# Custodian authority files

Files uploaded as proof of access for a custodian authority. Files
cannot be deleted — once uploaded, they're immutable.

## Endpoints

GET /v2/custodian-authorities/:id/files
  List files uploaded for the authority.

POST /v2/custodian-authorities/:id/files
  Upload a new file. Multipart form upload — the schema is not the
  usual JSON:API envelope.

## Path params

  id (required) — Custodian-authority identifier (UUID).

## Attributes (`type: custodian-authority-file`)

  hash       (string)            — Content hash, algorithm-prefixed,
                                    e.g. "sha2-256:7d865e...".
                                    For the consent JWT, strip the
                                    "<algorithm>:" prefix and use the
                                    remaining hex as the hash claim.
  name       (string)            — Logical role, e.g. "power-of-attorney",
                                    "consent". Matches one of the auth
                                    flow's `expectedFiles`.
  uploadedAt (string, ISO 8601)  — UTC timestamp of upload.
  filename   (string)            — Original filename as uploaded.