Claude Files API is GA: review Sume outputs by job id and media URL

If a Claude review loop checks generated media, keep two things per output: the Sume job id and the media.sume.com artifact URL from the job result. The Claude API release notes list the Files API and Agent Skills as out of beta from Aug 19, and cache diagnostics (cache_miss_reason) as generally available from Sep 23.

Whichever way a file reaches the model, the durable record of a Sume generation is the job and its Sume-hosted result.

What each side guarantees

A result worth keeping

A completed job returns artifacts like this one. Store the id and the Sume URL, not any other address you might see in a log.

{
  "id": "job_...",
  "status": "completed",
  "result": {
    "artifacts": [
      {
        "id": "artf_...",
        "url": "https://media.sume.com/artifacts/...",
        "type": "image",
        "content_type": "image/png"
      }
    ]
  }
}

A review loop that does not double-bill

A generate, review, regenerate loop is where cost and confusion creep in, so keep the identifiers straight.

• Read GET /v1/jobs/:id/result only after the job reports result_ready: true; before that it answers 409 job_not_completed.
• Give each regeneration its own Idempotency-Key, and reuse a key only for an exact retry of the same payload.
• Record which job id produced which artifact, so a rejected output can be traced.
• If a review fails, submit a new job; do not try to mutate the old one.

Keeping URLs out of logs

The MCP playbooks tell agents to prefer Sume public ids and media.sume.com URLs in reports, and not to paste signed URLs, OAuth tokens or API keys into chat logs. Safe logs hold request ids, job ids, status and sanitized media metadata.

That rule matters more once outputs travel between a generator and a reviewer, since each hop is another place a link can be copied.

Inputs are different from outputs

When you send media into Sume, input image and video URLs must be fetchable public HTTPS URLs. Localhost, private-network, non-HTTPS and signed or private URLs are rejected before generation is submitted. A file that exists only inside another provider's file store therefore needs a public URL before Sume can use it.