Documentation

• Welcome
• User guide
• Admin guide
• FileRun homepage
• Changelog
• Contact us

Install

• Requirements
• Install guides
• Docker installation
• Manual installation
• PHP configuration
  • PHP compatibility
  • PHP upgrade
  • ionCube loader
• Troubleshooting
• Reverse proxies
• Securing FileRun
• Server optimization

Configure

• Setting the time zone
• System settings
• Sign-in and passwords
• User sign-up
• Storage quotas
• Data retention
• File settings
• Enabling thumbnails and preview
  • Troubleshooting thumbnails
• E-mail notification system
• File preview options
  • File plugins
• File indexing
• Authentication integration
  • OpenID Connect
  • Authentik
  • OAuth2
  • LDAP
  • Active Directory
  • SimpleSAMLphp
  • Microsoft Entra ID
  • Google
  • Dropbox
  • Box.com
• Two-factor authentication
• Advanced configuration

Customize

• Branding
• Theme colors
• Favicons
• Custom CSS
• Translating FileRun
• Custom event scripts

Using FileRun

• File searching
• Metadata
• Organizing files
• Collections
• The media libraries
• The trash
• File-based activity logs
• Screenshot sharing
• Guest accounts
• Your account settings
  • App passwords

Access methods

• Desktop sync
• Mobile apps
• WebDAV

Collaborative editing

• Overview
• Collabora Online
• ONLYOFFICE Docs
• Microsoft 365
• Zoho Editor
• Google Docs Editor

The API

• Introduction
• File paths
• API Methods
• Migrating from an older version
• Changes in 2026.3

Maintenance

• Resetting the superuser password
• Updating FileRun
• Backing up the installation
• Changing database connection information
• Deleting old user files
• Migrating to another server
• Command line tools

• FileRun 2026.3, API changes
  • Version 2026.3.0
    • New scope: comments
    • New endpoints
    • Changed endpoints
      • /api.php/Drive/files/delete
      • /api.php/Drive/files/metadata/fields
      • /api.php/Core/account/info
      • /api.php/Core/!admin/users/add and /api.php/Core/!admin/users/edit
      • /api.php/Core/!admin/users/info
      • /api.php/Core/!admin/users/edit_groups
      • /api.php/Core/!admin/users/!super/app_password
      • /api.php/Core/users/search
      • Removed: /api.php/Core/account/password
  • Version 2026.3.1
    • New endpoint: /api.php/Drive/files/copy
    • /api.php/Drive/files/move
    • /api.php/Drive/files/extract and /api.php/Drive/files/zip
    • Permission names

FileRun 2026.3, API changes🔗

This page lists the API endpoints added and changed since FileRun 2026.2.1. For the changes introduced with FileRun 2026.1.0, see the migration guide.

Version 2026.3.0🔗

New scope: comments🔗

The file comments endpoints require the new comments scope. Request it together with the other scopes when obtaining the access token.

New endpoints🔗

Endpoint	Documentation
/api.php/Drive/files/lock	Locking files
/api.php/Drive/files/unlock	Locking files
/api.php/Drive/files/comments/list	File comments
/api.php/Drive/files/comments/add	File comments
/api.php/Drive/files/comments/delete	File comments
/api.php/Drive/files/tags/list	Listing tags
/api.php/Drive/files/tags/remove	Removing tags
/api.php/Drive/files/trash/item/restore	Managing the trash
/api.php/Drive/files/trash/item/delete	Managing the trash
/api.php/Drive/files/trash/empty	Managing the trash
/api.php/Core/!admin/users/deactivate	Deactivate FileRun user accounts
/api.php/Core/!admin/groups/search	Managing groups
/api.php/Core/!admin/groups/info	Managing groups
/api.php/Core/!admin/groups/add	Managing groups
/api.php/Core/!admin/groups/edit	Managing groups
/api.php/Core/!admin/groups/delete	Managing groups
/api.php/Core/!admin/groups/add_users	Managing groups
/api.php/Core/!admin/groups/remove_user	Managing groups
/api.php/Core/!admin/roles/info	Managing roles
/api.php/Core/!admin/roles/add	Managing roles
/api.php/Core/!admin/roles/edit	Managing roles
/api.php/Core/!admin/roles/delete	Managing roles

Changed endpoints🔗

/api.php/Drive/files/delete🔗

• When the item is moved to the trash, the response carries trash_path, the path by which the item can be restored or permanently deleted.

/api.php/Drive/files/metadata/fields🔗

• Requires the metadata scope and the account permission to access metadata. Any access token was accepted before. See Listing metadata fields.

/api.php/Core/account/info🔗

• The 2fa property is no longer returned.

/api.php/Core/!admin/users/add and /api.php/Core/!admin/users/edit🔗

• data[two_step_enabled] is renamed data[require_2fa].
• perms[change_pass] is renamed perms[change_auth].
• A role which grants administrative permissions can be assigned only by the superuser.
• Every group named in groups must be one the administrator is allowed to manage. Otherwise the request is refused before the account is created.
• The edit endpoint answers with the msg array, like the other endpoints.
• An edit request which does not send data[userIsActive] leaves the activation state of the account as it is. Before, such a request deactivated the account.
• data[two_step_reset] (set to 1) removes the second authentication factor of the account.
• Changing the password revokes the sessions, the OAuth2 tokens and the app passwords of the account.

/api.php/Core/!admin/users/info🔗

• The response no longer carries the password hash and the two-step authentication secrets.
• The response carries special_type, which is guest for a guest account. See Get FileRun user account information for the list of fields.

/api.php/Core/!admin/users/edit_groups🔗

• The administrator must be allowed to manage the account. Otherwise the request is refused. See Set the groups of a FileRun user account.

/api.php/Core/!admin/users/!super/app_password🔗

• Takes an optional name for the app password.
• Refuses to create an app password for the caller's own account, for guest accounts and for administrator accounts.
• The username returned is the public id of the account.

/api.php/Core/users/search🔗

• Only person accounts are returned: regular accounts and guest accounts. Internal accounts, such as the System account, are left out.

Removed: /api.php/Core/account/password🔗

• The endpoint for changing the password of the account is removed.

Version 2026.3.1🔗

New endpoint: /api.php/Drive/files/copy🔗

• Copies a file or a folder. See Copying files or folders.

/api.php/Drive/files/move🔗

• Takes the overwrite parameter. When set to 1, a move onto an existing file replaces it. See Moving files or folders.

/api.php/Drive/files/extract and /api.php/Drive/files/zip🔗

• Extracting and zipping no longer require the permission to make changes. Being allowed to download the source and to upload into the target folder is enough.
• Extracting over a file which already exists requires that the account is allowed to delete that file and to upload into its folder. An account holding the editor share role on a folder, without the permission to rename, move and delete, cannot extract over existing files any more.

Permission names🔗

The permission "User can make changes to files and folders" (perms[changes] on the user and role endpoints, readonly in the stored records) is split into five permissions:

Name	Meaning
edit_files	Edit existing files, including managing their previous versions
rename_move_delete	Rename, move and delete files and folders, including the trash and writing over existing files
collections	Create and manage collections and photo albums
starring	Star files and folders
write_metadata	Change tags, ratings and other metadata

• The user endpoints (!admin/users/add, !admin/users/edit) and the role endpoints (!admin/roles/add, !admin/roles/edit) take the five names. perms[changes] is still accepted, as an alias of rename_move_delete.
• !admin/roles/info and !admin/users/info hand out the five names. readonly and changes are still handed out as aliases of rename_move_delete.
• account/info lists the five names under permissions. readOnly is still returned, as the negation of rename_move_delete.
• Clients are recommended to move to the new names. An edit through the user endpoints which still sends only changes stores the other four permissions of the edited account as 0, because those endpoints rebuild the whole permissions record from the request. The role endpoints write only what the request names, so they are not affected.