blob-storage

Operations of the Artifact Store API. Paths are relative to your deployment's API host.

POST /api/artifact-store-api/blobs

Upload a content-addressed blob. Server computes the sha256 and stores under the caller orgId.

Authentication: bearer token (Authorization: Bearer <token>)

GET /api/artifact-store-api/blobs/{sha256}

Download a blob by sha256. Scoped to the caller orgId; returns 404 for unknown or cross-tenant sha256.

Authentication: bearer token (Authorization: Bearer <token>)

DELETE /api/artifact-store-api/blobs/{sha256}

Release the caller's claim on a blob by sha256, scoped to the caller orgId. Blobs are content-addressed org-wide, so one row is shared by every owner that stored identical bytes: the row is physically removed ONLY when nothing in artifact-store still references it (no ArtifactEntry.blobId, no ArtifactVersion pointer "blob://sha256/<digest>"). When another owner still holds the bytes they are RETAINED — the caller's claim is still released, and the retention is logged at WARN with the per-kind reference breakdown. Idempotent: returns 204 whether the blob was deleted, retained, or already gone. Used by the workflow-engine retention sweeper to release snapshot bytes after a WorkflowRun row is archived.

Authentication: bearer token (Authorization: Bearer <token>)