# listDealFiles

Files attached to a deal, most-recent-first: screenshots, recordings, documents. Each entry carries id, fileName, contentType-bearing fileUrl and createdAt. fileUrl is a time-limited signed HTTPS URL: fetch it promptly and do not persist or share it, and re-read this op rather than caching the URL. Each URL is signed per file, so the page is small (limit defaults to 25 and is capped there): a full page means there may be more, so page with offset. This is the ONLY way to reach an attachment's bytes: a Slack-sourced deal records its attachments as a bare filename at the end of the description (`Attachments: Screenshot ….png`), which names the file but cannot open it. To ADD a file your org already holds (by its artifactId), use attachDealFile; to detach one, removeDealFile. Returns an empty list for a deal with no files, which is different from a deal you cannot see: a foreign or unknown dealId is refused at the gateway.

- Call: `POST https://server.goliathdata.com/api/v1/call` with `{ "operationId": "listDealFiles", "variables": {...} }`
- Scope: `READ`
- Type: query
- Idempotency: a read; rejects `Idempotency-Key`
- Rate-limited: no
- Result cap: `limit` is clamped to 25, without an error

## Variables

- `dealId`: `ID!` (required)
- `limit`: `Int` (default `25`)
- `offset`: `Int`

## Response (data, an example)

```json
{
  "dealQuery": {
    "getDeal": {
      "id": "<ID>",
      "files": [
        {
          "id": "<ID>",
          "fileName": "…",
          "fileUrl": "…",
          "createdAt": "2026-01-01T00:00:00.000Z"
        }
      ]
    }
  }
}
```

## Example

```bash
curl https://server.goliathdata.com/api/v1/call \
  -H "Authorization: Bearer $GOLIATH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "operationId": "listDealFiles",
    "variables": {
      "dealId": "<dealId>"
    }
  }'
```