> ## Documentation Index
> Fetch the complete documentation index at: https://docs.everabyte.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dashboard and API boundaries

> Which tasks belong to the Everabyte dashboard and which belong to the REST API.

The developer API is one part of Everabyte. Some operations are intentionally only available to a signed-in human in the dashboard. Knowing the boundary prevents dead ends in your integration design.

## Dashboard responsibilities

Use the [Everabyte dashboard](https://app.everabyte.com) for:

* creating, scoping, and revoking API keys,
* managing company members and permissions,
* billing, plan changes, and subscription state,
* creating and deleting buckets,
* configuring bucket-level retention,
* generating and rotating encryption keys,
* legal hold and compliance actions,
* reviewing audit and activity views,
* support and account recovery.

These actions are protected by session authentication, step-up verification, or both. They are not part of the public API-key surface.

> [!TIP]
>
> If your product needs to provision buckets or keys on behalf of customers, do not script the dashboard. Talk to Everabyte about an enterprise or partner onboarding arrangement. See [Enterprise and partners](https://docs.everabyte.com/enterprise/overview.md).

## API responsibilities

Use the REST API for:

* listing the buckets a key can reach and reading a bucket's stored size,
* uploading files,
* listing files in a bucket and listing its deleted files,
* reading file metadata through list responses and file-scoped endpoints,
* downloading files and file versions,
* renaming files, changing visibility, setting or reading retention state where allowed,
* moving and copying files,
* soft- or hard-deleting files,
* restoring files from trash,
* listing, restoring, and deleting file versions,
* creating, updating, moving, copying, and deleting folders,
* restoring folders from trash,
* listing folders, subfolders, and folder content.

## What is not in the public API

The following areas exist in the backend but are not published as stable API-key contracts:

* sharing links, invitations, and share-control sessions,
* comments, tags, favorites, and collaboration features,
* audit logs, activity timelines, and narrative endpoints,
* semantic search and reindexing,
* upload pause/resume/progress streams,
* backup job orchestration beyond the agent-oriented surface,
* administrative, superadmin, reseller, and control-plane routes,
* billing, invoices, and subscription management.

> [!WARNING]
>
> Reachability is not permission to depend on a route. Undocumented routes can change or disappear without notice.

## Key creation prerequisites

Creating an API key in the dashboard requires, depending on account state:

* a company context,
* permission to manage API keys (`API_PERMISSIONS.MANAGE`),
* active billing access,
* a verified email when the account is on trial,
* step-up authentication.

If the dashboard refuses key creation, resolve that state first. There is no public endpoint that bypasses it.

## Environment labels

API keys carry an environment label. The dashboard default is `production`. This label is recorded with usage events; it does not create a separate API host or a separate dataset.

For isolated testing, use a separate company workspace and separate keys. This reference does not document a sandbox base URL.

## Where to ask

If a task is not possible with the public API and not exposed in the dashboard, contact [`support@everabyte.com`](mailto:support@everabyte.com). Include the company ID, the key's public identifier (never the secret), the route you attempted, and the response `code`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.