Skip to main content
The API reference is generated from an OpenAPI document that covers the file, folder, and read-only bucket endpoints needed to manage content — endpoints verified against the backend and reachable with company API-key credentials.

​
Base URL

Every path in the reference is relative to this base.

​
What is included

Bucket creation and configuration stay in the dashboard. The published bucket operations are read-only: they let a key discover its bucketId values and track stored size. Use them as the container identifiers for file and folder calls.

​
What is excluded

Excluded does not mean forbidden forever. It means this documentation does not publish a stable public contract for them.
  • Bucket creation, update, deletion, and provisioning. Use the dashboard.
  • Datacenter and region routes. They are session-only and are not reachable with an API key.
  • Global (bucket-less) file and folder listings. Scope every listing to a bucketId.
  • Recently accessed items, download-route resolution, and per-file security restriction reads.
  • Session-only endpoints, including file details that require a browser session.
  • Sharing, permission, and collaborator management.
  • API key lifecycle (dashboard only, step-up protected).
  • Billing and subscription management.
  • Audit and compliance exports.
  • Administrative, reseller, and partner provisioning.
  • Backup agent, semantic search, upload-progress, and other surfaces still stabilizing.
  • MCP tools (documented separately in Integrations, not as REST operations).

​
Reading the contracts

Each operation documents:
  • Path and method, including optional segments.
  • Authentication: always the same two headers for this surface.
  • Parameters: path, query, and body, with types and constraints.
  • Required scopes: the scope pair needed.
  • Responses: status codes and response shapes.
Response examples are illustrative. They show the shape and field names the backend produces, but identifiers, sizes, and timestamps are not real production data. Do not copy values from examples into tests as fixtures.

​
Two envelope shapes

The most common source of integration bugs is assuming one error shape. See Conventions for the exact variants, but the short version:
  • Controller success: { "status", "message", "data" }
  • Controller error: { "status", "message", "error" }
  • Middleware error: { "status", "message", "data": null, "code" }
Middleware errors carry a stable code. Controller errors generally do not.

​
Versioning

The documented surface is unversioned in the URL. This reference is the record of current behavior; treat undocumented fields as unstable.

​
Getting started

Authentication

Headers and which surface they apply to.

Conventions

Envelopes, types, and identifiers.

Pagination

List pagination shape.

Errors

Status codes and stable error codes.

Playground

How the request display works and its limits.

Files

File operation guide.

Folders

Folder operation guide.

Buckets

Bucket discovery and stored size.