# listPipelineItemFiles

Files attached to a pipeline item, most-recent-first: screenshots, recordings, documents. Each entry carries id, fileName, contentType-bearing fileUrl and createdAt. fileUrl is a time-limited signed HTTPS URL: fetch it promptly and do not persist or share it, and re-read this op rather than caching the URL. Each URL is signed per file, so the page is small (limit defaults to 25 and is capped there): a full page means there may be more, so page with offset. This is the ONLY way to reach an attachment's bytes: a Slack-sourced pipeline item records its attachments as a bare filename at the end of the description (`Attachments: Screenshot ….png`), which names the file but cannot open it. To ADD a file your org already holds (by its artifactId), use attachPipelineItemFile; to detach one, removePipelineItemFile. Returns an empty list for a pipeline item with no files, which is different from a pipeline item you cannot see: a foreign or unknown pipelineItemId is refused at the gateway.

- Call: `POST https://server.goliathdata.com/api/v1/call` with `{ "operationId": "listPipelineItemFiles", "variables": {...} }`
- Scope: `READ`
- Type: query
- Idempotency: a read; rejects `Idempotency-Key`
- Rate-limited: no
- Result cap: `limit` is clamped to 25, without an error

## Variables

- `pipelineItemId`: `ID!` (required)
- `limit`: `Int` (default `25`)
- `offset`: `Int`

## Response (data, an example)

```json
{
  "pipelineItemQuery": {
    "getPipelineItem": {
      "id": "<ID>",
      "files": [
        {
          "id": "<ID>",
          "fileName": "…",
          "fileUrl": "…",
          "createdAt": "2026-01-01T00:00:00.000Z"
        }
      ]
    }
  }
}
```

## Example

```bash
curl https://server.goliathdata.com/api/v1/call \
  -H "Authorization: Bearer $GOLIATH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "operationId": "listPipelineItemFiles",
    "variables": {
      "pipelineItemId": "<pipelineItemId>"
    }
  }'
```