Get Run Artifact

GET /runs/{run_id}/artifacts/{attachment_id}

A presigned link to a binary the run produced (G-9).

A link rather than the bytes. The caller fetches the object from the bucket either way, and proxying it through here would hold a worker for the length of a download to save one hop. The signature expires, which is what makes a leaked link stop working, and expires_at says when.

viewer, the same floor as the transcript it belongs to: an artifact is a piece of a run’s output, and a reader who may see the run’s steps may see what they produced.

The URL is signed against OBJECT_STORE_ENDPOINT. A deployment whose bucket is only addressable from inside its own network hands out a link only a client on that network can follow — a property of that deployment’s addressing, and the reason the setting names a public endpoint in production.

Role floor

Requires viewer or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Parameters

Name	In	Type		Notes
run_id	path	string (uuid)	required	—
attachment_id	path	string (uuid)	required	—

Responses

Status	Description	Body
200	Successful Response	RunArtifactView
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

curl -X GET https://your-deployment.example.com/runs/{run_id}/artifacts/{attachment_id} \
  -H "Authorization: Bearer $COBRE_TOKEN"

Response — RunArtifactView

Field	Type		Notes
attachment_id	string (uuid)	required	—
run_id	string (uuid)	required	—
url	string	required	—
media_type	string | null	optional	—
size_bytes	integer | null	optional	—
expires_at	string (date-time)	required	—