---
title: "List attached files"
method: GET
path: "/api/v2/projects/{projectId}/files"
tags: ["Projects"]
---

# List attached files

`GET /api/v2/projects/{projectId}/files`

## Request

- Base URL: `https://davinci-app.com`
- URL: `https://davinci-app.com/api/v2/projects/{projectId}/files`
- Auth: HTTP bearer

Returns the files attached to a branch from committed branch HEAD. Each
reference is joined to its `assets.primary` descriptor when present, so the
listed filename and size describe the immutable SHA-addressed blob. Older
snapshots without asset metadata retain the legacy files-prefix lookup.

Read from the branch's saved snapshot rather than from the running project,
so it works whether or not the project is open — and so a file attached
since the last save is not listed yet.

A reference whose bytes are missing from storage is listed with a null
`size`, because the object exists and omitting it would hide a half-finished
upload. The reverse does not hold: stored bytes with no reference on this
branch are not listed, since storage is shared across branches and one
branch cannot tell an orphan from another branch's file.

## Query parameters

- `branch` string

## Response `200`

Files attached to the branch.

- ListFilesResponse
  - `files` ProjectFile[], required
    - `objectId` string, required: Id of the reference object. Pass as `fileId` to download or delete.
    - `name` string, required: Display name of the object.
    - `filename` string, required: Stored name from `assets.primary.fileName`, or `{objectId}{fileType}` for a legacy snapshot. This is the `fileName` the data-plane download takes.
    - `fileType` string, required: Extension including the leading dot.
    - `parentId` string, nullable: Object the reference is attached under.
    - `size` integer, nullable, required: Byte size from `assets.primary.byteSize`, or the legacy stored-file size. Null when the reference exists but no size metadata or legacy blob exists.
  - `count` integer, required

## Other responses

- `401`: No credential was supplied, or the supplied credential is malformed, expired, or revoked. A credential that is present but unusable is never downgraded to an anonymous request.
- `403`: Authenticated but not authorized. Either the acting user lacks the required resource permission, the key's scope ceiling excludes it, or the endpoint rejects this credential type (`CREDENTIAL_NOT_PERMITTED`).
- `404`: The resource does not exist in the parent named by the path, or is hidden from the caller. Absence and privacy denial are deliberately indistinguishable so project, organization, and private-team existence cannot be probed.
- `429`: Request rate exceeded, either globally or for this key.
- `500`: Unexpected server error.

## Changes

- **2026-09-15** (v2) `67c8b8616dbb`: 5 info
  - the `success` response property const value `false` was added for the status `401`
  - the `success` response property const value `false` was added for the status `403`
  - the `success` response property const value `false` was added for the status `404`
  - the `success` response property const value `false` was added for the status `429`
  - …1 more
- **2026-09-15** (v2) `48948af37797`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/celedon-solutions/apis/davinci-public-api/changes/api/v2/projects/:projectId/files/get.md)

---

[API](https://skmtc.dev/celedon-solutions/apis/davinci-public-api.md) - [All operations](https://skmtc.dev/celedon-solutions/apis/davinci-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/celedon-solutions/apis/davinci-public-api/revisions/279218ca2e8d?raw)