From 78aa7c537e5aab3a686f99629097d852fd5aa76e Mon Sep 17 00:00:00 2001
From: Simon Oberreuter <73888585+soberreu@users.noreply.github.com>
Date: Sat, 21 Mar 2026 20:24:12 +0100
Subject: [PATCH] Fix: POST files/retain uses authentication headers (#636)

Co-authored-by: soberreu <soberreu>
---
 hindsight-control-plane/src/app/api/files/retain/route.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hindsight-control-plane/src/app/api/files/retain/route.ts b/hindsight-control-plane/src/app/api/files/retain/route.ts
index 303ca407..556ada21 100644
--- a/hindsight-control-plane/src/app/api/files/retain/route.ts
+++ b/hindsight-control-plane/src/app/api/files/retain/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { DATAPLANE_URL } from "@/lib/hindsight-client";
+import { DATAPLANE_URL, getDataplaneHeaders } from "@/lib/hindsight-client";
 
 export async function POST(request: NextRequest) {
   try {
@@ -25,6 +25,7 @@ export async function POST(request: NextRequest) {
     // Forward the form data to the dataplane
     const response = await fetch(url, {
       method: "POST",
+      headers: getDataplaneHeaders(),
       body: formData,
       // Don't set Content-Type - let fetch handle multipart boundary
     });