# `GET /vfs/{*path}`

Protected. Requires a valid session cookie (`credentials: 'include'`).

Get a virtual filesystem file

Returns a file the model produced in the `javascript_execute` sandbox
(virtual filesystem), for the authenticated user's selected company.

Embed the returned URL in chat markdown to display a generated image:
`![title](/api/vfs/example.png)`.     *
Images are ALWAYS returned as a preview: scaled to fit inside a 250x250 box with the
aspect ratio preserved (never stretched), and anything smaller than 100 px on its larger
edge is upscaled to 100 px. The preview carries a translucent strip along the bottom
edge listing the ORIGINAL width, height, file size, MIME type and filename.     *
Only image MIME types the sandbox produces are rendered inline; every other file
type is sent with `Content-Disposition: attachment` so it downloads rather than
being interpreted as a document in the app's origin.


## Path parameters

| Param | Required | Type | Description |
|-------|----------|------|-------------|
| `path` | yes | string | VFS file path (e.g. `example.png`, `labels/a.png`) |

## Query parameters

| Param | Required | Type | Description |
|-------|----------|------|-------------|
| `download` | no | boolean | Return the original, unmodified file instead of the standard preview.
Without this parameter images are always served as a 250x250 aspect-preserving
preview with a metadata strip. Ignored for non-image files, which are always
served as-is.
 |

## Response `200`

File bytes

## Errors

| Status | Description |
|--------|-------------|
| 400 | Invalid path, or no company selected — `{"error":"…"}` |
| 401 | Unauthorized — `{"error":"…"}` |
| 403 | Not authorized — `{"error":"…"}` |
| 404 | File not found — `{"error":"…"}` |

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._