Artifact Contract (DropBoxMini)

Status

Authoritative as of baseline 0018

Base URL

https://cp.sinnedtrebor.com

Endpoints

Method	Path	Description
GET	/api/dropbox/status	Service status
GET	/api/dropbox/artifacts	List artifacts
GET	/api/dropbox/artifacts/{artifactId}	Get artifact metadata
GET	/api/dropbox/artifacts/{artifactId}/download	Download artifact
POST	/api/dropbox/upload	Upload artifact

Authentication

All requests require:

X-API-Key: <key>

Roles

The service supports role-based keys loaded from DROPBOX_API_KEYS_JSON.

Example:

{
  "keys": [
    { "value": "key-read-xxx", "role": "read", "maxArtifactAgeHours": 0 },
    { "value": "key-rw-xxx", "role": "readwrite", "maxArtifactAgeHours": 0 },
    { "value": "key-agent-xxx", "role": "agent", "maxArtifactAgeHours": 24 }
  ]
}

Role behavior

Role	Read	Upload	Age restricted
read	yes	no	no
readwrite	yes	yes	no
agent	yes	yes	yes, based on `maxArtifactAgeHours`

For agent, the age window applies to read operations only. Upload is allowed.

Upload Endpoint

POST /api/dropbox/upload

Content-Type

multipart/form-data

Required Fields

artifactType
project
file

Optional Fields

baseline
patch
label
description
tags
source
createdBy

Supported Artifact Types

delivery-patch
screenshot
test-result
evidence-bundle
generic

Validation (Observed and Implemented)

delivery-patch

Requires zip
Requires numeric baseline
Requires numeric patch
Baseline must match current service baseline
Patch must be unique

screenshot

Accepts png (non-zip)
baseline optional
patch optional

Non-delivery artifact types

baseline optional
patch optional
if provided, baseline and patch must be numeric identifiers

Notes

POST is not supported on /api/dropbox/artifacts
Uploads must use /api/dropbox/upload
agent reads are filtered or denied for artifacts older than the configured age window
Legacy DROPBOX_SHARED_KEY is still supported as a readwrite fallback when DROPBOX_API_KEYS_JSON is not configured