---
title: "Serve Session File"
method: GET
path: "/api/session-file/{chat_id}"
tags: ["Assets"]
---

# Serve Session File

`GET /api/session-file/{chat_id}`

## Request

- Base URL: `https://app.getdot.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.getdot.ai/api/session-file/{chat_id}`
- Auth: none declared

Serve files written by the agent sandbox, with auth + ownership + path validation.

Security layers:
1. Auth: optional, unauthenticated access allowed for public (shared) chats
2. Org access: authenticated users must belong to the org or its parent org
3. Chat ownership: public chats are open; private chats require ownership or admin
4. Path: resolved inside the session, outside its picture store, an allowed extension, then
   opened as a real file inside the session (confined_fs.open_read) and served from that handle
5. MIME denylist: dangerous content types forced to application/octet-stream

## Path parameters

- `chat_id` string, required

## Query parameters

- `path` string, required: Relative path within the session directory
- `org_id` string, required: Organization ID that owns the chat
- `w` integer, nullable: Max width for an image preview; ignored for other files

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/getdot/apis/dot-api-2.md) · [All operations](https://skmtc.dev/getdot/apis/dot-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/getdot/apis/dot-api-2/revisions/d26fe7163a7f?raw)