File Management

Stashly organizes files into buckets. Each bucket contains objects (files and directories). You can manage them via the REST API using JWT authentication or a scoped API key.

Buckets#

GET/api/bucketsJWT or API Key

List all buckets accessible to the authenticated user or API key.

200Bucket list
{
  "success": true,
  "data": [
    { "id": "bkt_01j9", "name": "assets", "fileCount": 42, "size": 128000000 }
  ]
}
POST/api/bucketsJWT or API Key

Create a new bucket. Bucket names must be unique within a tenant.

Request Body

NameTypeDescription
name*stringUnique bucket name (lowercase, hyphens allowed)
201Bucket created
{ "success": true, "data": { "id": "bkt_02k1", "name": "uploads" } }
PATCH/api/buckets/:idJWT or API Key

Rename a bucket.

Request Body

NameTypeDescription
name*stringNew bucket name
DELETE/api/buckets/:idJWT or API Key

Delete a bucket and all its contents. This action is irreversible.

✕

Destructive

Deleting a bucket permanently removes all files inside it. There is no recovery.


Objects (Files & Directories)#

All object routes are scoped under a bucket: /api/buckets/:bucketId/objects.

GET/api/buckets/:bucketId/objectsJWT or API Key

List objects inside a bucket. Supports pagination and path prefix filtering.

Query Parameters

NameTypeDescription
prefixstringFilter objects by path prefix (e.g. images/)
pagenumberPage number (default: 1)
limitnumberItems per page (default: 20, max: 100)
200Object list
{
  "success": true,
  "data": [
    { "id": "obj_01j9", "name": "photo.jpg", "size": 2048000, "type": "file" },
    { "id": "obj_02k1", "name": "images/", "type": "directory" }
  ]
}
POST/api/buckets/:bucketId/objects/directoryJWT or API Key

Create an empty directory inside a bucket.

Request Body

NameTypeDescription
path*stringDirectory path (e.g. images/thumbnails/)
GET/api/buckets/:bucketId/objects/presignedJWT or API Key

Generate a time-limited presigned URL for public file access.

Query Parameters

NameTypeDescription
key*stringObject key (file path within bucket)
expiresInnumberURL validity in seconds (default: 3600)
200Presigned URL
{
  "success": true,
  "data": {
    "url": "https://cdn.stashly.io/api/serve?token=hmac_...",
    "expiresAt": "2025-05-29T15:00:00Z"
  }
}
GET/api/buckets/:bucketId/objects/downloadJWT or API Key

Directly download a file. Returns the file binary with appropriate Content-Type headers.

Query Parameters

NameTypeDescription
key*stringObject key (file path within bucket)
PATCH/api/buckets/:bucketId/objectsJWT or API Key

Rename a file or directory.

Request Body

NameTypeDescription
key*stringCurrent object key
newKey*stringNew object key
PATCH/api/buckets/:bucketId/objects/moveJWT or API Key

Move an object to a different path within the same bucket.

Request Body

NameTypeDescription
key*stringSource key
destination*stringDestination path
POST/api/buckets/:bucketId/objects/copyJWT or API Key

Copy an object to a new key within the same bucket.

DELETE/api/buckets/:bucketId/objectsJWT or API Key

Move an object to trash. It can be restored from the Trash API.

Request Body

NameTypeDescription
key*stringObject key to delete

Bulk Operations#

DELETE/api/buckets/:bucketId/objects/bulkJWT or API Key

Delete multiple objects in a single request.

Request Body

NameTypeDescription
keys*string[]Array of object keys to delete
PATCH/api/buckets/:bucketId/objects/bulk-moveJWT or API Key

Move multiple objects to a destination directory.

POST/api/buckets/:bucketId/objects/bulk-copyJWT or API Key

Copy multiple objects to a destination directory.


Trash#

Deleted files go to trash before permanent removal.

GET/api/trashJWT Required

List items currently in trash.

PATCH/api/trash/:id/restoreJWT Required

Restore an item from trash back to its original location.

DELETE/api/trash/emptyJWT Required

Permanently delete all items in trash. This is irreversible.

DELETE/api/trash/:id/permanentJWT Required

Permanently delete a single trash item.


Serving Files Publicly#

GET/api/serve

Serve a file using a presigned token. This endpoint is public — use presigned URLs to share files externally.

Query Parameters

NameTypeDescription
token*stringHMAC-signed presigned token from /objects/presigned