File requests API

Ask people to send you files and download what they send. Every request sends a token in the Authorization: Bearer header; see Get started with the API.

Create a file request

POST /api/file-requests

Creates a file request and emails each invited person their own upload link. The shared link is on unless you send link_enabled: false or your administrator has turned off shared links; a request without a shared link needs at least one invitee. Inviting people needs email set up for the domain. Under a service account token, the deadline must be within the domain’s maximum link lifetime even when acting as an admin.

Permission: File requests: Create and manage (requests:write)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Request body

Content type application/json.

Field	Type	Description
`label` (required)	string	The title. Required; leading and trailing spaces are removed. At most 120 characters.
`message`	string	Instructions for people sending files. At most 1000 characters.
`recipient_emails`	array of string	People to invite. Duplicates and empty entries are ignored; `Name <address>` is accepted. Up to 50 different addresses. At most 50 items.
`due_at` (required)	string (date-time)	The deadline, in the future and within the domain’s maximum link lifetime if your administrator set one.
`notify_mode`	string: `each`, `digest`, `off`	Email notifications to you: one per upload, a daily summary, or none. Default `"each"`.
`link_enabled`	boolean	Turn the shared link on or off. Defaults to on, or off when your administrator has turned off shared links.
`domain`	string	The domain to create the request on. Defaults to the domain you call the API on. The request’s user must have access to it, and under `Dew-Act-As` so must the service account.

{
  "label": "Q3 receipts",
  "message": "Please send your receipts for July to September as PDFs.",
  "recipient_emails": [
    "anna@example.com"
  ],
  "due_at": "2026-10-31T22:59:59Z",
  "notify_mode": "each"
}

Response 200

The request was created.

data fields:

Field	Type	Description
`file_request` (required)	FileRequest
`failed_recipients` (required)	array of string (email)	Always empty: the invitations go out after the response. A person the invitation couldn’t reach gets `invite_failed_at` on the request.

{
  "success": true,
  "message": "File request created",
  "data": {
    "file_request": {
      "id": "aB3dE9kQ",
      "creator_id": "6f1c2b3a-4d5e-4f60-8a7b-9c0d1e2f3a4b",
      "label": "Q3 receipts",
      "message": "Please send your receipts for July to September as PDFs.",
      "domain_hostname": "files.example.com",
      "created_at": "2026-10-01T09:00:00Z",
      "due_at": "2026-10-31T22:59:59Z",
      "deletes_at": "2027-01-29T22:59:59Z",
      "link_enabled": true,
      "notify_mode": "each",
      "people": [
        {
          "id": "rcp_3f9c2a1b7d4e4f6a8b0c1d2e3f4a5b6c",
          "email": "anna@example.com",
          "source": "invite",
          "email_verified": true,
          "created_at": "2026-10-01T09:00:00Z",
          "file_count": 0
        }
      ],
      "file_count": 0,
      "total_size": 0,
      "new_upload_count": 0,
      "link_count": 0,
      "status": "open",
      "link_url": "https://files.example.com/r/Hk82LmQp"
    },
    "failed_recipients": []
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission; the user’s account is unlicensed; the user has no access to the domain; or shared links are turned off by your administrator and `link_enabled` is true.	“This API token doesn’t have permission for this action.” “Your account is unlicensed. Contact your administrator to restore upload access.” “You don’t have access to this domain.” “Your administrator has turned off shared links.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

List file requests

GET /api/file-requests

Lists the file requests the user owns, newest first, with their people and totals. Without limit, every request. With limit, a page at a time: for the next page, pass the last request’s created_at and id as cursor_ts and cursor_id; a page shorter than limit is the last.

Permission: File requests: View and download (requests:read)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`status`	query	string: `open`, `closed`	Only open requests, or only closed ones (closed by hand or past their deadline). Both when left out.
`search`	query	string	Matches the title, or the address or name of someone on the request.
`limit`	query	integer	Requests per page; above 100 counts as 100. Minimum 1. Maximum 100.
`cursor_ts`	query	string (date-time)	`created_at` of the last request on the previous page.
`cursor_id`	query	string	`id` of the last request on the previous page.

Response 200

The user’s file requests.

data is array of FileRequest.

{
  "success": true,
  "data": [
    {
      "id": "aB3dE9kQ",
      "creator_id": "6f1c2b3a-4d5e-4f60-8a7b-9c0d1e2f3a4b",
      "label": "Q3 receipts",
      "message": "Please send your receipts for July to September as PDFs.",
      "domain_hostname": "files.example.com",
      "created_at": "2026-10-01T09:00:00Z",
      "due_at": "2026-10-31T22:59:59Z",
      "deletes_at": "2027-01-29T22:59:59Z",
      "link_enabled": true,
      "notify_mode": "each",
      "people": [
        {
          "id": "rcp_3f9c2a1b7d4e4f6a8b0c1d2e3f4a5b6c",
          "email": "anna@example.com",
          "source": "invite",
          "email_verified": true,
          "created_at": "2026-10-01T09:00:00Z",
          "file_count": 3
        },
        {
          "id": "rcp_8a7b6c5d4e3f4a1b9c2d3e4f5a6b7c8d",
          "email": "bob@example.com",
          "name": "Bob Jensen",
          "source": "link",
          "email_verified": true,
          "created_at": "2026-10-02T14:12:00Z",
          "file_count": 1
        }
      ],
      "file_count": 4,
      "total_size": 5242880,
      "new_upload_count": 1,
      "last_submitted_at": "2026-10-02T14:15:00Z",
      "link_count": 0,
      "status": "open",
      "link_url": "https://files.example.com/r/Hk82LmQp"
    }
  ]
}

Errors

Status	When	Example message
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Get a file request

GET /api/file-requests/{id}

Returns one file request with its people, every upload it received and its latest activity. To list the files inside an upload of several files, use the contents endpoint.

Permission: File requests: View and download (requests:read)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Response 200

The file request.

data is FileRequestDetail.

{
  "success": true,
  "data": {
    "file_request": {
      "id": "aB3dE9kQ",
      "creator_id": "6f1c2b3a-4d5e-4f60-8a7b-9c0d1e2f3a4b",
      "label": "Q3 receipts",
      "message": "Please send your receipts for July to September as PDFs.",
      "domain_hostname": "files.example.com",
      "created_at": "2026-10-01T09:00:00Z",
      "due_at": "2026-10-31T22:59:59Z",
      "deletes_at": "2027-01-29T22:59:59Z",
      "link_enabled": true,
      "notify_mode": "each",
      "people": [
        {
          "id": "rcp_3f9c2a1b7d4e4f6a8b0c1d2e3f4a5b6c",
          "email": "anna@example.com",
          "source": "invite",
          "email_verified": true,
          "created_at": "2026-10-01T09:00:00Z",
          "file_count": 3
        },
        {
          "id": "rcp_8a7b6c5d4e3f4a1b9c2d3e4f5a6b7c8d",
          "email": "bob@example.com",
          "name": "Bob Jensen",
          "source": "link",
          "email_verified": true,
          "created_at": "2026-10-02T14:12:00Z",
          "file_count": 1
        }
      ],
      "file_count": 4,
      "total_size": 5242880,
      "new_upload_count": 1,
      "last_submitted_at": "2026-10-02T14:15:00Z",
      "link_count": 0,
      "status": "open",
      "link_url": "https://files.example.com/r/Hk82LmQp"
    },
    "uploads": [
      {
        "file_id": "Qw4Rt8Zn",
        "name": "invoice-0912.pdf",
        "size": 1048576,
        "mime_type": "application/pdf",
        "kind": "file",
        "file_count": 1,
        "sender_email": "bob@example.com",
        "sender_name": "Bob Jensen",
        "recipient_id": "rcp_8a7b6c5d4e3f4a1b9c2d3e4f5a6b7c8d",
        "received_at": "2026-10-02T14:15:00Z",
        "is_new": true,
        "link_count": 0
      },
      {
        "file_id": "Xy7Kp2Lm",
        "name": "receipts.zip",
        "size": 4194304,
        "mime_type": "application/zip",
        "kind": "archive",
        "file_count": 3,
        "sender_email": "anna@example.com",
        "sender_message": "All three months are in here.",
        "recipient_id": "rcp_3f9c2a1b7d4e4f6a8b0c1d2e3f4a5b6c",
        "received_at": "2026-10-01T16:40:00Z",
        "is_new": false,
        "link_count": 0
      }
    ],
    "activity": [
      {
        "event_type": "file_request.created",
        "actor_email": "anna.owner@example.com",
        "actor_name": "Anna Owner",
        "target_name": "Q3 receipts",
        "metadata": {
          "domain": "files.example.com",
          "link_enabled": true
        },
        "timestamp": "2026-10-01T09:00:00Z"
      }
    ]
  }
}

Errors

Status	When	Example message
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or it belongs to someone else.	“File request not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Update a file request

PUT /api/file-requests/{id}

Changes a file request’s title, instructions, deadline, email notifications or shared link, or closes or reopens it. Send only the fields to change. Closing the request or turning off the shared link stops uploads in progress. Reopening a request whose deadline has passed needs a new due_at in the same call. Turning the shared link back on keeps its address.

Permission: File requests: Create and manage (requests:write)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Request body

Content type application/json.

Field	Type	Description
`label`	string	The title. Can’t be empty. At most 120 characters.
`message`	string	Instructions for people sending files. An empty string removes them. At most 1000 characters.
`due_at`	string (date-time)	A new deadline, in the future and within the domain’s maximum link lifetime if your administrator set one.
`notify_mode`	string: `each`, `digest`, `off`
`link_enabled`	boolean	Turn the shared link on or off. It can’t be turned on while your administrator has turned off shared links.
`closed`	boolean	`true` closes the request, `false` reopens it.

{
  "due_at": "2026-11-15T22:59:59Z",
  "closed": false
}

Response 200

The request was updated.

data fields:

Field	Type	Description
`file_request` (required)	UpdatedFileRequest

{
  "success": true,
  "message": "File request updated",
  "data": {
    "file_request": {
      "id": "aB3dE9kQ",
      "creator_id": "6f1c2b3a-4d5e-4f60-8a7b-9c0d1e2f3a4b",
      "label": "Q3 receipts",
      "message": "Please send your receipts for July to September as PDFs.",
      "domain_hostname": "files.example.com",
      "created_at": "2026-10-01T09:00:00Z",
      "due_at": "2026-11-15T22:59:59Z",
      "deletes_at": "2027-02-13T22:59:59Z",
      "link_enabled": true,
      "notify_mode": "each"
    }
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or shared links are turned off by your administrator and `link_enabled` is true.	“This API token doesn’t have permission for this action.” “Your administrator has turned off shared links.”
404	No such file request, or it belongs to someone else.	“File request not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Delete a file request

DELETE /api/file-requests/{id}

Permanently deletes a file request and every file received through it. Files still shared through links made from them stay until those links are gone. People’s upload links stop working.

Permission: File requests: Delete (requests:delete)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Response 200

The request was deleted.

data is Success.

{
  "success": true,
  "message": "File request deleted"
}

Errors

Status	When	Example message
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or it belongs to someone else.	“File request not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Mark uploads as seen

POST /api/file-requests/{id}/seen

Marks every upload on the request as seen, so is_new turns false and new_upload_count goes to 0.

Permission: File requests: Create and manage (requests:write)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Response 200

The uploads are marked as seen.

data is Success.

{
  "success": true
}

Errors

Status	When	Example message
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or it belongs to someone else.	“File request not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Invite people

POST /api/file-requests/{id}/people

Invites people to an open file request and emails each their own upload link. Addresses already invited are skipped. A request can have up to 50 invitees. Needs email set up for the request’s domain.

Permission: File requests: Create and manage (requests:write)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Request body

Content type application/json.

Field	Type	Description
`emails`	array of string	Addresses to invite. Duplicates and empty entries are ignored; `Name <address>` is accepted. At most 50 items.

{
  "emails": [
    "bob@example.com"
  ]
}

Response 200

The new invitees. Their invitations go out after the response.

data is FileRequestEmailResult.

{
  "success": true,
  "data": {
    "emails": [
      "bob@example.com"
    ]
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or it belongs to someone else.	“File request not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Change a person’s email address

PUT /api/file-requests/{id}/people/{person_id}

Corrects an invitee’s email address on an open file request and sends the invitation to the new address. Their previous upload link stops working. Needs email set up for the request’s domain.

Permission: File requests: Create and manage (requests:write)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.
`person_id` (required)	path	string	The person’s ID, from `people` on the file request.

Request body

Content type application/json.

Field	Type	Description
`email` (required)	string (email)	The new address. It can’t be one already invited to the request.

{
  "email": "anna.berg@example.com"
}

Response 200

The address was changed.

data fields:

Field	Type	Description
`delivered` (required)	boolean	Whether the invitation email to the new address was delivered.

{
  "success": true,
  "data": {
    "delivered": true
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or the person is no longer on it.	“That person is no longer part of this request.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Remove a person

DELETE /api/file-requests/{id}/people/{person_id}

Removes a person from a file request. Their upload link stops working, including for an upload in progress. Files they already sent stay on the request.

Permission: File requests: Create and manage (requests:write)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.
`person_id` (required)	path	string	The person’s ID, from `people` on the file request.

Response 200

The person was removed.

data is Success.

{
  "success": true
}

Errors

Status	When	Example message
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or the person is no longer on it.	“That person is no longer part of this request.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Send reminders

POST /api/file-requests/{id}/remind

Emails selected invitees their upload link again, with an optional note. Only invitees can be reminded, and only while the request is open. One reminder call is allowed every 30 seconds per user.

Permission: File requests: Create and manage (requests:write)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Request body

Content type application/json.

Field	Type	Description
`person_ids` (required)	array of string	IDs of invitees to remind, from `people` on the request.
`note`	string	A note added to the reminder. At most 500 characters.

{
  "person_ids": [
    "rcp_3f9c2a1b7d4e4f6a8b0c1d2e3f4a5b6c"
  ],
  "note": "Just a reminder: we need these by Friday."
}

Response 200

The people being reminded. The reminders go out after the response.

data is FileRequestEmailResult.

{
  "success": true,
  "data": {
    "emails": [
      "anna@example.com"
    ]
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or it belongs to someone else.	“File request not found”
429	A reminder was sent less than 30 seconds ago.	“Please wait a moment before sending another reminder.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Download everything received

GET /api/file-requests/{id}/download

Downloads every file the request received. When there is only one single-file upload you get that file; otherwise one ZIP.

Permission: File requests: View and download (requests:read)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Response 200

The files. One single file comes as itself, and one file inside an upload as that file; anything else comes as a ZIP named after the request, with a folder per sender when several people sent files. A ZIP is built as it downloads, so it has no Content-Length and can’t be resumed with Range. A single file supports Range requests and may be answered with a 302 redirect to your storage instead.

Content type application/zip.

Content type application/octet-stream.

Response 302

On storage that supports it, a single file is served from a temporary storage address.

Errors

Status	When	Example message
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or it has no files yet.	“File request not found” “Nothing to download”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Download a selection

POST /api/file-requests/{id}/download

Downloads selected uploads, files and folders from a request. Send the selection as a form field items holding a JSON array, up to 5,000 items, in a body of up to 2 MB. One single-file upload or one file inside an upload comes as itself; anything else as one ZIP.

Permission: File requests: View and download (requests:read)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Request body

Content type application/x-www-form-urlencoded.

Field	Type	Description
`items` (required)	string	A JSON array of `ReceivedItemSelection` objects, 1 to 5,000 of them.

Response 200

Content type application/zip.

Content type application/octet-stream.

Response 302

On storage that supports it, a single file is served from a temporary storage address.

Errors

Status	When	Example message
400	The selection is missing, empty, not valid JSON or has more than 5,000 items.	“Invalid selection”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or a selected upload, file or folder isn’t part of it.	“File not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

POST /api/file-requests/{id}/links

Creates a shared link of your own to files a request received. A whole upload is shared as it is stored: the link keeps those files after the request is deleted, until the link expires. Anything else (a file or folder inside an upload, or several items) is copied into a new file first, up to 1 GB and 2,000 files. The link follows your administrator’s link expiry; with email protection, each recipient is emailed an invitation.

Permission: File requests: View and download (requests:read) and Files: Upload and share (files:write)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.

Request body

Content type application/json.

Field	Type	Description
`items` (required)	array of ReceivedItemSelection	What to share. At most 5000 items.
`link`	ReceivedLinkSettings

{
  "items": [
    {
      "file_id": "Xy7Kp2Lm"
    }
  ],
  "link": {
    "link_type": "protected",
    "protection_method": "email",
    "email_recipients": [
      {
        "email": "bob@example.com"
      }
    ]
  }
}

Response 200

The link was created.

data is ReceivedFileLink.

{
  "success": true,
  "message": "Link created",
  "data": {
    "file": {
      "id": "Zt5Np3Ws",
      "name": "receipts.zip",
      "size": 4194304,
      "mime_type": "application/zip",
      "link_type": "protected",
      "protection_method": "email",
      "domain_hostname": "files.example.com",
      "expires_at": "2026-11-03T10:20:00Z"
    },
    "url": "https://files.example.com/p/Zt5Np3Ws",
    "formatted_text": "https://files.example.com/p/Zt5Np3Ws"
  }
}

Errors

Status	When	Example message
400	The selection or link settings are invalid, or a copy would exceed 1 GB or 2,000 files.	“Invalid selection” “Links can include up to 1 GB and 2,000 files. To share more, create a link to a whole upload.” “Password is required”
401	The token is missing, wrong, revoked or expired.
403	The token lacks one of the permissions, or the user’s account is unlicensed.	“This API token doesn’t have permission for this action.” “Your account is unlicensed. Contact your administrator to restore upload access.”
404	No such file request, or a selected upload, file or folder isn’t part of it.	“File not found”
413	A copy is larger than the domain’s upload limit or the storage accepts.	“Total size exceeds limit (10 GB)”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.
507	Not enough storage space for the copy.	“Not enough storage space for this upload”

List received files

GET /api/file-requests/{id}/files

Lists every file the request received, across uploads and folders, sorted by name, 500 per page. With q, returns only files whose name contains it.

Permission: File requests: View and download (requests:read)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.
`q`	query	string	Search text. Matches file names containing it, ignoring case; leave it out to list instead of search. At most 200 characters.
`offset`	query	integer	How many items to skip. Each page holds up to 500 items. Default `0`. Minimum 0.

Response 200

One page of files.

data fields:

Field	Type	Description
`items` (required)	array of ReceivedFile
`total` (required)	integer	How many files match in all.

{
  "success": true,
  "data": {
    "items": [
      {
        "file_id": "Qw4Rt8Zn",
        "path": "",
        "name": "invoice-0912.pdf",
        "size": 1048576,
        "sender_email": "bob@example.com",
        "sender_name": "Bob Jensen",
        "received_at": "2026-10-02T14:15:00Z"
      },
      {
        "file_id": "Xy7Kp2Lm",
        "path": "July/receipt-0714.pdf",
        "name": "receipt-0714.pdf",
        "size": 1398101,
        "sender_email": "anna@example.com",
        "received_at": "2026-10-01T16:40:00Z"
      }
    ],
    "total": 2
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or it belongs to someone else.	“File request not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Download an upload

GET /api/file-requests/{id}/files/{file_id}

Downloads one upload as it is stored: the file, or for an upload of several files, its ZIP. Supports Range requests for resuming.

Permission: File requests: View and download (requests:read)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.
`file_id` (required)	path	string	The upload’s ID, `file_id` in `uploads` on the file request.
`preview`	query	string: `1`	Ignored for API tokens, which always get the file as an attachment. In a browser, `1` shows content the browser can display inline.

Response 200

The file. 206 answers a Range request.

Content type application/octet-stream.

Response 206

Part of the file, for a Range request.

Content type application/octet-stream.

Response 302

On storage that supports it, a single file is served from a temporary storage address.

Errors

Status	When	Example message
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or the upload isn’t part of it.	“File not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Delete an upload

DELETE /api/file-requests/{id}/files/{file_id}

Permanently deletes one upload from a request: a single file, or every file sent together in one upload. A file inside an upload of several files can’t be deleted on its own. Files still shared through links made from the upload stay until those links are gone.

Permission: File requests: Delete (requests:delete)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.
`file_id` (required)	path	string	The upload’s ID, `file_id` in `uploads` on the file request.

Response 200

The upload was deleted.

data is Success.

{
  "success": true
}

Errors

Status	When	Example message
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, or the upload isn’t part of it.	“File not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

List files in an upload

GET /api/file-requests/{id}/files/{file_id}/contents

Lists one folder of an upload of several files, folders first, then files, sorted by name, 500 per page. With q, searches the names of every file and folder below the folder instead. The first page also says how many files the folder holds and their size.

Permission: File requests: View and download (requests:read)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.
`file_id` (required)	path	string	The upload’s ID, `file_id` in `uploads` on the file request.
`path`	query	string	The folder: empty for the top of the upload, else a folder’s `path` ending in `/`. Default `""`.
`q`	query	string	Search text. Matches file names containing it, ignoring case; leave it out to list instead of search. At most 200 characters.
`offset`	query	integer	How many items to skip. Each page holds up to 500 items. Default `0`. Minimum 0.

Response 200

One page of the folder.

data fields:

Field	Type	Description
`items` (required)	array of ReceivedFolderItem
`total` (required)	integer	How many items match in all.
`file_count`	integer	First page only: how many files are under the folder.
`size`	integer (int64)	First page only: their total size in bytes.

{
  "success": true,
  "data": {
    "items": [
      {
        "name": "July",
        "path": "July/",
        "is_dir": true,
        "file_count": 2,
        "size": 2796202
      },
      {
        "name": "summary.xlsx",
        "path": "summary.xlsx",
        "is_dir": false,
        "file_count": 1,
        "size": 1398102
      }
    ],
    "total": 2,
    "file_count": 3,
    "size": 4194304
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, the upload isn’t part of it, or it is a single file.	“File not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Download a file or folder from an upload

GET /api/file-requests/{id}/files/{file_id}/entry

Downloads one file, or one folder as a ZIP, from inside an upload of several files. Neither supports Range requests.

Permission: File requests: View and download (requests:read)
Act for a user: accepts the Dew-Act-As header. Personal tokens work too.

Parameters

Name	In	Type	Description
`id` (required)	path	string	The file request’s ID.
`file_id` (required)	path	string	The upload’s ID, `file_id` in `uploads` on the file request.
`path` (required)	query	string	A file’s `path` inside the upload, or a folder’s ending in `/`, as the contents endpoint lists them.
`preview`	query	string: `1`	Ignored for API tokens, which always get the file as an attachment. In a browser, `1` shows content the browser can display inline.

Response 200

The file, with its Content-Length, or the folder as a ZIP built as it downloads, without one.

Content type application/octet-stream.

Content type application/zip.

Errors

Status	When	Example message
400	`path` is missing.	“path is required”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, or may not reach this item.
404	No such file request, the upload isn’t part of it, or the path isn’t in it.	“File not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

File requests API

Create a file request

Request body

Response 200

Errors

List file requests

Parameters

Response 200

Errors

Get a file request

Parameters

Response 200

Errors

Update a file request

Parameters

Request body

Response 200

Errors

Delete a file request

Parameters

Response 200

Errors

Mark uploads as seen

Parameters

Response 200

Errors

Invite people

Parameters

Request body

Response 200

Errors

Change a person’s email address

Parameters

Request body

Response 200

Errors

Remove a person

Parameters

Response 200

Errors

Send reminders

Parameters

Request body

Response 200

Errors

Download everything received

Parameters

Response 200

Response 302

Errors

Download a selection

Parameters

Request body

Response 200

Response 302

Errors

Share received files

Parameters

Request body

Response 200

Errors

List received files

Parameters

Response 200

Errors

Download an upload

Parameters

Response 200

Response 206

Response 302

Errors

Delete an upload

Parameters

Response 200

Errors

List files in an upload

Parameters

Response 200

Errors

Download a file or folder from an upload