Upload and download

File bytes move through authenticated HTTP while Trestle keeps provider paths and credentials private.

Multipart upload

curl -X POST "$TRESTLE_URL/api/v1/files" \
  -H "Authorization: Bearer $TRESTLE_TOKEN" \
  -F "file=@report.pdf" \
  -F "collection=issues" \
  -F "recordId=rec_123"

The response contains the generated file ID, content type, size, hash and optional record binding. Preserve the ID, not a guessed filesystem path.

Download and ranges

curl "$TRESTLE_URL/api/v1/files/file_123" \
  -H "Authorization: Bearer $TRESTLE_TOKEN" \
  -H "Range: bytes=0-1048575" --output chunk.bin

Standard byte ranges support media and resumable clients. An unauthenticated request is refused, and invalid or multiple ranges do not trigger unbounded provider reads.