Page immutable public Artifact manifests

GET

/v1/sessions/{sessionId}/artifacts

const url = 'https://example.com/v1/sessions/9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731/artifacts?after=9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731&limit=100';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://example.com/v1/sessions/9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731/artifacts?after=9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731&limit=100' \
  --header 'Authorization: Bearer <token>'

Requires wamp.cloud.sessions:read. Manifests only — size, sha256, contentType and provenance; the bytes come from the separate content endpoint, so an Artifact id is never a bearer capability on its own. Ordered oldest first and paged by id: after is an Artifact id (the previous page’s nextAfter, which is null on an empty page), and an id that does not belong to this Session is 404, not an empty page. Artifacts are immutable once created, but retention is finite: state flips to pruned when the payload is reclaimed while the manifest stays listed forever. Only publicly visible artifacts appear — internal checkpoint blobs never do.

Authorizations

cloudInstallationBearer

Parameters

Path Parameters

sessionId

required

A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.

string format: uuid

Example

9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731

A UUID you mint and own; it is the idempotency key for creation and the address of every Turn, artifact and publication underneath

Query Parameters

after

A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.

string format: uuid

Example

9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731

Exclusive Artifact id cursor returned as nextAfter

limit

integer

default: 100 >= 1 <= 100

Turns per page, 1-100, default 100

Responses

200

Artifact page

application/json

One page of the Session’s public artifact manifests, oldest first. Internal checkpoint artifacts are excluded from this listing entirely.

object

artifacts

required

Artifact manifests on this page, oldest first

Array<object>

The immutable manifest of one retained Session output. Bytes are never inlined here — fetch them from the artifact content endpoint, which authorizes through the owning Session on every request.

object

required

Artifact id, also the after cursor value when paging artifacts

string format: uuid

sessionId

required

Session that owns the artifact and through which access is authorized

string format: uuid

runId

Run that produced it; absent on artifacts produced by a Publication rather than a Run

string format: uuid

publicationId

Publication that produced it; set only on github.pull_request artifacts

string format: uuid

kind

required

What this output is: result.summary for a Run’s markdown summary, presented.file for a file the agent chose to present, github.pull_request for the JSON record of a Publication

string

role

required

Always output on this API; internal conversation and workspace checkpoints carry a different role and are filtered from every public path

string

contentType

required

Media type the content endpoint will serve these bytes with

string

size

required

Exact byte length of the content, matching the Content-Length of the download

integer

sha256

required

Digest of the content, also served as the strong ETag, so unchanged bytes never need to be downloaded twice

string

/^[a-f0-9]{64}$/

state

required

available while the bytes are retained; pruned once retention removed them, after which the content endpoint answers 410

string

Allowed values: available pruned

metadata

Presentation hints only — truncated when the producer had to bound the content, plus fileName, label and description for presented files

object

truncated

boolean

fileName

string

label

string

description

string

createdAt

required

When the artifact was durably recorded; artifact pages are ordered by this value ascending

string format: date-time

nextAfter

required

Id of the last artifact on this page, to send as an exclusive after cursor; null only when the Session has no public artifacts at all

string | null

hasMore

required

Whether more artifacts follow this page

boolean

Example

{
  "artifacts": [
    {
      "id": "b6e0d857-4a19-4f52-9c83-1d7e64a05b2f",
      "sessionId": "9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731",
      "runId": "c47a1e08-3d6b-4a92-9f15-8b70d2e5c6a4",
      "kind": "result.summary",
      "role": "output",
      "contentType": "text/markdown; charset=utf-8",
      "size": 1843,
      "sha256": "76100793e5ca92df907f7b13f4d9ff43cc39482e072b800eacaf5fc393ad0269",
      "state": "available",
      "metadata": {
        "truncated": false
      },
      "createdAt": "2026-08-12T09:43:58Z"
    },
    {
      "id": "a2c94d10-7b38-4e6f-95d1-0c83f7e2b451",
      "sessionId": "9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731",
      "runId": "c47a1e08-3d6b-4a92-9f15-8b70d2e5c6a4",
      "kind": "presented.file",
      "role": "output",
      "contentType": "text/plain; charset=utf-8",
      "size": 4096,
      "sha256": "ca2d51cb1ca1fb82a7e23972235bd5c4cc83810f77c071fb175bde61bf80208f",
      "state": "available",
      "metadata": {
        "fileName": "rate-limit-benchmark.txt",
        "label": "Benchmark output",
        "description": "wrk results for the sliding-window limiter at 100 rps per key"
      },
      "createdAt": "2026-08-12T09:44:01Z"
    }
  ],
  "nextAfter": "a2c94d10-7b38-4e6f-95d1-0c83f7e2b451",
  "hasMore": true
}

404

The resource is missing or inaccessible

application/json

Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.

object

error

required

Stable machine code

string

requiredScope

The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request

string

retryAfterSeconds

Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value

integer

>= 1

key

additional properties

any

Example

{
  "error": "cloud_session_not_found"
}