# List artifacts

Every artifact across the team’s spaces, projected from their `artifacts/*.tsx` source files.

GET `/v1/artifacts`

## Authorization

`Authorization: Bearer <key>` with the Space key (`sfc_` prefix) of an unclaimed Space. The same key is the fragment of the claim URL and the token in the Space's `/_/<key>` sign-in URL.

or

`Authorization: Bearer <token>` with an API key (`sfa_` prefix), an OAuth access token, a session token, or a Space machine credential (`sfm_` prefix).

or

`Authorization` OAuth2 access token · headerrequired

OAuth 2.0 with Spacefast scopes. People use the authorization code flow; machines use client credentials.

### Scopes: `connectors:read`

## Query parameters

- `limit` integer required
  - min 1 · max 100 · default: 20
- `cursor` string
  - min length 1 · max length 4096
- `space` string
  - min length 1
- `query` string
  - min length 1 · max length 200
- `team` string
  - min length 1

## Responses

### 200 Response for status 200

- `$schema` string <uri>
  - Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
- `data` object[] required

Array of `object`

- `ref` string required
  - Artifact address: `<spaceId>:<path>`. The only way to name an artifact.
  - min length 3 · max length 1024 · matches ^[^:]+:[^:].*$
- `spaceId` string required
  - Space holding the source file. Read-only projection of `ref`.
- `path` string required
  - Path within the space's source, e.g. `artifacts/burndown.tsx`. Read-only projection of `ref`.
- `slug` string required
  - Short name derived from the file name. Unique within its space.
- `title` string required
  - Title declared in the file's front-matter.
- `description` string | any required
  - Description declared in the file's front-matter.
- `owner` string required
  - `personal` when the file lives under `artifacts/personal/<user>/`. A visibility convention, not a storage boundary.
  - Allowed: `team`, `personal`
- `bindings` object required
  - Role name to connection id. Code writes roles, never accounts — sharing an artifact is a rebind, not a rewrite.
- `commitSha` string required
  - Commit the projection was read at. Everything here is true as of this commit.
- `previewUrl` string | any required
  - Rendered snapshot for this commit; null until one has been captured.
- `updatedAt` string <date-time> required
  - When the commit landed.

### pagination object required

- `nextCursor` string | any required
  - Opaque cursor for the next page; null when there are no more results.
- `hasMore` boolean required
  - Whether another page exists after this one.
  - default Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.