You are reading the documentation of FileRun 2026.4.0, which is not released yet. It is subject to change, so do not use it for planning. Read this page for FileRun 2026.3.0

FileRun 2026.3, API changes🔗

This page lists the API endpoints added and changed since FileRun 2026.2.1. For the changes introduced with FileRun 2026.1.0, see the migration guide.

Version 2026.3.0🔗

New scope: comments🔗

The file comments endpoints require the new comments scope. Request it together with the other scopes when obtaining the access token.

New endpoints🔗

Changed endpoints🔗

/api.php/Drive/files/delete🔗

• When the item is moved to the trash, the response carries trash_path, the path by which the item can be restored or permanently deleted.

/api.php/Drive/files/metadata/fields🔗

• Requires the metadata scope and the account permission to access metadata. Any access token was accepted before. See Listing metadata fields.

/api.php/Core/account/info🔗

• The 2fa property is no longer returned.

/api.php/Core/!admin/users/add and /api.php/Core/!admin/users/edit🔗

• data[two_step_enabled] is renamed data[require_2fa].
• perms[change_pass] is renamed perms[change_auth].
• A role which grants administrative permissions can be assigned only by the superuser.
• Every group named in groups must be one the administrator is allowed to manage. Otherwise the request is refused before the account is created.
• The edit endpoint answers with the msg array, like the other endpoints.
• An edit request which does not send data[userIsActive] leaves the activation state of the account as it is. Before, such a request deactivated the account.
• data[two_step_reset] (set to 1) removes the second authentication factor of the account.
• Changing the password revokes the sessions, the OAuth2 tokens and the app passwords of the account.

/api.php/Core/!admin/users/info🔗

• The response no longer carries the password hash and the two-step authentication secrets.
• The response carries special_type, which is guest for a guest account. See Get FileRun user account information for the list of fields.

/api.php/Core/!admin/users/edit_groups🔗

• The administrator must be allowed to manage the account. Otherwise the request is refused. See Set the groups of a FileRun user account.

/api.php/Core/!admin/users/!super/app_password🔗

• Takes an optional name for the app password.
• Refuses to create an app password for the caller's own account, for guest accounts and for administrator accounts.
• The username returned is the public id of the account.

/api.php/Core/users/search🔗

• Only person accounts are returned: regular accounts and guest accounts. Internal accounts, such as the System account, are left out.

Removed: /api.php/Core/account/password🔗

• The endpoint for changing the password of the account is removed.