diff --git a/api-server/src/main/java/vermillion/database/Queries.java b/api-server/src/main/java/vermillion/database/Queries.java
index 8ea3b8b..f50534a 100644
--- a/api-server/src/main/java/vermillion/database/Queries.java
+++ b/api-server/src/main/java/vermillion/database/Queries.java
@@ -17,9 +17,11 @@ public class Queries {
   public Queries() {
 
     downloadByQuery = new JsonObject()
-            .put("query", new JsonObject().put("bool",
-                    new JsonObject().put("should",
-                            new JsonArray())));
+            .put("query",
+                    new JsonObject().put("bool",
+                            new JsonObject().put("must",
+                                    new JsonObject().put("bool",
+                                            new JsonObject().put("should", new JsonArray())))));
     baseQuery =
         new JsonObject()
             .put("query", new JsonObject().put("bool", new JsonObject().put("filter", "")));
diff --git a/api-server/src/main/java/vermillion/http/HttpServerVerticle.java b/api-server/src/main/java/vermillion/http/HttpServerVerticle.java
index 7c5fd63..92a8f33 100644
--- a/api-server/src/main/java/vermillion/http/HttpServerVerticle.java
+++ b/api-server/src/main/java/vermillion/http/HttpServerVerticle.java
@@ -1333,10 +1333,18 @@ public void downloadByQuery(RoutingContext context)  {
         }
         logger.debug("final params :" + finalEntries.toString());
 
+        int size = 10000; //max set of results per search request
         JsonObject downloadByQuery = query.getDownloadByQuery();
-        JsonArray jsonArray = downloadByQuery.getJsonObject("query").getJsonObject("bool")
-                .getJsonArray("should");
-        logger.debug("download by query: " + downloadByQuery);
+        JsonArray jsonArray = downloadByQuery.put("size", size).getJsonObject("query").getJsonObject("bool")
+                .getJsonObject("must").getJsonObject("bool").getJsonArray("should");
+
+        JsonObject filterByAuthorisedIds = downloadByQuery.getJsonObject("query").getJsonObject("bool");
+        if (resourceId != null) {
+            filterByAuthorisedIds.put("filter",
+                    new JsonObject().put("terms",
+                            new JsonObject().put("id.keyword",
+                                    new JsonArray().add(resourceId))));
+        }
 
         for (int i=0; i<finalEntries.size(); i++) {
             String key = finalEntries.get(i).getKey();
@@ -1345,8 +1353,6 @@ public void downloadByQuery(RoutingContext context)  {
             logger.debug("value: " + value);
 
             jsonArray.add(new JsonObject().put("match", new JsonObject().put("data.metadata."+key, value)));
-            logger.debug("constructed query for download by query API for category/subCategory is: "
-                    + jsonArray.toString());
         }
 
         if(jsonArray.size() == 0) {
@@ -1356,52 +1362,41 @@ public void downloadByQuery(RoutingContext context)  {
 
         UUID uuid = UUID.randomUUID();
         logger.debug("uuid: " + uuid);
-        List<String> authorisedIds = new ArrayList<>();
-        JsonArray finalHits = new JsonArray();
         Map<String, String> emailDetails = new HashMap<>();
 //        final String finalDownloadLink = "https://" +System.getenv("SERVER_NAME") +CONSUMER_PATH + uuid;  //Could be used in future if needed
 
         checkAuthorisation(token, READ_SCOPE).flatMap(id -> {
-            logger.debug("id=" + id);
+            logger.debug("authorised ids of consumer=" + id);
             if (id.size() == 0) {
                return Single.error(new UnauthorisedThrowable("Unauthorized"));
             }
+            JsonArray authorisedResourceIds = new JsonArray();
             Iterator<Object> iterator = id.stream().iterator();
-            while (iterator.hasNext()) {
+            while (iterator.hasNext() && resourceId == null) {
                 String next = (String) iterator.next();
-                authorisedIds.add(next);
+                filterByAuthorisedIds.put("filter",
+                        new JsonObject().put("terms",
+                                new JsonObject().put("id.keyword",
+                                        authorisedResourceIds.add(next))));
             }
             setConsumerEmailDetails(token, emailDetails).subscribe();
+
+            logger.debug("constructed query for download by query API for category/subCategory is: "
+                    + downloadByQuery.toString());
             return dbService.rxSecureSearch(downloadByQuery, token, false, "");
+
         }).flatMapCompletable(result-> {
             logger.debug("Response from search endpoint:" + result.toString());
-            logger.debug("authorised ids of consumer: " + authorisedIds.toString());
             JsonArray hits = result.getJsonArray("hits");
             if (hits.size() == 0) {
                 return Completable.error(new FileNotFoundThrowable("The requested files are not found"));
             }
-            IntStream.range(0, hits.size())
-                    .mapToObj(pos -> {
-                        JsonObject value = (JsonObject) hits.getValue(pos);
-                        String id = value.getString("id");
-
-                        if (authorisedIds.contains(id)) {
-                            finalHits.add(value);
-                        }
-                        return finalHits;
-                    }).collect(Collectors.toList());
-            if (finalHits.size() == 0) {
-                return Completable.error(new UnauthorisedThrowable("The access to requested files are unauthorized"));
-            }
 
             String email = emailDetails.get("email");
             logger.debug("consumerEmail=" + email);
             if (email == null || "".equals(email)) {
                 return Completable.error(new UnauthorisedThrowable("Email is missing"));
             }
-            return Completable.complete();
-
-        }).andThen(Completable.defer(() -> {
 
             SchedulerFactory stdSchedulerFactory = new StdSchedulerFactory();
             Scheduler scheduler = stdSchedulerFactory.getScheduler();
@@ -1411,7 +1406,7 @@ public void downloadByQuery(RoutingContext context)  {
             JobDataMap jobDataMap = new JobDataMap();
             jobDataMap.put("token", token);
             jobDataMap.put("uuid", uuid);
-            jobDataMap.put("finalHits", finalHits);
+            jobDataMap.put("finalHits", hits);
             jobDataMap.put("email", emailDetails.get("email"));
 
             // define the job and tie it to our JobScheduler class
@@ -1441,7 +1436,7 @@ public void downloadByQuery(RoutingContext context)  {
             }
 
             return Completable.complete();
-        })).subscribe(()-> response.setStatusCode(ACCEPTED)
+        }).subscribe(()-> response.setStatusCode(ACCEPTED)
                         .setStatusMessage("Please kindly wait as your download links are getting ready")
                         .end("Please check your email to find the download links..!!" + "\n"),
                 throwable -> apiFailure(context, throwable));