Go
Artifacts
Publish HTML from an agent and get a link. Included with Go and Go Max.
What an artifact is#
An artifact is 1 to 20 HTML files published as one unit. One file renders as a page. Several open as a board of live previews, with a page per file.
Artifacts are part of Go and Go Max. Publishing is included with the plan: it does not debit usage-credits.
A new artifact is private by default. A public link is a toggle, in the dashboard or over the API.
Only the latest version exists. Republishing replaces the whole file set atomically, keeping the same ID and the same link. No version history is retained.
Use Hosted tools to gather data or generate images before publishing your HTML.
Publish from the API#
Artifacts use the same API key as inference: Authorization: Bearer hk-….
POST /v1/artifacts takes multipart/form-data. The first part is manifest, UTF-8 JSON with content type application/json. Every part after it is one file: named by its manifest part, sent as text/html, holding raw UTF-8 HTML.
The manifest carries slug, entry, title, description, favicon, and files as path/part pairs. slug is required when creating; paths end in .html or .htm.
curl -i https://haidercode.ai/v1/artifacts \
-H "Authorization: Bearer hk-…" \
-H 'Idempotency-Key: report-1' \
-F 'manifest={"slug":"weekly-report","entry":"index.html","files":[{"path":"index.html","part":"page"},{"path":"notes/details.html","part":"details"}]};type=application/json' \
-F 'page=@/tmp/index.html;type=text/html' \
-F 'details=@/tmp/details.html;type=text/html'The response carries the id, the slug, the etag, and board_url, the viewer link to share. Keep the etag: replacing an artifact by ID requires it.
| Endpoint | What it does |
|---|---|
POST /v1/artifacts | create, or replace the artifact with the same slug |
PUT /v1/artifacts/{id} | replace every file; requires the exact quoted If-Match |
GET /v1/artifacts | list your artifacts, newest first; ?limit=, ?cursor=, ?q= |
GET /v1/artifacts/{id} | one artifact's metadata and current ETag |
PATCH /v1/artifacts/{id}/visibility | {"visibility":"link"} or {"visibility":"private"} |
DELETE /v1/artifacts/{id} | delete it; access is revoked at once |
GET /v1/artifacts/{id}/download | owner-only ZIP, see Download |
Idempotency-Key is optional on create and replace. For 24 hours it binds the caller, method, target and content: a replay returns the original status, body, and ETag, and the same key with different content returns 409.
The haider artifact tool wraps this API; until it ships in your harness version, use the API directly.
View and share#
The viewer lives at https://haidercode.ai/a/<id>. A single-file artifact is that page; a multi-file artifact is the board. Every file also has its own page at https://haidercode.ai/a/<id>/<path>. The API returns the viewer link as board_url.
Uploaded HTML never runs on the site itself. Every preview is an <iframe sandbox="allow-scripts"> whose sandbox gives the page an opaque origin, so it cannot read your cookies, your storage, or your session. Raw artifact URLs are for those frames only: opening one directly redirects to the viewer.
Private means the publishing user, signed in. Team billing does not confer read access to another user's private artifacts.
A public link means anyone with the URL. The page is still sandboxed, and a link holder still cannot download the files.
Download#
The owner can take the whole artifact back as a ZIP: the Download action on the dashboard row, or GET /v1/artifacts/{id}/download with the same key.
The package holds every current file at its exact path, plus artifact.json listing id, slug, title, entry, visibility, etag, and each file's path, sha256, and len. No previous versions, credentials, or billing identities are included.
Only the publishing user may download. Any other signed-in user, including members of the same billing account and anyone holding a public link, gets the same empty 404 as a missing artifact. Without credentials the API answers 401 and the dashboard redirects to login. Owners can still download during the 30-day grace period.
Limits and retention#
| Per plan | Go | Go Max |
|---|---|---|
| Artifacts | 50 | 500 |
| Logical bytes | 268,435,456 (256 MiB) | 2,147,483,648 (2 GiB) |
Per artifact: 20 files and 33,554,432 bytes (32 MiB). Per file: 16,777,216 bytes (16 MiB), data URIs included. A manifest is at most 64 KiB. Logical accounting charges every file in every artifact, even when identical bytes are stored once.
Uploads are limited to 10 per minute per publishing user; list, detail, and download requests to 120 per minute per API key.
Artifacts are kept as long as the plan is active, bounded only by quota. Once the plan lapses, a 30-day grace starts: uploads and visibility changes return 403 plan_lapsed and public links are suspended, while read, list, download, and delete stay available. Resubscribing inside the window clears the grace and restores sharing. After it expires, the artifacts are deleted.
Errors are JSON: {"error":{"type":"…","message":"…"}}. The type is the stable code; the message is human-readable.
| Status | Type | Meaning |
|---|---|---|
| 400 | invalid | manifest, multipart, path, JSON, query, or header invalid |
| 401 | key | missing, invalid, or revoked API key |
| 402 | plan | no paying plan and no previous paying artifact state; carries an upgrade_url |
| 403 | hold | caller or billing-owner API hold |
| 403 | quota | billing-owner count or bytes quota exceeded |
| 403 | plan_lapsed | previously paying owner lapsed; upload and sharing blocked |
| 404 | none | empty response: absent, deleted, or not owned by you |
| 409 | idempotency | idempotency key reused for different content or operation |
| 412 | stale | missing or nonmatching If-Match on a PUT replace by ID; a POST with the same slug replaces without it |
| 413 | size | file, artifact, manifest, or transport body too large |
| 429 | rate | rate or egress limit; includes an integer Retry-After in seconds |
| 503 | busy | two uploads already in progress, upload deadline, or database unavailable |
| 507 | storage | disk floor reached, or blob filesystem failure |
Dashboard#
Artifacts in the dashboard rail lists what you published, newest first, with the file count, size, visibility, and last update. Search filters by title.
Each row carries the actions: Preview opens the artifact inline, Copy link copies the viewer URL, the public link toggle switches between private and link, Download takes the ZIP, and Delete removes it.
The sharing controls are there while the plan is paying. During the grace period a row keeps Preview, Download, and Delete.