Skip to main content
Everabyte is a cloud storage platform for companies. The developer API exposes the storage primitives your application needs: buckets, folders, files, versions, retention, trash, and restore. This documentation is for developers integrating with Everabyte from a trusted server. It is not the Help Center and it is not marketing material: it describes behavior verified against the backend implementation.

​
The API at a glance

All routes are registered under the /api prefix. For example, listing a bucket’s files is https://api.everabyte.io/api/files/findAll/BUCKET_ID.

​
Who can use the developer API

The REST storage surface is company-scoped. A company API key authenticates as the company workspace and can only reach the company’s buckets, folders, and files. Individual EverSpark accounts are rejected with 403 API_COMPANY_ONLY. The only first-party exception is an API key bound to an enrolled backup device, which the desktop agent uses for its own upload and restore chain. That exception is not a general-purpose path for third-party integrations. API keys are limited to storage operations: /files, /folders, /buckets, and the backup agent surface. Requests to other route families are rejected with 403 API_KEY_SURFACE_DENIED before any quota is consumed.

​
What is published here

The API reference contains endpoints that are:
  • reachable with API-key credentials,
  • allowed by the documented scope model, and
  • verified against route registration and controller behavior.
Some backend routes exist but are deliberately excluded: session-only endpoints, administrative and reseller provisioning, sharing controls, audit exports, and features that are still stabilizing. Excluded does not mean forbidden forever; it means this documentation does not yet publish a stable public contract for them.
Do not build against an endpoint merely because you can reach it. If it is not in this reference, treat it as internal and contact support before depending on it.

​
Two distinct authentication surfaces

These are separate. A browser session does not authenticate the REST API, and an API key does not authenticate dashboard routes. See Authentication overview.

​
Prerequisites

Before your first request, you need:
  1. A company account with access to the dashboard.
  2. An API key created for that company, with the scopes your integration needs.
  3. Active billing where your plan requires it. Lapsed subscriptions receive 402 SUBSCRIPTION_REQUIRED.
  4. A verified email if you are using trial access.
  5. Active encryption keys for the user who owns the uploads. Uploads fail with a clear error until those keys exist.

​
Where to go next

Quickstart

Make a verified request and upload your first file.

Core concepts

Understand buckets, folders, files, versions, and retention.

Authentication

Learn how API keys, scopes, and bucket ceilings work.

API reference

Read the endpoint contracts.