diff --git a/src/apps.js b/src/apps.js
index 03bf32924..05d54c4ba 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -2631,7 +2631,8 @@ async function downloadFile(app, filePath) {
     assert.strictEqual(typeof app, 'object');
     assert.strictEqual(typeof filePath, 'string');
 
-    const statStream = await startExec(app, { cmd: [ 'stat', '--printf=%F-%s', filePath ], tty: true });
+    const statExecId = await createExec(app, { cmd: [ 'stat', '--printf=%F-%s', filePath ], tty: true });
+    const statStream = await startExec(app, statExecId, { tty: true });
     const data = await drainStream(statStream);
 
     const parts = data.split('-');
@@ -2652,7 +2653,8 @@ async function downloadFile(app, filePath) {
         throw new BoxError(BoxError.NOT_FOUND, 'only files or dirs can be downloaded');
     }
 
-    const inputStream = await startExec(app, { cmd, tty: false });
+    const execId = await createExec(app, { cmd, tty: false });
+    const inputStream = await startExec(app, execId, { tty: false });
 
     // transforms the docker stream into a normal stream
     const stdoutStream = new TransformStream({
@@ -2693,7 +2695,8 @@ async function uploadFile(app, sourceFilePath, destFilePath) {
     const escapedDestFilePath = safe.child_process.execSync(`printf %q '${destFilePath.replace(/'/g, '\'\\\'\'')}'`, { shell: '/bin/bash', encoding: 'utf8' });
     debug(`uploadFile: ${sourceFilePath} -> ${escapedDestFilePath}`);
 
-    const destStream = await startExec(app, { cmd: [ 'bash', '-c', `cat - > ${escapedDestFilePath}` ], tty: false });
+    const execId = await createExec(app, { cmd: [ 'bash', '-c', `cat - > ${escapedDestFilePath}` ], tty: false });
+    const destStream = await startExec(app, execId, { tty: false });
 
     return new Promise((resolve, reject) => {
         const done = once(error => reject(new BoxError(BoxError.FS_ERROR, error.message)));
diff --git a/src/routes/apps.js b/src/routes/apps.js
index ac0e43915..376dd25ca 100644
--- a/src/routes/apps.js
+++ b/src/routes/apps.js
@@ -760,12 +760,6 @@ async function startExecWebSocket(req, res, next) {
     assert.strictEqual(typeof req.app, 'object');
     assert.strictEqual(typeof req.params.execId, 'string');
 
-    let cmd = null;
-    if (req.query.cmd) {
-        cmd = safe.JSON.parse(req.query.cmd);
-        if (!Array.isArray(cmd) || cmd.length < 1) return next(new HttpError(400, 'cmd must be array with atleast size 1'));
-    }
-
     const columns = req.query.columns ? parseInt(req.query.columns, 10) : null;
     if (isNaN(columns)) return next(new HttpError(400, 'columns must be a number'));
 
@@ -777,7 +771,7 @@ async function startExecWebSocket(req, res, next) {
     // in a badly configured reverse proxy, we might be here without an upgrade
     if (req.headers['upgrade'] !== 'websocket') return next(new HttpError(404, 'exec requires websocket'));
 
-    const [error, duplexStream] = await safe(apps.startExec(req.app, { cmd: cmd, rows: rows, columns: columns, tty: tty }));
+    const [error, duplexStream] = await safe(apps.startExec(req.app, req.params.execId, { rows, columns, tty }));
     if (error) return next(BoxError.toHttpError(error));
 
     req.clearTimeout();