> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace

> Browse and manage the artifacts your agents write.

Every account has one workspace: a private file store that the Hackbot
agent's filesystem tools read and write. When Hackbot saves recon output, a
screenshot, or a draft, the file lands here. The dashboard Workspace page
browses the same files, and the API reads them directly.

## List artifacts

`GET /api/workspace/tree` returns every file, flattened to one list:

```json theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
{
  "entries": [
    {
      "path": "recon/INDEX.md",
      "name": "INDEX.md",
      "size": 2048,
      "modifiedAt": "2026-09-22T10:04:00.000Z"
    }
  ],
  "truncated": false
}
```

The listing is capped like the agent's own view. A `truncated` flag marks a
clipped result.

## Read one artifact

`GET /api/workspace/file/{file}` returns one artifact with its metadata.
Encode each path segment: `/api/workspace/file/recon%2FINDEX.md`.

Text artifacts carry their decoded `content`. Binary artifacts return
metadata only, and the bytes come from the raw endpoint. Reads past 512 KiB
come back clipped, with `truncated: true`.

## Download an artifact

`GET /api/workspace/raw/{file}` streams the raw bytes with the derived
content type. Use it for downloads and image previews. Scriptable documents
(HTML, SVG, XML) download as attachments, so a stored artifact never
executes in the dashboard origin.

## Delete artifacts

`DELETE /api/workspace/artifacts` deletes artifacts:

* Send `{ "paths": ["recon/INDEX.md"] }` to delete exactly those files, up
  to 500.
* Send an empty body to clear the whole workspace.

The response reports the deleted count and any paths that failed.

## Tenancy

The workspace is derived from your session on every request. A path can
never name another account's bucket: tenancy is the session, not the URL.