Manage files on a running computer. All paths are restricted to /workspace, /home, /root, /tmp, /opt, and /srv.

Base path: /api/v1/computers/{id}/files

Upload a File

POST /api/v1/computers/{id}/files/upload

Uploads a file to the computer via multipart form data.

Request

Content-Type: multipart/form-data

Response - 201 Created

{
  "success": true,
  "file": {
    "path": "/workspace/script.py",
    "filename": "script.py",
    "size_bytes": 1234
  }
}

Errors

curl -X POST https://api.miosa.ai/api/v1/computers/{id}/files/upload 
  -H "Authorization: Bearer $MIOSA_API_KEY" 
  -F "file=@./script.py" 
  -F "path=/workspace/scripts/"

List Directory

GET /api/v1/computers/{id}/files

Lists files and directories at a given path.

Query Parameters

Response - 200 OK

{
  "files": [
    {
      "name": "Documents",
      "type": "directory",
      "size_bytes": 4096,
      "modified_at": "2026-04-11T10:30:00Z"
    },
    {
      "name": "script.py",
      "type": "file",
      "size_bytes": 1234,
      "modified_at": "2026-04-11T10:25:00Z"
    }
  ],
  "path": "/workspace"
}

File Entry Fields

curl "https://api.miosa.ai/api/v1/computers/{id}/files?path=/workspace" 
  -H "Authorization: Bearer $MIOSA_API_KEY"

Download a File

GET /api/v1/computers/{id}/files/download

Downloads a file from the computer as binary data.

Query Parameters

Response - 200 OK

Binary file content. Content-Type is inferred from the file extension. The Content-Disposition header is set for download.

Errors

curl "https://api.miosa.ai/api/v1/computers/{id}/files/download?path=/workspace/output.txt" 
  -H "Authorization: Bearer $MIOSA_API_KEY" 
  --output output.txt

Export a File

POST /api/v1/computers/{id}/files/export

Returns file metadata and base64-encoded content in a single response.

Request Body

Response - 200 OK

{
  "success": true,
  "file": {
    "path": "/workspace/data.json",
    "filename": "data.json",
    "size_bytes": 5678,
    "content_type": "application/json",
    "modified_at": "2026-04-11T10:30:00Z"
  },
  "content_base64": "eyJrZXkiOiAidmFsdWUifQ=="
}

Errors

curl -X POST https://api.miosa.ai/api/v1/computers/{id}/files/export 
  -H "Authorization: Bearer $MIOSA_API_KEY" 
  -H "Content-Type: application/json" 
  -d '{"path": "/workspace/data.json"}'

Delete a File

DELETE /api/v1/computers/{id}/files

Removes a file from the computer.

Request Body

Response - 200 OK

{
  "success": true,
  "path": "/workspace/old-file.txt"
}

Errors

curl -X DELETE https://api.miosa.ai/api/v1/computers/{id}/files 
  -H "Authorization: Bearer $MIOSA_API_KEY" 
  -H "Content-Type: application/json" 
  -d '{"path": "/workspace/old-file.txt"}'

Path Security

All paths are validated before execution:

1. Expansion - Path.expand resolves .., ~, and symlinks
2. Prefix check - Expanded path must start with /workspace, /home, /root, /tmp, /opt, or /srv
3. Rejection - Paths outside these prefixes return 403 FORBIDDEN_PATH

This prevents path traversal attacks. For example, /workspace/../../etc/passwd expands to /etc/passwd and is rejected.