You are reading the documentation of FileRun 2026.4.0, which is not released yet. It is subject to change, so do not use it for planning. Go to the documentation of FileRun 2026.3.0

FileRun 2026.4, API changes🔗

This page lists the API endpoints added and changed since FileRun 2026.3.0. For the changes of FileRun 2026.3.0, see API changes in 2026.3.

Version 2026.4.0🔗

New permissions🔗

The permission to make changes, changes, is split into eight permissions: edit_files, rename_move, delete_files, delete_folders, delete_permanently, collections, starring and write_metadata. The user and role endpoints take and hand out the eight, and each file endpoint asks for the one of its action. changes is still accepted from older clients. See Add FileRun user accounts for what each permission covers.

The permission admin_shared_drives lets a simple administrator use the shared drives endpoints.

New paths🔗

The shared drives are reached at /ROOT/DRIVES/{id}, and the trash of a drive at /ROOT/DRIVES_TRASH/{id}, where {id} is the id of the drive. /ROOT/DRIVES lists the drives the account is a member of. See File paths.

New endpoints🔗

Changed on every endpoint🔗

• A write that the space quota refuses is answered with the status 507 Insufficient Storage instead of 403. The message in the answer is the same.

Changed endpoints🔗

The file endpoints and the new permissions🔗

• Renaming and moving require rename_move.
• Deleting requires delete_files for a file and delete_folders for a folder. Opening the trash and restoring from it require delete_files. Deleting from the trash and emptying it require delete_permanently as well.
• Starring and unstarring require starring. Changing tags and other metadata requires write_metadata.
• Locking and unlocking require one of edit_files, rename_move and delete_files. See Locking files.

/api.php/Drive/files/move🔗

• Takes overwrite. Set to 1, a move onto an existing file replaces it, and a move onto an existing folder merges the two folders.
• Without overwrite, a move onto a name already taken is refused, and the refusal carries conflicts, the item in the way. See Moving files or folders.

/api.php/Drive/files/extract🔗

• No longer requires the permission to make changes: being allowed to download the archive and to upload into the folder is enough.
• Extracting over an existing file requires delete_files and the permission to upload into its folder. An account with the editor share role, without the permission to delete, can no longer extract over existing files. See Extracting archives.

/api.php/Drive/files/zip🔗

• No longer requires the permission to make changes. Adding to an existing archive requires edit_files. See Zipping files and folders.

/api.php/Drive/files/trash/empty🔗

• Takes an optional path, /ROOT/DRIVES_TRASH/{id}, to empty the trash of a shared drive. See Managing the trash.

/api.php/Drive/files/browse🔗

• hasStar requires the starring permission.
• A listing of the trash carries trash_deleted_by, the public id of the account that deleted the item, and trash_deleted_by_name. Both are empty for the items deleted before FileRun 2026.4.0.
• hasThumb answered the opposite of the truth. It is fixed.
• weblink-full carried the password of the link under download_limit. It carries the download limit now.

/api.php/Drive/files/share🔗

• Takes download_limit, the number of downloads, and access_period, a length in seconds, for a file shared with a guest. Both are refused for a share with a group or with a user who is not a guest. See Sharing files and folders.

/api.php/Drive/files/weblink🔗

• An expiry that is not a valid date is refused with a message saying so. It gave a database error.

/api.php/Drive/files/search🔗

• A content search with a keyword that the search server cannot read is answered with the status 400, and the message gives the reason of the search server.

/api.php/Drive/files/thumbnail🔗

• A request without width and height gets a thumbnail of the default size.

/api.php/Core/account/info🔗

• perms lists the eight permissions. readOnly is still returned, worked out from rename_move, delete_files and delete_folders. See Getting user account information.

/api.php/Core/users/search🔗

• Is for administrators only, and requires the admin scope. Any other account finds the people it can share with through the new Drive/users/search, with the share scope. See Search user accounts.

/api.php/Core/!admin/users/add and /api.php/Core/!admin/users/edit🔗

• Take the eight permissions and admin_shared_drives. perms[changes] sets rename_move, delete_files, delete_folders and delete_permanently, except the ones the request sends itself.
• The edit endpoint stores a permission left out as 0, so an edit that sends only perms[changes] turns off edit_files, collections, starring and write_metadata.
• A permission that means nothing without another one is stored as 0 when that one is 0, such as share without download. See Add FileRun user accounts.
• Take data[language], the language of the e-mail messages to the account, and data[require_email_otp], an e-mail code at every sign-in. Left out of an edit, data[require_email_otp] is turned off.
• The add endpoint says in its answer when the e-mail with the sign-in details could not be sent.
• The edit endpoint refuses the account of a shared drive.

/api.php/Core/!admin/users/info🔗

• last_access_date is renamed last_web_ui_access, with the same value.
• The response carries last_seen, the time of the last activity of any kind, language and require_email_otp.
• perms holds the eight permissions and admin_shared_drives, and no longer readonly. See Get FileRun user account information.

/api.php/Core/!admin/users/edit_groups🔗

• In the answer, add_to_group lists only the groups joined by the request, and the new remove_from_group lists the groups left.
• Leaving a group removes the folder notifications, the web links and the stars of the account inside the shares of the group.

/api.php/Core/!admin/users/delete🔗

• A refused deletion carries the reason in the message of the account.

/api.php/Core/!admin/roles/info, /api.php/Core/!admin/roles/add and /api.php/Core/!admin/roles/edit🔗

• The home folder path template is named drive_homefolder_template. The old name, homefolder, is still handed out and accepted, and will be removed in a future version.
• Take and hand out the eight permissions and admin_shared_drives. The info endpoint still hands out changes and readonly.
• On the Guest role, edit_files, collections and starring can be granted. See Managing roles.

/oauth2/token/🔗

• An error no longer has the message field. Read error_description.
• A refresh token that is expired, revoked or issued to another application is answered with the invalid_grant error and the status 400, where it was invalid_request and 401. An expired or revoked authorization code is answered with invalid_grant too.
• A password grant with an empty username is refused with invalid_request.

/oauth2/authorize/🔗

• A request refused for a scope that does not exist is sent back to the application with its state.
• A request for the metadata or the comments scope without all of list, upload, download, modify and delete no longer fails with an error.

Removed: the PHP API client library🔗

• The PHP API client library (apps/Drive/!classes/vendor/FileRun/API/Client) is no longer part of the installation package.