Skip to main content
The developer API is one part of Everabyte. Some operations are intentionally only available to a signed-in human in the dashboard. Knowing the boundary prevents dead ends in your integration design.

​
Dashboard responsibilities

Use the Everabyte dashboard for:
  • creating, scoping, and revoking API keys,
  • managing company members and permissions,
  • billing, plan changes, and subscription state,
  • creating and deleting buckets,
  • configuring bucket-level retention,
  • generating and rotating encryption keys,
  • legal hold and compliance actions,
  • reviewing audit and activity views,
  • support and account recovery.
These actions are protected by session authentication, step-up verification, or both. They are not part of the public API-key surface.
If your product needs to provision buckets or keys on behalf of customers, do not script the dashboard. Talk to Everabyte about an enterprise or partner onboarding arrangement. See Enterprise and partners.

​
API responsibilities

Use the REST API for:
  • listing the buckets a key can reach and reading a bucket’s stored size,
  • uploading files,
  • listing files in a bucket and listing its deleted files,
  • reading file metadata through list responses and file-scoped endpoints,
  • downloading files and file versions,
  • renaming files, changing visibility, setting or reading retention state where allowed,
  • moving and copying files,
  • soft- or hard-deleting files,
  • restoring files from trash,
  • listing, restoring, and deleting file versions,
  • creating, updating, moving, copying, and deleting folders,
  • restoring folders from trash,
  • listing folders, subfolders, and folder content.

​
What is not in the public API

The following areas exist in the backend but are not published as stable API-key contracts:
  • sharing links, invitations, and share-control sessions,
  • comments, tags, favorites, and collaboration features,
  • audit logs, activity timelines, and narrative endpoints,
  • semantic search and reindexing,
  • upload pause/resume/progress streams,
  • backup job orchestration beyond the agent-oriented surface,
  • administrative, superadmin, reseller, and control-plane routes,
  • billing, invoices, and subscription management.
Reachability is not permission to depend on a route. Undocumented routes can change or disappear without notice.

​
Key creation prerequisites

Creating an API key in the dashboard requires, depending on account state:
  • a company context,
  • permission to manage API keys (API_PERMISSIONS.MANAGE),
  • active billing access,
  • a verified email when the account is on trial,
  • step-up authentication.
If the dashboard refuses key creation, resolve that state first. There is no public endpoint that bypasses it.

​
Environment labels

API keys carry an environment label. The dashboard default is production. This label is recorded with usage events; it does not create a separate API host or a separate dataset. For isolated testing, use a separate company workspace and separate keys. This reference does not document a sandbox base URL.

​
Where to ask

If a task is not possible with the public API and not exposed in the dashboard, contact support@everabyte.com. Include the company ID, the key’s public identifier (never the secret), the route you attempted, and the response code.