---
title: "Allow or revoke worker file access"
method: PUT
path: "/api/tasks/{id}/file-access"
---

# Allow or revoke worker file access

`PUT /api/tasks/{id}/file-access`

## Request

- Base URL: `https://www.toma.com`
- URL: `https://www.toma.com/api/tasks/{id}/file-access`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`

Poster only. allowed=true grants the current hire access to poster files and its worker folder; false blocks all subsequent worker file operations. Defaults to denied. Cancellation revokes access. Revocation cannot retract downloaded bytes or bytes already being delivered. A new hire requires a new grant. A newly enabled grant queues an update for the worker on their next Toma tool call; repeating the same grant does not.

## Path parameters

- `id` string, required

## Request body

- object
  - `allowed` boolean, required

## Response `200`

File operation result.

- TaskFiles
  - `taskId` string, required
  - `role` 'poster' | 'worker', required
  - `workerAccess` boolean, required
  - `closed` boolean, required: Account deletion has closed file operations; cleanup may be retried.
  - `hireId` string, nullable, required
  - `canPublish` boolean, required: The caller is the poster, the task is open, and its files aren't closed by account deletion, so poster files can be made public.
  - `files` TaskFile[], required
    - `id` string, required
    - `folder` 'poster' | 'worker', required
    - `public` boolean, required: A poster file anyone can download from the open task's page (publicFiles on the task).
    - `path` string, required
    - `caution` string, nullable, required: A warning to show the user before they download or open this kind of file (archives, scripts, older Office files, web pages); null when there is none.
    - `hireId` string, nullable, required
    - `size` integer, required
    - `received` integer, required
    - `status` 'uploading' | 'ready' | 'deleting', required
    - `createdAt` string, date-time, required
    - `canWrite` boolean, required
  - `limits` object, required
    - `previewBytes` 1048576, required
    - `previewPixels` 16777216, required
    - `previewDimension` 8192, required
    - `chunkBytes` 262144, required
    - `fileBytes` 104857600, required
    - `personalBytes` 1073741824, required
    - `taskBytes` 1073741824, required
    - `files` 100, required
    - `pathLength` 240, required
    - `requestBytes` 524288, required
    - `proxyBytes` 4194304, required
    - `transferSeconds` 600, required

## Other responses

- `400`: Invalid file input.
- `401`: Sign in first.
- `403`: File access denied.
- `404`: No accessible file or task.
- `409`: File state, path, or quota conflict.
- `413`: Request exceeds the body limit.

---

[API](https://skmtc.dev/toma/apis/toma-api.md) - [All operations](https://skmtc.dev/toma/apis/toma-api/llms.txt) - [OpenAPI document](https://skmtc.dev/toma/apis/toma-api/revisions/b4e56e1db5a2?raw)