---
title: "List uploaded files for a session"
method: GET
path: "/api/session/{uid}/files"
tags: ["Hide", "Reveal"]
---

# List uploaded files for a session

`GET /api/session/{uid}/files`

## Request

- Base URL: `https://snapwonders.com`
- URL: `https://snapwonders.com/api/session/{uid}/files`
- Auth: API key in header `X-Api-Key`

Returns all files currently attached to a session. Use this to verify that all uploads have completed (status `complete`) and that each file is on the correct step before calling `POST /api/job`. **Authentication:** `X-Api-Key` header required.

## Path parameters

- `uid` string, uuid, required

## Response `200`

File list

- object
  - `upload_uid` string, uuid
  - `type` 'hide' | 'reveal'
  - `session_status` string
  - `files` object[]
    - `step` integer: 1 = secret/content to hide; 2 = cover image (hide sessions only)
    - `name` string
    - `mime_type` string
    - `file_size` integer: File size in bytes
    - `status` 'pending' | 'completed' | 'failed' | 'staged': pending: upload in progress; complete: ready for job; staged: job already started

## Other responses

- `401`: Not authenticated. `error` names the exact cause: `missing_api_key`, `malformed_api_key`, `invalid_api_key` (key unknown/revoked/expired), or — when the key itself is valid — `account_not_verified` / `account_inactive`.
- `404`: Session not found
- `410`: Session expired — sessions are valid for 24 hours from creation

---

[API](https://skmtc.dev/snapwonders/apis/snapwonders-api-mcp.md) · [All operations](https://skmtc.dev/snapwonders/apis/snapwonders-api-mcp/llms.txt) · [OpenAPI document](https://skmtc.dev/snapwonders/apis/snapwonders-api-mcp/revisions/645bbccc9550?raw)