Hierarchy
Buckets
A bucket has:
You can list the buckets a key can reach with
GET /buckets/all, and read one bucket’s stored size with GET /buckets/size/{bucketId}. Bucket creation, configuration, and deletion are dashboard operations: copy the bucketId and use it in the file and folder paths. See the bucket operations.
Folders
A folder hasid, name, visibility, parentId, timestamps, and derived counters. Folder details add:
Folder content is a combined, paginated list of subfolders and files. Each item carries a
type of folder or file.
The folder tree has a maximum depth of 8. Creating a folder deeper than that fails with 400.
Files
A file record exposed by list endpoints includes:
List responses also include a
downloadUrl of the form /api/files/download/{fileId}. This is a legacy display path; the documented download route is GET /files/{fileId}/stream.
Listing root-level content vs folder content
Use the right endpoint for the level you are rendering:
Root-level lists are paginated separately for files and folders. Folder content combines both types and paginates the combined result.
Identifiers
Use opaque IDs exactly as returned. Do not construct IDs, infer ordering from them, or treat a name as unique. Folder creation rejects a duplicate name under the same parent, but files can share display names.Names and extensions
File names are returned without the extension, and the extension is returned separately inextFile. When you reconstruct a filename for display or download, join them with a dot only when extFile is non-empty.
The streaming download sets X-File-Name as a URL-encoded filename and Content-Disposition for safe saving. Prefer those headers over reconstructing a name yourself.
Visibility
visibility controls whether a public share link can expose the file. It does not make a file anonymously readable by itself. Anonymous access requires a share link, which is created and managed in the dashboard, not through the published API surface.
What the API does not expose
- Raw object keys or storage paths
- Provider names or credentials
- Encryption keys or envelopes
- Other companies’ resources
- Bucket creation, update, or deletion