Workspace

Browse and manage the artifacts your agents write.

Every account has one workspace: a private file store that the Hackbot agent’s filesystem tools read and write. When Hackbot saves recon output, a screenshot, or a draft, the file lands here. The dashboard Workspace page browses the same files, and the API reads them directly.

List artifacts

GET /api/workspace/tree returns every file, flattened to one list:

{
  "entries": [
    {
      "path": "recon/INDEX.md",
      "name": "INDEX.md",
      "size": 2048,
      "modifiedAt": "2026-09-22T10:04:00.000Z"
    }
  ],
  "truncated": false
}

The listing is capped like the agent’s own view. A truncated flag marks a clipped result.

Read one artifact

GET /api/workspace/file/{file} returns one artifact with its metadata. Encode each path segment: /api/workspace/file/recon%2FINDEX.md.

Text artifacts carry their decoded content. Binary artifacts return metadata only, and the bytes come from the raw endpoint. Reads past 512 KiB come back clipped, with truncated: true.

Download an artifact

GET /api/workspace/raw/{file} streams the raw bytes with the derived content type. Use it for downloads and image previews. Scriptable documents (HTML, SVG, XML) download as attachments, so a stored artifact never executes in the dashboard origin.

Delete artifacts

DELETE /api/workspace/artifacts deletes artifacts:

• Send { "paths": ["recon/INDEX.md"] } to delete exactly those files, up to 500.
• Send an empty body to clear the whole workspace.

The response reports the deleted count and any paths that failed.

Tenancy

The workspace is derived from your session on every request. A path can never name another account’s bucket: tenancy is the session, not the URL.