Upload an artifact
const url = 'https://example.com/v1/artifacts';const form = new FormData();form.append('file', 'file');form.append('name', 'example');form.append('contentType', 'example');form.append('tags', '"example"');form.append('ownerRunId', '2489E9AD-2EE2-8E00-8EC9-32D5F69181C0');form.append('projectId', 'example');form.append('expectedHash', 'example');
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
options.body = form;
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/v1/artifacts \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: multipart/form-data' \ --form file=@file \ --form name=example \ --form contentType=example \ --form 'tags="example"' \ --form ownerRunId=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \ --form projectId=example \ --form expectedHash=exampleMultipart upload. file part carries the bytes; other form fields carry metadata (name, contentType, tags (JSON), ownerRunId, projectId, expectedHash). Framework computes sha256 and returns it in BlobMeta.hash. If expectedHash was supplied and diverges, response is 400 blob-hash-mismatch. Content-type sniffing is NOT performed server-side — the framework trusts the caller. The artifact belongs to its owner run’s project, else projectId, else the project the caller’s API key is limited to, else the tenant’s default project; uploading needs write there, and a key limited to a project uploads into that project only. An upload over the runtime’s cap (default 100 MiB) is 413 artifact-too-large.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Header Parameters
Section titled “Header Parameters”Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per docs/API-ROUTE-CONVENTIONS.md §3.1). A retry sent while the first request still runs is answered 409 idempotency-key-in-flight with Retry-After, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets 409 idempotency-key-replay-withheld, with the first request’s status and when it succeeded (from 0.1.5).
Request Bodyrequired
Section titled “Request Bodyrequired”Multipart form. file is the byte stream (required). Other fields are optional metadata: name (defaults to file part filename), contentType (defaults to file part MIME), tags (JSON-encoded object), ownerRunId (RunId string), expectedHash (sha256 hex, framework rejects on mismatch).
object
JSON-encoded Record<string, string> — parsed server-side.
The project it belongs to, when there’s no ownerRunId (with one, the run’s project, and this must agree). Default: the tenant’s default project.
Caller-computed sha256, hex-encoded, lowercase. Framework verifies + rejects on mismatch with blob-hash-mismatch (400).
Responses
Section titled “Responses”Upload accepted; metadata returned.
object
ArtifactId — opaque branded string (a UUID).
Caller-supplied filename or logical name.
MIME type as declared by the uploader. Framework does NOT sniff content-type server-side.
Byte length of the persisted body.
Sha256 of the body, hex-encoded, lowercase (64 chars).
Free-form caller-supplied labels. Filterable on list via ?tag.<key>=<value>.
object
Optional back-ref to the RunId that produced this blob.
The project the artifact belongs to: its owner run’s, else the upload’s projectId, else the tenant’s default project. Reading it needs read there; deleting it, write. Absent on blobs stored before projects were recorded.
Who uploaded it: user:<id> or service_account:<id>.
The bucket of the blob’s S3-compatible address (/s3/{bucket}/{key}). Present, with key, when the server’s storage gives the blob one: an object put through /s3 has the bucket and key it was put under, and an upload through POST /v1/artifacts conventionally has bucket artifacts and its blobId as the key.
The key of the blob’s S3-compatible address (/s3/{bucket}/{key}). Present, with bucket, when the server’s storage gives the blob one.
Examplegenerated
{ "blobId": "example", "tenantId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "name": "example", "contentType": "example", "size": 1, "hash": "example", "tags": { "additionalProperty": "example" }, "ownerRunId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "projectId": "example", "createdBy": "example", "createdAt": "2026-04-15T12:00:00Z", "bucket": "example", "key": "example"}Malformed multipart body, bad tag JSON, hash mismatch, declared size mismatch, or a projectId that isn’t the owner run’s.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Missing / malformed / expired / revoked bearer token.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}No write on the project (permission-denied), or the caller’s API key is limited to another project (key-project-mismatch).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}No such owner run (run-not-found).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Idempotency-Key was reused with a different body, or resource-state conflict.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Over the upload cap (artifact-too-large; details.maxBytes says how much).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Server error (unmapped domain code or framework crash).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}