> ## Documentation Index > Fetch the complete documentation index at: https://docs.praxis-ai.com/llms.txt > Use this file to discover all available pages before exploring further. # Get a short-lived link to a file > Answers a signed address for one file of the vault. The address can be opened without a session until it expires. Name the file by `filename` (a file of the caller) or by `path` (`/uploads//`; a file of another person must be one the caller may read). Asking for a link counts as a use of the file — it restarts the file's "keep if unused" period — unless `purpose` is `preview`: a link for showing the file in a preview counts nothing, and its address ends with `preview=1`. ## OpenAPI ````yaml /mdx/api-reference/runtime/runtime-api.json post /api/user/upload-token openapi: 3.0.0 info: title: Pria Runtime API version: 2.0.236 description: >- Pria API Documentation Praxis's developer platform is a core part of our mission to empower organizations to grow better. Our APIs are designed to enable teams of any shape or size to build robust integrations that help them customize and get the most value out of Pria. All Pria APIs are built using REST conventions and designed to have a predictable URL structure.

They use many standard HTTP features, including methods (POST, GET, PUT, DELETE) and error response codes.

All API calls are made under https://hiimpria.ai/api and all responses return standard JSON. In these docs, you'll find lists of all available endpoints for a given API, along with interactive code blocks for building requests. For walkthroughs of basic usage for these APIs, check out the API guides.

A session that a course page (Canvas) opened for an administrator — or that a Digital Twin's sign-in provider opened for one of its people — starts with user rights in that twin only: until the person confirms it's them with a code (POST /api/user/launch-scope/challenge, then /api/auth/mfa-resend and /api/auth/mfa-verify), every route outside that twin's day-to-day work answers 403 with code LAUNCH_SCOPE_STEP_UP and the twin's id. servers: - url: https://pria.praxislxp.com description: Pria API Server security: [] tags: - name: Authentication description: User authentication, registration, and password management (/api/auth) - name: OAuth description: OAuth authentication providers - Google, GitHub, SSO (/api/auth/oauth) - name: User description: User profile management and account operations (/api/user) - name: User Institutions description: User institution memberships and switching (/api/user/institution) - name: User Tools description: Available tools for authenticated users (/api/user/tools) - name: Institutions description: Institution settings and configuration (/api/user/institution) - name: Conversation description: AI conversation and Q&A endpoints (/api/ai) - name: Realtime description: Real-time voice AI and WebRTC sessions (/api/ai/rt) - name: Assistant description: AI assistant configuration and management (/api/user/assistant) - name: History description: Conversation history and favorites (/api/user/history) - name: RAG description: >- Document upload, embedding, and retrieval-augmented generation (/api/user/files, /api/user/rag) - name: Setting description: Instance variables and settings management (/api/user/setting) - name: Branding description: Digital twin branding and customization (/api/agent/branding) - name: Agent description: Agent engagement and session management (/api/agent) - name: SDK Launch description: >- SDK launch token signing and verification for secure iframe embedding (/api/auth/sdk-sign, /api/auth/sdk-verify) - name: Testing description: Health checks, diagnostics, and test endpoints (/api/test) - name: Admin Accounts description: Account management for super admins (/api/admin/account) - name: Admin Institutions description: Institution management for admins (/api/admin/institution) - name: Admin Users description: User management for admins (/api/admin/user) - name: Admin Entitlements description: >- User-institution relationships and permissions (/api/admin/userInstitution) - name: Admin Sessions description: Session management for admins (/api/admin/session) - name: Admin Histories description: Conversation history management and analytics (/api/admin/history) - name: Admin Assistants description: AI assistant management for admins (/api/admin/assistant) - name: Admin Questions description: Institution question and prompt management (/api/admin/question) - name: Admin Tools description: Tool configuration management (/api/admin/tool) - name: Admin AI Models description: AI model configuration (/api/admin/aimodel) - name: Admin MCP Servers description: Model Context Protocol server management (/api/admin/mcpserver) - name: Admin Feedbacks description: User feedback management (/api/admin/feedback) - name: Admin Uploads description: Upload management (/api/admin/upload) - name: Admin Charts description: Analytics and visualization chart management (/api/admin/chart) - name: Audio Notes description: Capture and ingest spoken notes into the personal vault - name: Memory description: User-facing memory parameters (personal + shared instance memory). - name: My Data description: >- GDPR controls — personal-scope counts, async ZIP-by-email export, and scoped soft-delete. Every endpoint pins `user = req.user._id` AND `institution: null`; institution-scoped data is governed by the institution's own retention policy and never reached from here. - name: Questions description: >- User-facing read of the onboarding question bank used by the "create a digital twin" wizard. - name: Transcription description: >- One-shot speech-to-text for in-place dictation. Audio blob in, transcript out — no Upload / History / RAG embeddings are persisted. Use `/audio-notes` for anything durable. paths: /api/user/upload-token: post: tags: - User Files summary: Get a short-lived link to a file description: > Answers a signed address for one file of the vault. The address can be opened without a session until it expires. Name the file by `filename` (a file of the caller) or by `path` (`/uploads//`; a file of another person must be one the caller may read). Asking for a link counts as a use of the file — it restarts the file's "keep if unused" period — unless `purpose` is `preview`: a link for showing the file in a preview counts nothing, and its address ends with `preview=1`. requestBody: required: true content: application/json: schema: type: object properties: filename: type: string description: >- The stored name of one of the caller's files (no folder separators). Give this or `path`. path: type: string description: >- The file's path, `/uploads//`. Give this or `filename`. ttl: type: integer default: 60 minimum: 10 maximum: 86400 description: How long the link works, in seconds. purpose: type: string enum: - preview description: >- `preview` when the link is only used to show the file in a preview. Such a link is not counted as a use of the file. Leave it out for a download or a link to share. responses: '200': description: The signed address content: application/json: schema: type: object properties: success: type: boolean signedUrl: type: string description: >- The path with its signature — add it to the site address to open the file. hmac: type: string expires: type: integer path: type: string '400': description: Neither `filename` nor `path` was given, or one of them is malformed '401': description: Authentication required '403': description: The path names a file the caller may not read security: - apiKeyAuth: [] components: securitySchemes: apiKeyAuth: type: apiKey in: header name: x-access-token description: JWT token passed in x-access-token header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.