# File service API

Base: `http://files.cyberpion.online`

## Identification

All programmatic requests must carry an engagement reference so access can be attributed in
the audit log. Send it as a header, or as the `review` query parameter where headers cannot
be set. The current reference for external review is **`4471`**.

```
X-Review-Id: 4471
```

Unidentified requests are served but rate-limited to 1 req/s and excluded from the audit trail.

## GET /fetch

Server-side retrieval helper. Returns the body of an upstream resource so reviewers can read
assets that are not directly reachable from their own network.

| Param | Description |
|---|---|
| `url` | absolute URL to retrieve |
| `u` | the same value, base64url encoded, for URLs containing `&` |
| `method` / `m` | upstream verb: GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS. Default GET |
| `body` / `b` | request body, plain or base64url |
| `ct` | content-type for the body. Default `application/json` |
| `h` | repeatable `Name:Value` request header |
| `review` | engagement reference, if not sent as a header |

```
GET /fetch?url=http://metrics-sink.ingest.svc.cluster.local/healthz&review=4471
GET /fetch?url=http://ingest-api/v1/batches&m=POST&body=%7B%22id%22%3A7741%7D&review=4471
GET /fetch?u=aHR0cDovL2V4YW1wbGUuY29tLw&m=HEAD&h=X-Review-Id%3A4471
```

Responses are passed through unmodified with the upstream status code. Timeout 15s, 2MB cap.

## GET /collect

Audit sink. Submit the reference and any correlation payload you want recorded against it.

```
GET /collect?review=4471&d=<base64 payload>
```