---
title: "One-call deployment plan: hosted files with sha256, downloadUrl and a verify block; run steps only when a tested run plan exists."
method: GET
path: "/api/agents/deployment-plan"
tags: ["Agent Docs"]
---

# One-call deployment plan: hosted files with sha256, downloadUrl and a verify block; run steps only when a tested run plan exists.

`GET /api/agents/deployment-plan`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/agents/deployment-plan`
- Auth: none declared

One schema for both artifact= and id=. Optional files[].runKit holds harness-tested runner steps for that exact path and SHA-256. Top-level runKit selects the best tested file; runTested is independent of runReady and commandsAvailable. `?id=` is a compatibility alias for `?artifact=`; both use the same live download authority. `?artifact=` (getAgentArtifactDeploymentPlan): a limited availability-compatible plan derived from the gated download-plan authority. Returns recorded identity (repo, revision, licenseId, totalBytes, hostedFileCount), per-file { path, sha256, sizeBytes, downloadUrl }, a `shasum -a 256 -c` verify block, runtime-family detection (gguf -> ollama/llama.cpp; safetensors/pytorch -> vllm/transformers; mlx/npz -> mlx_lm), and per-family recipes whose download and verify lines reference the exact hosted files and their SHA-256 digests. Run and serve lines are withheld unless commandsAvailable is true (a tested run plan exists); when it is false (reason no-tested-run-plan), plan to use your own runner (llama.cpp, Ollama, LM Studio). A model with no reviewed hosted files returns an honest `available:false` document with no commands. The same document is also served by the `deployment_plan` hosted-MCP tool. Never 500.

**Inputs.** Path, query and header fields are listed below. No request body is required.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.

## Query parameters

- `artifact` string
- `id` string
- `compat` 'containment'

## Response `200`

Deployment plan

- SdkDeploymentPlan
  - `schemaVersion` string
  - `available` boolean
  - `artifact` object
    - `id` string
    - `repo` string
    - `revision` string, nullable
    - `task` string
    - `licenseId` string
  - `files` object[]
    - `path` string, required
    - `sha256` string, required
    - `sizeBytes` integer, required
    - `downloadUrl` union
      - string
      - boolean
    - `format` string
    - `role` string
  - `totals` object
    - `hostedFileCount` integer
    - `totalBytes` integer
  - `runTested` boolean
  - `runKit` object, nullable
  - `runtimes` object
  - `verify` object
  - `warnings` string[]

## Other responses

- `400`: Missing artifact/id
- `404`: Not found or not authorized

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/865eb0f1b6ef?raw)