Skip to main content
Every account has one workspace: a private file store that the Hackbot agent’s filesystem tools read and write. When Hackbot saves recon output, a screenshot, or a draft, the file lands here. The dashboard Workspace page browses the same files, and the API reads them directly.

​
List artifacts

GET /api/workspace/tree returns every file, flattened to one list:
The listing is capped like the agent’s own view. A truncated flag marks a clipped result.

​
Read one artifact

GET /api/workspace/file/{file} returns one artifact with its metadata. Encode each path segment: /api/workspace/file/recon%2FINDEX.md. Text artifacts carry their decoded content. Binary artifacts return metadata only, and the bytes come from the raw endpoint. Reads past 512 KiB come back clipped, with truncated: true.

​
Download an artifact

GET /api/workspace/raw/{file} streams the raw bytes with the derived content type. Use it for downloads and image previews. Scriptable documents (HTML, SVG, XML) download as attachments, so a stored artifact never executes in the dashboard origin.

​
Delete artifacts

DELETE /api/workspace/artifacts deletes artifacts:
  • Send { "paths": ["recon/INDEX.md"] } to delete exactly those files, up to 500.
  • Send an empty body to clear the whole workspace.
The response reports the deleted count and any paths that failed. Clearing the workspace never deletes a finished export.

​
Export the workspace

An export packs selected artifacts, or the whole workspace, into one ZIP. The export runs in the background, so you can keep working after you start it. Start an export by sending the paths in batches of five:
  • The first batch (batchIndex: 0) creates the export. The response returns its id.
  • Send each later batch with that id in the exportId field.
  • Every response answers 202 with the batch progress. The last batch queues the build.
  • To export everything, send every path from GET /api/workspace/tree, in batches of five.
The export worker reads the listed artifacts, compresses them, and uploads the archive to your bucket as downloads/{your-user-id}.zip. When the archive is ready, the platform sends you a dashboard notification with the download link. The toast, the notification bell, and the profile’s Download History all carry it. The download lives for one day:
  • GET /api/workspace/exports/{id}/download streams the ZIP. The endpoint answers 409 while the export is not ready, and 410 after the link expires.
  • GET /api/workspace/exports lists your exports with their created and expiry times.
  • GET /api/workspace/exports/{id} returns one entry. Poll it while the export runs.
The profile page keeps a Download History with the same entries. Expired and failed exports stay in the list, without a link. Batch requests draw the Export rate budget of 120 per minute, so one request per five files fits even a workspace at the listing cap.

​
Tenancy

The workspace is derived from your session on every request. A path can never name another account’s bucket: tenancy is the session, not the URL.