File Management
Stashly organizes files into buckets. Each bucket contains objects (files and directories). You can manage them via the REST API using JWT authentication or a scoped API key.
Buckets#
/api/bucketsJWT or API KeyList all buckets accessible to the authenticated user or API key.
{
"success": true,
"data": [
{ "id": "bkt_01j9", "name": "assets", "fileCount": 42, "size": 128000000 }
]
}
/api/bucketsJWT or API KeyCreate a new bucket. Bucket names must be unique within a tenant.
Request Body
| Name | Type | Description |
|---|---|---|
name* | string | Unique bucket name (lowercase, hyphens allowed) |
{ "success": true, "data": { "id": "bkt_02k1", "name": "uploads" } }
/api/buckets/:idJWT or API KeyRename a bucket.
Request Body
| Name | Type | Description |
|---|---|---|
name* | string | New bucket name |
/api/buckets/:idJWT or API KeyDelete a bucket and all its contents. This action is irreversible.
Destructive
Deleting a bucket permanently removes all files inside it. There is no recovery.
Objects (Files & Directories)#
All object routes are scoped under a bucket: /api/buckets/:bucketId/objects.
/api/buckets/:bucketId/objectsJWT or API KeyList objects inside a bucket. Supports pagination and path prefix filtering.
Query Parameters
| Name | Type | Description |
|---|---|---|
prefix | string | Filter objects by path prefix (e.g. images/) |
page | number | Page number (default: 1) |
limit | number | Items per page (default: 20, max: 100) |
{
"success": true,
"data": [
{ "id": "obj_01j9", "name": "photo.jpg", "size": 2048000, "type": "file" },
{ "id": "obj_02k1", "name": "images/", "type": "directory" }
]
}
/api/buckets/:bucketId/objects/directoryJWT or API KeyCreate an empty directory inside a bucket.
Request Body
| Name | Type | Description |
|---|---|---|
path* | string | Directory path (e.g. images/thumbnails/) |
/api/buckets/:bucketId/objects/presignedJWT or API KeyGenerate a time-limited presigned URL for public file access.
Query Parameters
| Name | Type | Description |
|---|---|---|
key* | string | Object key (file path within bucket) |
expiresIn | number | URL validity in seconds (default: 3600) |
{
"success": true,
"data": {
"url": "https://cdn.stashly.io/api/serve?token=hmac_...",
"expiresAt": "2025-05-29T15:00:00Z"
}
}
/api/buckets/:bucketId/objects/downloadJWT or API KeyDirectly download a file. Returns the file binary with appropriate Content-Type headers.
Query Parameters
| Name | Type | Description |
|---|---|---|
key* | string | Object key (file path within bucket) |
/api/buckets/:bucketId/objectsJWT or API KeyRename a file or directory.
Request Body
| Name | Type | Description |
|---|---|---|
key* | string | Current object key |
newKey* | string | New object key |
/api/buckets/:bucketId/objects/moveJWT or API KeyMove an object to a different path within the same bucket.
Request Body
| Name | Type | Description |
|---|---|---|
key* | string | Source key |
destination* | string | Destination path |
/api/buckets/:bucketId/objects/copyJWT or API KeyCopy an object to a new key within the same bucket.
/api/buckets/:bucketId/objectsJWT or API KeyMove an object to trash. It can be restored from the Trash API.
Request Body
| Name | Type | Description |
|---|---|---|
key* | string | Object key to delete |
Bulk Operations#
/api/buckets/:bucketId/objects/bulkJWT or API KeyDelete multiple objects in a single request.
Request Body
| Name | Type | Description |
|---|---|---|
keys* | string[] | Array of object keys to delete |
/api/buckets/:bucketId/objects/bulk-moveJWT or API KeyMove multiple objects to a destination directory.
/api/buckets/:bucketId/objects/bulk-copyJWT or API KeyCopy multiple objects to a destination directory.
Trash#
Deleted files go to trash before permanent removal.
/api/trashJWT RequiredList items currently in trash.
/api/trash/:id/restoreJWT RequiredRestore an item from trash back to its original location.
/api/trash/emptyJWT RequiredPermanently delete all items in trash. This is irreversible.
/api/trash/:id/permanentJWT RequiredPermanently delete a single trash item.
Serving Files Publicly#
/api/serveServe a file using a presigned token. This endpoint is public — use presigned URLs to share files externally.
Query Parameters
| Name | Type | Description |
|---|---|---|
token* | string | HMAC-signed presigned token from /objects/presigned |