Filesystem API

The Filesystem API provides complete file management operations.

Endpoint: GET/POST /api/filesystem.php

Auth: Session + CSRF

Actions

list — List Directory

GET /api/filesystem.php?action=list&path=/Documents

Parameters:

Name	Type	Default	Description
path	string	/	Directory path to list

Response:

{
  "items": [
    {
      "name": "file.txt",
      "type": "file",
      "size": 1234,
      "modified": "2026-02-20T10:30:00Z",
      "mime": "text/plain"
    },
    {
      "name": "subfolder",
      "type": "directory",
      "modified": "2026-02-20T10:30:00Z"
    }
  ],
  "path": "/Documents"
}

Virtual Teamchat Folder

At the root level (/), a virtual /Teamchat/ folder is injected. It lists chat rooms the user belongs to. Navigating into a room folder accesses shared files via lib/shared-filesystem.php.

read — Read File

GET /api/filesystem.php?action=read&path=/Documents/notes.md

Response:

{
  "content": "# My Notes\n\nSome content here...",
  "path": "/Documents/notes.md"
}

write — Write File

POST /api/filesystem.php
Content-Type: application/json

{
  "action": "write",
  "path": "/Documents/notes.md",
  "content": "# Updated Notes\n\nNew content."
}

Response:

{
  "ok": true,
  "path": "/Documents/notes.md"
}

mkdir — Create Directory

POST /api/filesystem.php
Content-Type: application/json

{
  "action": "mkdir",
  "path": "/Documents/NewFolder"
}

delete — Delete File/Directory

POST /api/filesystem.php
Content-Type: application/json

{
  "action": "delete",
  "path": "/Documents/old-file.txt"
}

WARNING

In the Files app UI, delete operations go through the Trash API (/api/trash.php) for soft delete. Direct filesystem delete is permanent.

move — Move / Rename

POST /api/filesystem.php
Content-Type: application/json

{
  "action": "move",
  "from": "/Documents/old-name.md",
  "to": "/Documents/new-name.md"
}

Restrictions:

• Cross-domain moves (user ↔ Teamchat) are blocked
• Cross-room moves within Teamchat are blocked

copy — Copy File/Directory

POST /api/filesystem.php
Content-Type: application/json

{
  "action": "copy",
  "from": "/Documents/template.md",
  "to": "/Documents/copy-of-template.md"
}

Same cross-domain restrictions as move.

upload — Upload File

POST /api/filesystem.php?action=upload&path=/Documents
Content-Type: multipart/form-data

file: <binary>

Response:

{
  "ok": true,
  "path": "/Documents/uploaded-file.pdf",
  "size": 52430
}

Checks user quota before accepting upload. Returns 413 if quota exceeded.

download — Download File

GET /api/filesystem.php?action=download&path=/Documents/file.pdf

Returns binary file with Content-Disposition: attachment header.

quota — Storage Quota

GET /api/filesystem.php?action=quota

Response:

{
  "used": 52428800,
  "total": 524288000,
  "percent": 10,
  "used_formatted": "50 MB",
  "total_formatted": "500 MB"
}

File Storage

User files are stored at:

userdata/user_{ID}/{path}

Shared Teamchat files at:

userdata/shared/room_{ROOM_ID}/{path}