Skip to main content
POST
Publish an HTML artifact
Store a completed HTML report and its assets. Requires samples:write and results:read. Creation is credit-free; organization and author come from authentication. description is required provenance: summarize the data sources, methods and limitations. Titles are trimmed to 1 to 200 characters; descriptions to 1 to 10,000 characters. Blank values are rejected.
  • sample_ids and job_ids are optional arrays of up to 100 unique UUIDs each. Linked resources must belong to the authenticated organization.
  • html is the nonempty UTF-8 entry document, stored as index.html.
  • assets accepts up to 128 {path, content_base64} objects. Use canonical base64 and unique relative paths such as assets/figure.png. Path segments use ASCII letters, digits, _, - and . (including Zarr metadata such as .zattrs); dot-only segments . and .. are rejected. Paths are at most 240 characters. Traversal, absolute paths, index.html and _strand_bundle.json are rejected.
  • HTML plus decoded assets must fit within 32 MiB. The application limits encoded JSON to 46 MiB, but deployment proxy limits can be lower. For example, a 32 MiB encoded-request edge limit leaves roughly 24 MiB for decoded base64 assets, before JSON/HTML overhead. The 32 MiB bundle cap is not a guarantee that every deployment accepts a request of that size. Multipart and signed-upload flows for larger bundles are not implemented.
  • Reference bundled assets using relative URLs; external network resources are blocked when the report renders.
A 201 response contains snake_case metadata, provenance, linked IDs, auth-derived author, entry_html_path, size_bytes, sha256, created_at, and url. The relative in-app URL requires an organization member’s signed-in session, and metadata responses omit HTML and asset bytes. Invalid input, bundle paths or foreign linked resources return 400; oversized encoded JSON returns 413. A deployment proxy may reject a smaller request before it reaches this endpoint.

Python and MCP

MCP create_artifact accepts the same fields and sends report content through the tool call. Keep credentials and patient identifiers out of report content. Artifacts are immutable, with no edit-in-place API. To remove one, use Delete an artifact.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Scopes

samples:write

Upload and change slides

results:read

Read and download results

Body

application/json
title
string
required

Trimmed; must not be blank.

Required string length: 1 - 200
description
string
required

Required nonblank provenance summary: sources, methods and limitations.

Required string length: 1 - 10000
html
string
required

UTF-8 HTML plus decoded assets must not exceed 32 MiB.

Minimum string length: 1
sample_ids
string<uuid>[]
Maximum array length: 100
job_ids
string<uuid>[]
Maximum array length: 100
assets
object[]
Maximum array length: 128

Response

Created artifact metadata and org-gated URL

id
string<uuid>
required
org_id
string<uuid>
required
title
string
required
description
string
required
sample_ids
string<uuid>[]
required
job_ids
string<uuid>[]
required
author_type
enum<string>
required
Available options:
user,
agent
author_id
string
required
entry_html_path
enum<string>
required
Available options:
index.html
size_bytes
integer
required
Required range: 1 <= x <= 33554432
sha256
string
required
Pattern: ^[a-f0-9]{64}$
created_at
string<date-time>
required
url
string
required

Org-gated relative in-app URL /artifacts/{id}, not a public link.