ExaVault API v2.0

---

The Legacy ExaVault API 2.0 documentation page is the best starting point for legacy ExaVault API reference. Any API methods that were not used by any customers as of 2022 were discontinued in 2023.

The list of methods still supported is as follows:

• POST /users (Create a user)
• GET /users (Get a list of users)
• GET /users/{id} (Get info for a user)
• DELETE /users/{id} (Delete a user)
• PATCH /users/{id} (Update a user)
• GET /resources/list (Get a list of all resources)
• GET /resources/{id} (Get resource metadata)
• PATCH /resources/{id} (Rename a resource)
• DELETE /resources/{id} (Delete a resource)
• DELETE /resources (Delete resources)
• POST /resources (Create a folder)
• GET /resources (Get resource properties)
• GET /resources/list/{id} (List contents of a folder)
• POST /resources/copy (Copy resources)
• POST /resources/move (Move resources)
• GET /resources/preview (Preview a file)
• POST /resources/upload (Upload a file)
• GET /resources/download (Download a file)
• GET /account (Get account settings)
• POST /shares (Create a share)
• GET /shares (Get a list of shares)
• GET /shares/{id} (Get info for a share)
• PATCH /shares/{id} (Update a share)
• DELETE /shares/{id} (Delete a share)

The hostname of api.exavault.com was not officially supported on the legacy platform for version 2.0, but happened to work due to that network's configuration. After your account has migrated to the modern platform, you must use your account's subdomain address, such as accountname.exavault.com or accountname.files.com, for all legacy version 2.0 calls.

The include parameter is not supported for operations that previously accepted it, and will be ignored. The included property of a response will always be an empty array.

The relationships property of a response will contain placeholders and not actual IDs of related records.

There is no master user on the Files platform, only admin and user.

User permissions are approximations of the permissions available to users on Files.com, so some combinations of permissions are no longer supported e.g., it is not possible to create a user who has "upload" but not "list" permissions, so users with "upload" permissions will be automatically granted "list" permissions.

If a user has "download" permissions, they will always have "notification" rights.

Users will always have "changePassword" permissions.

The email address for users is always required.

Inputs that accept "resource identifiers" do not accept the "hash:STRING" format. Only "id:INTEGER" and "/path/to/file" are accepted.

Multi-Status responses (for POST /resources/copy, POST /resources/move and DELETE /resources) are not supported. If an operation is partially successful, you will receive an error message for the first failure rather than a multi-status response. When this happens, the response will not include information about any files that were successfully processed or any files that were not attempted.

The hash and createdby attributes for resources of type "file" is not supported and will always be empty in a returned Resource object.

The filecount and size attributes for resources of type "dir" is not supported and will always be empty in a returned Resource object.

If the nickname is not specified, it will not default to the username (will be null).

If an empty permissions object is provided, it will create a user with no permissions rather than returning an error.

"UTC" is not a valid option for the timeZone parameter.

The email parameter is always required to be a valid email, regardless of the user permissions.

The welcomeEmail parameter is ignored, and a welcome email is always sent.

Passwords cannot be set to common words or passwords which have been published on the dark web.

The include parameter is not supported and the included array in the response will always be empty.

The user with the role master will be listed as having role admin.

The homeResource filter parameter must not be prefixed with a leading slash when filtering for users having a specific home directory.

The status filter parameter is not supported.

The email filter parameter does not support wildcards.

Sorting the list by nickname, username, email, or homeDir is case-insensitive.

Attempting to list a user with a name taken by another account will result in a 404 NOT FOUND error rather than a 403 ACCESS DENIED error.

The include parameter is not supported and the included array in the response will always be empty.

The user with the role master will be listed as having role admin.

There is no master user on red, so it is now possible to remove the user who has the same name as the account.

Admin users can now edit any user, including the master user.

Email addresses can be removed from a user by setting the `email` to an empty string ("")

Passwords cannot be set to common words or passwords which have been published on the dark web.

UTC is not a valid option for the timeZone parameter.

The expiration value must be in the future.

Non-admin users cannot change their own user settings.

The name filter cannot be used to search recursively through a folder or the entire account.

The name filter does not support wildcard characters.

The list of results cannot be sorted by file type (extension).

The name filter does not support wildcard characters.

The list of results cannot be sorted by file type (extension).

When a resource cannot be deleted, the meta.id property in the errors array of the response will be a string rather than an integer.

The include parameter is not supported and the included array in the response will always be empty.

Only administrator users can use the method to retrieve details about the site.

The data.attributes.clientId value in the response will return null

The data.attributes.maxUsers value in the response will return 999999999999999

The values in data.attributes.quota will consist of placeholder values. You can no longer rely on data.attributes.quota.diskUsed to track the amount of storage space used by the account.

The resources parameter is now required.

It is no longer possible to send a file directly from your device using this endpoint.