Artifacts

Overview

Artifacts are immutable files published by Agent Turns. Use these endpoints to list an Agent's outputs, stream their private bytes through the authenticated API, or tombstone an Artifact.

Endpoints

GET /v1/agents/:agentId/artifacts

Returns Artifacts newest first across the Agent's Sessions. An unknown or foreign Agent ID produces an empty page.

Query parameter	Type	Default	Description
`sessionId`	string	—	Restrict to one `ss_…` Session
`userId`	string	—	Attribution filter; `""` means tenant-level
`includeDeleted`	boolean	`false`	Include tombstones
`cursor`	string	—	Opaque cursor

Response

Returns 200 OK.

Response schema: artifactsListResponseSchema.

{
  "data": [
    {
      "artifactId": "at_1234567890ABCDEF",
      "agentId": "ag_1234567890ABCDEF",
      "tenantId": "ten_1234567890ABCDEF",
      "sessionId": "ss_1234567890ABCDEF",
      "filename": "report.pdf",
      "mediaType": "application/pdf",
      "sizeBytes": 24830,
      "userId": "",
      "metadata": {},
      "createdAt": "2026-07-10T10:00:00Z",
      "deletedAt": null
    }
  ],
  "nextCursor": null
}

Errors

400 invalid_request for malformed filters or cursor. See REST errors.

cURL

curl --get \
  "$BLAZING_AGENTS_BASE_URL/v1/agents/ag_1234567890ABCDEF/artifacts" \
  --header "Authorization: Bearer $BLAZING_AGENTS_API_KEY" \
  --data-urlencode "includeDeleted=false"

SDK: list. See Artifacts and Publish and download Artifacts.

GET /v1/agents/:agentId/artifacts/:artifactId

Downloads one Artifact. The globally unique Artifact ID is tenant-checked against the Agent; no filename is required in the URL.

Requires bearer authentication, an ag_… agentId, and an at_… artifactId. There are no query or body parameters. The credential selects the Tenant ownership boundary; reads and mutations are restricted to resources owned by that Tenant.

Location	Field	Required	Description
Header	`Authorization`	yes	Tenant API key or dashboard Supabase JWT.
Path	`agentId`	yes	Agent ID (`ag_…`).
Path	`artifactId`	yes	Artifact ID (`at_…`).

Response

Returns 200 OK with the raw bytes and these headers:

Content-Type: stored media type
Content-Length: byte length
Content-Disposition: attachment: encoded original filename
X-Content-Type-Options: nosniff

The body is binary, not JSON.

Errors

400 invalid_request for malformed IDs. 404 not_found for a missing/foreign Artifact or missing bytes. 410 not_found when the Artifact was deleted. See REST errors.

cURL

curl --fail-with-body \
  "$BLAZING_AGENTS_BASE_URL/v1/agents/ag_1234567890ABCDEF/artifacts/at_1234567890ABCDEF" \
  --header "Authorization: Bearer $BLAZING_AGENTS_API_KEY" \
  --output report.pdf

SDK: download. See Artifacts and Publish and download Artifacts.

DELETE /v1/agents/:agentId/artifacts/:artifactId

Tombstones the Artifact record and enqueues durable, internally idempotent deletion of its private Storage object; Session transcripts are not rewritten. A repeated HTTP deletion returns 410 not_found because the Artifact is already tombstoned.

Request

Location	Field	Required	Description
Header	`Authorization`	yes	Tenant API key or dashboard Supabase JWT.
Path	`agentId`	yes	Agent ID (`ag_…`).
Path	`artifactId`	yes	Artifact ID (`at_…`).

curl --request DELETE \
  "$BLAZING_AGENTS_BASE_URL/v1/agents/ag_1234567890ABCDEF/artifacts/at_1234567890ABCDEF" \
  --header "Authorization: Bearer $BLAZING_AGENTS_API_KEY"

SDK: delete. See Artifacts and Publish and download Artifacts.

On this page