# Site source

Most writes to a site's tree are a git push. Read
[Site source](/concepts/source) for the two repositories and the rules
about what may go where.

These calls are for the files a push cannot carry: a picture the agent
already holds, a stock photo, and a file the owner has on their own
machine.

## List and read

| Call | What it does |
|---|---|
| `GET /v1/sites/{id}/assets` | lists the files that arrived this way |
| `GET /v1/sites/{id}/assets/{path}` | reads one back |

A listing is needed because git holds a pointer to where a picture is, not
the picture. No listing of the source tree can report one.

## Write a file the agent holds

`PUT /v1/sites/{id}/assets/{path}` writes one file.

The path decides what is allowed. `src/assets` takes what the build's
toolchain can read; `public/` takes a shorter list, today `.pdf` alone.

## Add a stock photo

`POST /v1/sites/{id}/photos` takes the id from `POST /v1/photos/search`
and a path under `src/assets/`.

## Give the owner an upload link

`POST /v1/sites/{id}/uploads` mints a link the owner opens in a browser
and drops a file on.

The link is bound by four things at once:

- one site;
- an expiry;
- a number of files;
- a byte cap for each file.

Clave reads the file's type from its bytes, not from its name, because the
name is chosen by whoever uploads.

The link needs no token, so it travels over chat safely. Treat it as a
credential anyway: whoever holds it can write into that site.

## One allowance

All three ways share one daily allowance. `GET /v1/account` reports it.

---

## Where this page sits

This is one page of the Clave documentation.
Read it as a web page at https://docs.heyclave.party/api/source.
Every page has a `.md` address, and https://docs.heyclave.party/llms.txt lists them all.

- Previous: [Sites](https://docs.heyclave.party/api/sites.md)
- Next: [Deployments](https://docs.heyclave.party/api/deployments.md)
- Index: [Overview](https://docs.heyclave.party/index.md)