Azure OpenAI Responses API: image file_id fails with “Error while downloading file” in Foundry private BYO-storage setup

I’m investigating an image-input failure when calling the gpt-6-luna deployment through a Microsoft Foundry project endpoint.

The image uploads successfully through the project-scoped Files API with purpose="assistants". However, referencing the returned ID in a Responses request fails with HTTP 400:

{

  "error": {

    "message": "Error while downloading file.",

    "type": "invalid_request_error",

    "param": "url",

    "code": "invalid_value"

  }

}

Environment

• Foundry Standard setup with customer-managed Storage, Cosmos DB, and Azure AI Search.
• Agent network injection into a customer VNet.
• Storage public network access disabled; approved blob private endpoint.
• Foundry and Search public access enabled with IP restrictions.
• All required service endpoints resolve to private IPs through the VNet’s configured DNS server when tested from our machine.
• Project managed identity has Storage Account Contributor, Storage Blob Data Contributor, and a conditional Storage Blob Data Owner assignment.
• Microsoft Entra ID authentication.

Reproduction

Using the same project-scoped OpenAI client for upload and inference:

with open("image.png", "rb") as image:

    uploaded = client.files.create(

        file=image,

        purpose="assistants",

    )

response = client.responses.create(

    model="gpt-6-luna",

    store=False,

    input=[{

        "role": "user",

        "content": [

            {"type": "input_text", "text": "Describe this image."},

            {"type": "input_image", "file_id": uploaded.id},

        ],

    }],

)

The endpoint is:

https://<account>.services.ai.azure.com/api/projects/<project>/openai/v1/

No agent reference, tools, or existing conversation is involved.

Checks Already Completed

• Files API upload succeeds for the 73,298-byte PNG.
• File metadata retrieval and content download succeeded for an earlier equivalent upload; downloaded bytes have a valid PNG signature.
• The same image submitted as inline base64 through input_image.image_url succeeds.
• The file-ID failure reproduces in both our C# application and a standalone Python script.
• Adding Storage Account Contributor did not resolve the issue.
• Blob diagnostics show a successful read by Foundry’s file service using the project identity. We have not established whether the failing image-processing request reaches storage.

Latest Failure

• File ID: assistant-TZ4wjudCTFRRPqB2iUVxrB
• Started: 2026-11-06T13:57:02.106338Z
• Failed: 2026-11-06T13:57:04.098939Z
• APIM request ID: 1b0f5909-0ce6-43b8-b257-8c8c99c5801b
• x-request-id: 84dbd505-a850-4e10-9045-94146e5eda1f
• Error-body request ID: 64f75b44d388608de93bd3b44310c093

Questions

The Responses API documentation explicitly documents image input using uploaded file IDs, but its examples use the Azure OpenAI resource endpoint.

1. Is input_image.file_id supported for files uploaded through a Foundry project-scoped Files API with private BYO storage?
2. Does image processing retrieve these files through a different identity or network path from the Files API download operation?
3. Are additional configuration requirements or known limitations applicable to this setup?
4. Which diagnostics can reveal the underlying download failure beyond the generic HTTP 400 error?