Skip to main content
Files are org-scoped binary objects you upload once and reference by id. Uploads are virus-scanned before they become retrievable and are covered by the same BAA requirement as every other endpoint — see BAA gating. Uploaded files are stored on HASP-owned storage. Text uploads (text/* and application/json) are scanned for PHI and the redacted text is what is stored; binary uploads are stored as sent.
Stored files cannot yet be referenced from inference requests. To give a model an image or PDF today, send it inline as a base64 image or document block. A file (or url) source on a content block is rejected with 400 UNSUPPORTED_PARAMETER rather than silently dropped.
Every files endpoint — upload, list, metadata, content, and delete — requires the ai:documents scope; without it the request returns 403 MISSING_SCOPE. See Scopes.

Upload a file

Body

An upload that fails the malware scan is rejected with MALWARE_DETECTED and no file is stored.

List files

Cursor-paginated, scoped to the caller’s org. See Pagination.

Retrieve metadata

Returns the file’s metadata — id, purpose, size, content type, scan state, and creation time. It does not return the bytes.

Download content

Returns the stored bytes. This is a content read, so it is recorded in the audit chain as a disclosure — the metadata endpoint above is not.

Delete a file

Deletes the record and the underlying storage object. Files belonging to another org return 404.

Errors