Upload source files before referencing them in a task.

Upload

POST /v1/files
Authorization: Bearer $HR_API_KEY
Content-Type: multipart/form-data

purpose=user_data
file=@agreement.docx

Reference in input

{
  "input": [
    {
      "role": "user",
      "content": [
        { "type": "input_file", "file_id": "file_..." },
        { "type": "input_text", "text": "Review this agreement." }
      ]
    }
  ],
  "stream": true
}

Request fields and response

The upload is a multipart form. The file is streamed to storage as it arrives, so a large upload never waits on the whole body.

file

The file part. Required. Its name becomes the path in the agent's working directory.

purpose

A label for your own bookkeeping, user_data by default. It is returned as sent.

Size

Up to 25 MiB per file. A larger upload answers 413.

Response

{ id, object: "file", bytes, created_at, filename, purpose }. Keep id for the input_file block.

Ownership

A file id belongs to the Workspace key that uploaded it. Any other key that names it gets 404, never the bytes.

Delete a file

Delete an uploaded file. A task that names it afterwards gets file_not_found. It is removed 30 days later; until then it can be restored by emailing contact@harnessrouter.ai.

Returns { "id": "file_...", "object": "file", "deleted": true }.

DELETE /v1/files/{file_id}
Authorization: Bearer $HR_API_KEY

• Deletion and retention: What a delete does for each kind of data, and when it leaves backups.

Where the file lands

Every turn that carries an input_file block writes the file into the agent's working directory under its upload filename before the agent starts, so a task can read ./agreement.docx on its first step. A file attached on a later turn of the same session lands the same way, and an upload with the same filename replaces the earlier copy.

Filenames are taken as relative paths inside the working directory. A name that would escape it is refused.

• Harness environment: Secrets and long values reach the shell without passing through the prompt.