upload
POST /v1/files, multipart/form-data — the one method in the client that does not send JSON. The file part carries the bytes; other parts are metadata:
list
GET /v1/files. FileFilter extends the page query with:
"session" | "published"
Only scratch, or only published artifacts.
string
Only files a given session produced.
get
GET /v1/files/{id} — the metadata object.
download
GET /v1/files/{id}?download=true — the bytes, as text, through the API. A download is authorized by the same key as every other read; there is no unauthenticated URL unless you publish.
publish
POST /v1/files/{id}/publish. The promotion boundary: session scratch becomes a durable org artifact. Idempotent — publishing twice is fine.
delete
DELETE /v1/files/{id}.