Skip to content
CCS Files Docs

The root folder

GET
/api/v1/tenants/{tenant_id}/applications/{application_id}/folders/root
curl --request GET \
  --url https://files.centralcodestation.com/api/v1/tenants/example/applications/example/folders/root \
  --header 'Authorization: Bearer <token>'

Exists implicitly per application; every member may view it (it lists only what each caller may see).

Folders and files

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
tenant_id
required
string

The Identity Server tenant id.

application_id
required
string

The Identity Server application id: a tenant application, or (platform clients) the client’s own platform application.

Responses

Section titled “Responses”

200

Section titled “200”

Success.

Media typeapplication/json
object
type
required
string
Allowed values: folder
folder_id
required

root for the application’s root folder.

string
tenant_id
required
string
application_id
required
string
parent_id
required
string
nullable
name
required
string
path
required
string
depth
required
number
description
required
string
nullable
owner_id
required
string
nullable
created_by
required
object
user_id
required
string
nullable
client_id
required
string
inherit
required
boolean
acl_scope_id
required
string
entries_count
required
number
state
required
string
Allowed values: available trashed
revision
required

Send it as If-Match to refuse a stale write (412 revision_mismatch).

number
metadata
required
object
key
additional properties
string
external_ref
required
string
nullable
busy
required

A background job rewrites the subtree; writes under it answer 409 folder_busy.

boolean
managed
required

Application-managed: the item is a folder an application marked, or lies below one. Read-only for people (403 folder_managed); only the application’s machine clients change it.

boolean
managed_by
required

Who manages it and which folder carries the mark; null when not managed.

object
client_id
required

The machine client that marked the managing folder.

string
name
required

A display name for it: the tenant application’s name, or a platform application’s slug.

string
nullable
managed_folder_id
required

The folder that carries the mark (the item itself, or its nearest marked ancestor). The tenant owner releases this one.

string
managed_at
required
string format: date-time
created_at
required
string format: date-time
nullable
updated_at
required
string format: date-time
nullable
trashed_at
required
string format: date-time
nullable
trashed_by
required
string
nullable
my_actions
required

What the caller may do with the folder.

Array<string>
Allowed values: view download edit share delete approve

Example 

{
  "type": "folder",
  "folder_id": "01J9Z6R2M3N4P5Q6R7S8T9V0W1",
  "tenant_id": "fitness-co",
  "application_id": "fitness-app",
  "parent_id": "root",
  "name": "posts",
  "path": "/posts",
  "depth": 1,
  "description": null,
  "owner_id": "u-ana",
  "inherit": true,
  "acl_scope_id": "root",
  "entries_count": 0,
  "state": "available",
  "revision": 1,
  "metadata": {},
  "managed": true,
  "managed_by": {
    "client_id": "fitness-backend",
    "name": "Fitness",
    "managed_folder_id": "01J9Z6R2M3N4P5Q6R7S8T9V0W1",
    "managed_at": "2026-10-22T09:12:33.120Z"
  },
  "created_at": "2026-10-22T09:12:33.120Z",
  "updated_at": "2026-10-22T09:12:33.120Z",
  "trashed_at": null,
  "trashed_by": null,
  "my_actions": [
    "view",
    "download",
    "edit",
    "share",
    "delete"
  ]
}

401

Section titled “401”

Error. error is one of: invalid_token.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 401,
  "error": "invalid_token",
  "message": "The bearer token is missing, malformed, expired, signed by an unknown key, or has the wrong audience (`aud` must be `files-api`).",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

403

Section titled “403”

Error. error is one of: not_tenant_member, no_application_access, tenant_not_available, insufficient_scope, client_context_mismatch, files_access_not_granted, missing_action.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 403,
  "error": "not_tenant_member",
  "message": "The user is not an active member of the tenant in the URL.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

404

Section titled “404”

Error. error is one of: application_not_found, not_found.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 404,
  "error": "application_not_found",
  "message": "The application in the URL is not an active application of the tenant.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

429

Section titled “429”

Error. error is one of: rate_limited.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 429,
  "error": "rate_limited",
  "message": "Too many requests in the current window; `retry_after` (and the `Retry-After` header) says when to retry.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

503

Section titled “503”

Error. error is one of: identity_unavailable.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 503,
  "error": "identity_unavailable",
  "message": "The service could not reach the Identity Server and has no fresh cached answer.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

default

Section titled “default”

Error: see error for the code.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 403,
  "error": "invalid_request",
  "message": "This client is not bound to this tenant/application",
  "path": "/api/v1/tenants/t1/applications/a1/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D"
}