Develop / Reference

Files & Skills

Forwards file and skill calls to the provider unchanged and determines which provider receives them.

POST /v1/files
Family
pass-through
Shield
no
Streaming
no
Format
as at the provider, upload as multipart/form-data
Billing
none

Requirements

Files and skills work only if admins of your organisation have turned on Allow file and image attachments in requests under Models → Shield (Advanced Settings). Otherwise, the gateway answers with 403 file_content_not_allowed.

Because /v1/files and /v1/skills are not inspected by Noirdoc Shield, the gateway rejects content-carrying calls when the enforced policy is active or the request sends X-Noirdoc-Mask: on (fail-closed). This affects all methods except GET, HEAD, OPTIONS and DELETE, for example uploading a file and creating a skill or a version. The gateway then answers with 403 masking_not_supported_for_endpoint. Listing, retrieving, downloading and deleting remain allowed.

Select the provider

These calls carry no model. The gateway therefore first determines the API format and then forwards the call to the oldest active provider of this format. Providers that your organisation has connected itself (BYOK) take precedence. Claude through Google Vertex is not eligible for this.

EndpointAPI format
/v1/files with x-api-keyAnthropic
/v1/files with Authorization: Bearer or api-keyOpenAI
/v1/files with the header X-Provider: anthropic or X-Provider: openai (lowercase)the one specified, regardless of the key header
/v1/skillsalways Anthropic, X-Provider has no effect

X-Provider selects only the format. The restrictions of your key and your organisation still apply. If no provider is set up for the format, the gateway answers with 502 provider_not_configured.

The Anthropic SDK sends the key as x-api-key. The gateway then forwards the call to an Anthropic provider. The OpenAI SDK sends Authorization: Bearer and ends up at a provider in the OpenAI format.

If an Anthropic client uses Authorization: Bearer, set X-Provider: anthropic.

Shell
curl https://api.noirdoc.de/v1/files \
  -H "Authorization: Bearer $NOIRDOC_API_KEY" \
  -H "X-Provider: anthropic" \
  -F file=@contract.pdf
Python
import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.noirdoc.de/v1",
    api_key=os.environ["NOIRDOC_API_KEY"],
)

with open("contract.pdf", "rb") as f:
    uploaded = client.files.create(file=f, purpose="user_data")
print(uploaded.id)
TypeScript
import fs from "node:fs";
import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.noirdoc.de/v1",
  apiKey: process.env.NOIRDOC_API_KEY,
});

const uploaded = await client.files.create({
  file: fs.createReadStream("contract.pdf"),
  purpose: "user_data",
});
console.log(uploaded.id);

What Noirdoc changes

AreaBehaviour
Body and responseThe gateway forwards body, Content-Type and query parameters unchanged. It returns the provider’s response unchanged, except for errors, generated files and filtered lists (see below). The gateway reports errors in the uniform error object, see Error codes.
Beta headerWith Anthropic, the gateway adds files-api-2025-04-14 for files and skills-2025-10-02 for skills to anthropic-beta. Your own values are kept.
Generated filesUnder Noirdoc Shield, placeholders ([PERSON]) are one-way and files downloaded through /v1/files/{id}/content are returned unchanged. Re-identifying placeholders in generated text, CSV, Markdown, HTML, JSON, DOCX and XLSX files applies only to pre-existing organisations on legacy masking until 30.11.2026, as long as the mapping is stored.
Response headersX-Noirdoc-Provider and X-Noirdoc-Shield are absent on successful file and skill calls. Provider errors carry X-Noirdoc-Provider. Provider responses carry X-Noirdoc-Masked: false.

Providers managed by Noirdoc

These providers use one shared account for all organisations. The gateway therefore separates the objects itself:

  • Uploading and listing are allowed. A list contains only your organisation’s objects and Anthropic’s prebuilt skills. A list page can therefore contain fewer entries than limit.
  • Calls with {id} reach only objects that were created through your organisation. For all other IDs, the gateway answers with 404 object_not_found.
  • The gateway rejects other methods on /v1/files and /v1/skills with 403 endpoint_not_available_on_platform.
  • If the gateway cannot check or cannot store which organisation an object belongs to, it answers with 503 ownership_check_unavailable.

With your own provider key (BYOK), these restrictions do not apply.

Sub-routes

MethodPathPurpose
POST/v1/filesupload a file
GET/v1/fileslist files
GET/v1/files/{id}retrieve a file’s metadata
DELETE/v1/files/{id}delete a file
GET/v1/files/{id}/contentdownload a file’s content
as at Anthropic/v1/skillscreate and list skills
as at Anthropic/v1/skills/{id}a skill
as at Anthropic/v1/skills/{id}/versionsthe versions of a skill
as at Anthropic/v1/skills/{id}/versions/{version}one version of a skill

The gateway answers other paths under /v1/files/ and /v1/skills/ with 404 unsupported_endpoint.

Anthropic determines which methods the skills paths accept. See Anthropic’s Skills reference.

Errors on these endpoints

Status Code Meaning
402 insufficient_credit The organisation's credit is used up or lower than the estimated maximum cost of the request (including Noirdoc Shield, also on BYOK routes when Shield is active).
403 endpoint_not_available_on_platform The call would read data from the shared account of a provider managed by Noirdoc and is blocked there.
403 provider_not_allowed_for_tenant The organisation counts as bound by professional secrecy (§ 203 StGB); this excludes every provider that offers this model.
403 provider_not_allowed_for_key The key's restrictions (providers, data residency, CLOUD Act, § 203) exclude every provider of this model.
403 starter_model_not_allowed The organisation is still using only its starter credit, and the model or its managed provider is not included in starter credit.
403 masking_not_supported_for_endpoint The endpoint supports neither Noirdoc Shield nor legacy masking, yet the policy is enforced or the request sends X-Noirdoc-Mask: on (and on /v1/images/generations also X-Noirdoc-Shield: on). During the legacy masking transition until 30.11.2026, this also affects /v1/embeddings and /v1/rerank on pre-existing organisations that have not switched to Shield yet.
403 file_content_not_allowed The request contains files, images or audio, and the organisation does not allow file content.
404 unsupported_endpoint The gateway does not know this path.
404 object_not_found The object (file, skill or stored response) does not exist or does not belong to your organisation.
502 provider_not_configured The organisation has no suitable provider set up for this request.
502 provider_misconfigured The configuration of the selected provider is invalid, for example a base URL that is not allowed.
502 provider_unreachable The gateway could not connect to the provider, or the connection dropped.
503 ownership_check_unavailable The gateway could not check just now whether the object belongs to your organisation and rejected the request. The response contains Retry-After with 5 seconds.
504 provider_timeout The provider did not answer within the gateway's timeout. The response contains Retry-After with 10 seconds.

Provider reference

The providers’ references describe all fields (checked on 30 September 2026):