Skip to main content
Expiring file storage. Every file has a lifetime after which it deletes itself. Filenames are encrypted at rest; contents uploaded through the API are not, see How Encryption Works before you build on this.

List files

GET /files. Requires files.read.

Retrieve a file

GET /files/{id}. Returns 404 if it does not exist or is not yours, the two are deliberately indistinguishable. Requires files.read.

Start an upload

POST /files. Reserves an id and returns a short-lived URL to PUT the bytes to. Nothing is stored until you call complete. Requires files.write.

Finish an upload

POST /files/{id}/complete. Commits the upload once the bytes are in storage. Safe to call twice, a repeat returns the same file rather than an error, so retries are free. Requires files.write.

Get a download URL

GET /files/{id}/download. Returns a signed URL valid for five minutes. JSON rather than a redirect, so a client that follows redirects can’t accidentally stream a huge body into memory. Requires files.read.

Delete a file

DELETE /files/{id}. Removes the record and the stored bytes. Cannot be undone. Requires files.delete.
Example file object