_update.rb b/ruby/lib/jam_ruby/models/artifact_update.rb
index 9b671df91..5956bbcfd 100644
--- a/ruby/lib/jam_ruby/models/artifact_update.rb
+++ b/ruby/lib/jam_ruby/models/artifact_update.rb
@@ -1,5 +1,6 @@
 module JamRuby
   class ArtifactUpdate < ActiveRecord::Base
+    include JamRuby::S3ManagerMixin
 
     DEFAULT_ENVIRONMENT = 'public'
     CLIENT_PREFIX = 'JamClient'
@@ -50,5 +51,15 @@ module JamRuby
 
       url
     end
+
+    # generate a secure URL for a hidden/private S3 artifact
+    def secure_url
+
+      self.version
+      self.product
+      #self[:uri]
+
+      s3_manager.sign_url(self[:uri], {:expires => 60 * 5 , :secure => true})
+    end
   end
 end
diff --git a/web/app/controllers/api_jam_blaster_controller.rb b/web/app/controllers/api_jam_blaster_controller.rb
new file mode 100644
index 000000000..ca7fcb1d3
--- /dev/null
+++ b/web/app/controllers/api_jam_blaster_controller.rb
@@ -0,0 +1,33 @@
+class ApiJamBlasterController < ApiController
+
+  def artifact
+
+    # JamBlasterArtifact  -> table calleds jam_blaster_artifacts
+
+    # /api/jamblaster?product=jb&version=1.0.3
+
+    product = params[:product]
+    version = params[:version]
+
+
+    # example of signing a bucket 'object' in S3
+
+    # example of sticking in a row in database
+    # insert into artifact_updates (product, version, uri, sha1, environment, size) values ('blah', '1.1.1', 'nowhere/valid', 'abc', 'public', 1);
+
+
+    artifact = ArtifactUpdate.where(product: product).where(version: version).first
+
+    if artifact.nil?
+      logger.debug("oo! no artifact for #{product}")
+      render json: {reason: 'not found'}, status: 404
+    else
+
+      url = artifact.secure_url
+      render json: {url: url}
+
+    end
+
+
+  end
+end
diff --git a/web/config/routes.rb b/web/config/routes.rb
index 658db1c33..dafbbf8a1 100644
--- a/web/config/routes.rb
+++ b/web/config/routes.rb
@@ -194,6 +194,8 @@ SampleApp::Application.routes.draw do
 
   scope '/api' do
 
+    match '/jamblaster' => 'api_jam_blaster#artifact', :via => :get
+
     match '/auths/login' => 'api_auths#login', :via => :post
 
     # music sessions
diff --git a/web/spec/controllers/api_jam_blaster_controller_spec.rb b/web/spec/controllers/api_jam_blaster_controller_spec.rb
new file mode 100644
index 000000000..51dc8ec8d
--- /dev/null
+++ b/web/spec/controllers/api_jam_blaster_controller_spec.rb
@@ -0,0 +1,13 @@
+require 'spec_helper'
+
+describe ApiJamBlasterController do
+  render_views
+
+
+  # probably better to put as much logic (and meaningful tests) in artifact_update_spec
+  it "works" do
+
+  end
+
+
+end