BolrachDevelopers

Files API

Live

Secure object plane for products: create a signed upload, PUT the bytes, complete to run the malware gate, then mint a download URL only when scan status is clean. Health is public; everything else needs a platform key.

Base URL https://api.bolrach.devWrite files:writeRead files:readHealth public

Health

GET /v1/files/health

Unauthenticated liveness. Returns database reachability and whether R2 is configured (no secrets).

curl "https://api.bolrach.dev/v1/files/health"

Upload flow

  1. POST /v1/files/uploads with product key, tenant, filename, content type, size.
  2. PUT the file body to the signed URL before it expires.
  3. POST /v1/files/uploads/{id}/complete to scan (EICAR and heuristics in private build).
  4. When scan_status is clean, call download-url for a short-lived GET.
POST /v1/files/uploads

Scope files:write. Returns object_id and a presigned upload URL.

curl -X POST "https://api.bolrach.dev/v1/files/uploads" \
  -H "Authorization: Bearer bt_your_key_here" \
  -H "Content-Type: application/json"
  -d '{"product_key":"myapp","tenant_id":"t1","filename":"note.txt","content_type":"text/plain","byte_size":12}'
POST /v1/files/uploads/{id}/complete

Runs scan after the object lands. Infected objects are quarantined; download stays blocked.

curl -X POST "https://api.bolrach.dev/v1/files/uploads/OBJECT_ID/complete" \
  -H "Authorization: Bearer bt_your_key_here" \
  -H "Content-Type: application/json"
  -d '{}'
GET /v1/files/objects/{id}

Scope files:read. Metadata including scan_status.

curl "https://api.bolrach.dev/v1/files/objects/OBJECT_ID" \
  -H "Authorization: Bearer bt_your_key_here"
POST /v1/files/objects/{id}/download-url

Signed download only when scan is clean. Fails closed otherwise.

curl -X POST "https://api.bolrach.dev/v1/files/objects/OBJECT_ID/download-url" \
  -H "Authorization: Bearer bt_your_key_here" \
  -H "Content-Type: application/json"
  -d '{}'
POST /v1/files/objects/{id}/scan

Scope files:write. Re-run the malware gate (private build: EICAR + heuristics). Use after a failed scan or if bytes were replaced under the same object id.

curl -X POST "https://api.bolrach.dev/v1/files/objects/OBJECT_ID/scan" \
  -H "Authorization: Bearer bt_your_key_here" \
  -H "Content-Type: application/json"
  -d '{}'

Private-build notes

Coordinated launch keeps this plane private. Abuse packs cover EICAR quarantine. Product keys must not share files:write across untrusted tenants.

Machine catalogue: api.bolrach.dev/v1 · openapi.json.