Sharing

Set visibility when you upload a file, or set default_visibility on a project. Choose public, unlisted, or private.

Visibility

• Public and unlisted files work at their hosted URL without a key or signature.
• Private files return url: null from the file API until you create a signed access URL.

Hosted URLs

Files are served from https://f.agentfsusercontent.com/f/<id>. HTML, SVG, and XML files are served from a sandboxed origin, https://s.agentfsusercontent.com/f/<id>, so a page someone uploads cannot act as agentfs.cloud.

Links on the old hosts, f.agentfs.cloud and s.agentfs.cloud, keep working. They redirect permanently to the same path and query on the new host.

Rendered Markdown pages show Raw, Download, and Report links. Report opens an email to abuse@agentfs.cloud. A file blocked for abuse returns 451 file_blocked instead of its bytes.

An unlisted file is not an access control boundary; use private when a file must not be readable without a signed link.

Set visibility on a one-shot upload:

curl -sS -X POST https://agentfs.cloud/v1/files \
  -H "Authorization: Bearer $AGENTFS_KEY" \
  -F "file=@./report.pdf" \
  -F "path=research/report.pdf" \
  -F "visibility=private"

Uploads without a key cannot be public or private. They are always unlisted.

Project defaults

A file with no visibility value uses its project's default_visibility, which defaults to unlisted. Changing the project default applies right away to every file that has no visibility of its own, including files uploaded earlier. A file's own visibility always wins over the project default.

Folders only organize paths. They have no visibility or expiry of their own.

Create a signed link

Call POST /v1/files/:id/access with a key that has share permission:

curl -sS -X POST https://agentfs.cloud/v1/files/f_8f2c/access \
  -H "Authorization: Bearer $AGENTFS_KEY" \
  -H "content-type: application/json" \
  -d '{"expires_in":"24h"}'

For a private file, the response contains the link and its expiry:

{
  "file_id": "f_8f2c",
  "url": "https://f.agentfsusercontent.com/f/f_8f2c?expires=1775048400&v=1&signature=example",
  "markdown": "[report.pdf](https://f.agentfsusercontent.com/f/f_8f2c?expires=1775048400&v=1&signature=example)",
  "expires_at": "2026-04-01T13:00:00.000Z"
}

If the file is public or unlisted, the endpoint returns its existing URL and expires_at: null; those URLs do not become temporary. For a private file, omit expires_in for a one-hour link. Accepted durations use s, m, h, d, or w, and a signed link can last at most 7 days.

The file's own expiry still applies. A signed link cannot make an expired file available.

A private link looks like ?expires=<unix time>&v=<access version>&signature=<signature>. Older links without v keep working until they expire, unless the file's links were revoked.

Revoke private links

If a private link leaks, revoke every private link issued for the file so far. The key needs write permission:

curl -sS -X POST https://agentfs.cloud/v1/files/f_8f2c/access/revoke \
  -H "Authorization: Bearer $AGENTFS_KEY"

{
  "id": "f_8f2c",
  "access_version": 2
}

Old links then return 404. Links you create afterwards work as usual. Revoking does not touch public or unlisted URLs: change the file's visibility or delete it for those.