Gated File Delivery

Get a short-lived download URL for a gated file. Requires a verified tenant_auth session (wst_ Bearer). Returns { url, expires_in, delivery, filename }. Entitlement is checked live.

Upload a file into the private library as a tenant member. Requires a verified tenant_auth session (wst_ Bearer). tenant_code is taken from the session, never from the body. No overwrite. With member_upload_scope uploader the file is private to the uploader, who can remove it with delete-mine; otherwise uploads are append-only. Returns { file_id, filename, size_bytes }.

List the private files this tenant may reach. The read counterpart of download: same door, same entitlement, so it can never show a file download would refuse. Scoped to the session tenant, not to the caller alone — a colleague seeing your upload is the point — unless member_upload_scope is uploader: then members only see their own uploads (plus the files the owner published). Returns file_id, filename, content_type, size_bytes, added_by, source and created_at. Never storage_key.

Permanently remove one of your own uploads (put-upload). Only when the project sets member_upload_scope uploader. Requires a verified tenant_auth session (wst_ Bearer). Any other file answers 404. Returns { deleted, file_id }.

Set project defaults: entitlement_mode (library|asset), delivery_mode (signed|stream), signed_ttl_secs (10..900), member upload settings incl. member_upload_scope (tenant|uploader) and member_upload_retention_days.

Register a private file. Provide exactly one source: storage_key (already-uploaded private path), base64 (inline bytes), or source_url (https, our own public storage — fetched into private). Optional per-file tenant_code / entitlement_mode / delivery_mode overrides.

Import one file the owner picked in their own connected storage into the private library: a private copy is stored and registered as a normal gated file, so download works exactly as for put-file. provider: "dropbox" (connect it first with dropbox.connect). ref: the file id from the Dropbox Chooser or dropbox search-files ("id:…"). The type is checked from the bytes against the project allowlist (member_upload_mime_allow, else the platform default: PDF, Office, CSV, text, images) and the plan storage limit is checked first. Later changes in the provider are not synced. Paid plans. Returns { id, filename, size_bytes, content_type, provider }.

Grant access to a file (entitlement_mode = asset). grant_type: tenant_code | tenant_user | plan.

Remove a previously granted access rule.

List gated files for this project, optionally filtered by tenant_code. Each row carries archived_at (null = in member delivery).

Change a registered gated file: filename, tenant_code (empty = every tenant of this site), entitlement_mode or delivery_mode (empty = project default). Members see the change on their next list or download. Provenance of member uploads is kept.

Take a file out of member delivery without deleting it: it disappears from list-mine, download answers 404 and stream links already issued stop working. archived:false restores it. The owner still sees it in list-files and can export it with owner-download. Reversible, so prefer it over delete-file for superseded versions.

Permanently remove a gated file: its registration and grants, plus the stored bytes when gated-files stored them (put-file base64/source_url, put-upload) and no other registration uses them. A file registered from an existing storage_key keeps its object. Requires confirm:true. Cannot be undone; frees storage.

Owner export: short-lived private download URLs (5 to 15 minutes) for up to 50 gated files at once, archived ones included. Never a public CDN link and no member entitlement involved. Use it to back up or hand over files; never put these URLs on a page. Returns {files:[{file_id, filename, size_bytes, archived, url}], not_found, expires_in}.

Owner read: the contents of up to 10 gated files (1 MB each, 3 MB per call, 60 calls per hour), archived ones included, for an assistant that cannot fetch owner-download URLs. Text comes back as utf8, anything else as base64, each with sha256. Files over 1 MB are listed in too_large: use owner-download for those. Files that did not fit in the 3 MB budget of this call are listed in deferred: call owner-read again with those ids. The contents enter the conversation: use it only for files the owner wants the assistant to read, never publish them. Returns {files:[{file_id, filename, content_type, size_bytes, archived, sha256, encoding, content}], not_found, too_large, missing, limits}.

Download statistics: files registered, downloads in the period, top files.