Upload a file
Body
MALWARE_DETECTED and no file is stored.
List files
Retrieve metadata
Download content
Delete a file
404.
Control Plane
Files
Upload files once, reference them across inference requests, and retrieve or delete them — with the same BAA gate, malware scan, and audit trail as any other PHI-bearing surface.
Files are org-scoped binary objects you upload once and reference by id. Uploads are virus-scanned before they become retrievable and are covered by the same BAA requirement as every other endpoint — see BAA gating.
An upload that fails the malware scan is rejected with
Cursor-paginated, scoped to the caller’s org. See Pagination.
Returns the file’s metadata — id, purpose, size, content type, scan state, and creation time. It does not return the bytes.
Returns the stored bytes. This is a content read, so it is recorded in the audit chain as a disclosure — the metadata endpoint above is not.
Deletes the record and the underlying storage object. Files belonging to another org return