API Keys
The Filedgr partner API authenticates every request with a key and secret pair, sent as two headers. There are no anonymous endpoints.
| Header | Value |
|---|---|
x-api-key | Your API key (UUID) |
x-api-secret | Your API secret (UUID) |
curl https://api.filedgr.network/vaults \
-H "x-api-key: 00000000-0000-0000-0000-000000000000" \
-H "x-api-secret: 11111111-1111-1111-1111-111111111111"
Both headers are required on every route. The secret is compared in constant time; a missing or mismatched header returns 403, and a key that does not resolve to a user with an entity returns 404.
Obtaining credentials
Contact Filedgr to have a key and secret issued for your entity. There is currently no self-service way to create one — no API endpoint issues API-key credentials, and the credential-creation endpoint explicitly rejects them.
The secret is shown once at issuance and is never returned by any API response, so store it immediately. There is no endpoint to list, rotate or revoke keys; contact Filedgr if a key is compromised.
Your API key is the principal
This is the most important thing to understand about the API:
The key identifies you. Path segments that name a user are resolved to the key holder.
GET /users/{user_id}/favorites/type/VAULT returns your favorites regardless of the user_id
you put in the path. The same applies to /users/{user_id}/entities and
/users/{user_id}/invitations. You cannot read or modify another user's data by changing the id,
and you should not build logic that assumes otherwise.
Tenancy: entities
Everything you create — vaults, assets, webhooks, credits — belongs to an entity, not to a user directly. Your API key resolves to a user, and that user's entity is what owns the data.
GET /entities and GET /users/{user_id}/entities list the entities you belong to.
Although those endpoints return a list, the partner API always acts as your first entity. There is no way to select which entity a request applies to. If your account belongs to more than one, the others are unreachable through this API — use a key belonging to the right account instead.
A key that resolves to no entity at all returns 404, not 403. Entity scoping is also why 404 is the standard response for a resource that exists but is not yours — the API does not distinguish "not found" from "not yours", by design.
Server-to-server only
x-api-key and x-api-secret are not in the API's CORS Access-Control-Allow-Headers allowlist.
Browser requests will fail preflight. Call this API from your backend, and never ship these
credentials to a client application.
Base URLs
| Environment | Base URL |
|---|---|
| Production | https://api.filedgr.network |
| Development | https://api.dev.filedgr.network |
| Test | https://api.test.filedgr.network |