Files.fm Cloud Storage API

Files.fm is a cloud storage platform with an HTTPS REST API (GET/POST), plus FTP/FTPS, WebDAV, and CalDAV/CardDAV calendar and address-book APIs. This document is the single source of truth for the Files.fm API. It merges the modern REST API V2 (recommended for new integrations) with the legacy V1 endpoints (kept for compatibility), and is intended for both human programmers and LLM/AI agents.

The content is verified against the live code: the V2 router api/v2/index.php, the V1 scripts under api/, and the shared authenticator api/authenticate_user.php. The REST V2 and integration sections also derive from Files.fm_API_docs_EN_v.1.9.5.pdf (version 1.9.5, dated 2026-05-01); legacy V1 endpoints derive from the public API reference page and the live /api/ scripts. Concrete access tokens and hashes in examples are placeholders.

For new integrations, prefer API V2 where available. The legacy V1 endpoints remain documented because many of them have no V2 equivalent (thumbnails, recursive tree, ZIP download, versions, sharing, embedding, and more).

REST API Overview

Base API host:

https://api.files.fm

Web links and the file browser use the base web host https://files.fm. Localized web subdomains are supported for share links, for example https://es.files.fm/u/{folder_hash} and https://de.files.fm/u/{folder_hash}.

Routing model

The API is reachable through three URL styles. Knowing which style an endpoint uses avoids most "404 / wrong path" problems.

The api_v2/{action} form is a clean-URL rewrite to the single dispatcher api/v2/index.php; the action may also be passed as a GET/POST parameter. Prefer POST for API parameters unless an endpoint explicitly documents GET as accepted. Successful REST responses are JSON unless the endpoint returns raw file content (such as download_file); a few legacy endpoints return plain text.

Common Integration Flow

1. Generate an API key at https://files.fm/account#api_keys or use a dedicated user/service account.
2. Create a folder with create_folder; store folder_hash, folder_edit_key, and folder_upload_key in your own database.
3. Upload files with upload_file using authentication or the folder upload key.
4. List or inspect content with get_folder_content, get_file_info, and get_folder_info.
5. Download files with download_file.
6. Rename, move, delete, or restore files/folders as needed.

Important Concepts

• Every file and folder has a unique hash. Treat file and folder hashes as opaque, variable-length strings: preserve and transmit the complete value returned by the API, and do not validate or branch on its length. Store hashes and the corresponding edit/upload/delete keys in your own system.
• Keys and their meaning:
  • Folder hash identifies a folder (also called an "upload"). Example: hash=k7m2q9r4t6v8w3xy.
  • File hash identifies a file. Example: i=p4s7u2w9x3y6z8ab in download links.
  • add_key / folder_upload_key / AddFileKey is an opaque capability that allows uploading new files into a folder without full access.
  • delete_key / folder_edit_key / DeleteKey is an opaque capability that allows editing/deleting the folder and its files (subject to access rights).
  • Newly created folder keys are independent 32-character lowercase hexadecimal values. Preserve and transmit them exactly; older folders can still have shorter keys.
  • File edit/delete key (file_delete_key) is used for file edits/replacements; newly created keys are 32-character lowercase hexadecimal capabilities, while legacy shorter keys remain valid. A folder edit key also works where supported.
• ROOT folder: every account has exactly one ROOT folder (DisplayName = "ROOT", ParentID = 0). It is always private, cannot be renamed or deleted, and is the default parent when you create a folder without parent_folder_hash. Its hash and keys are returned at login (see "ROOT folder and account info").
• Access types: PRIVATE, LINK, PASSWORD, and PUBLIC where supported.
  • LINK allows reading/listing/downloading by anyone who knows the hash/link.
  • PRIVATE requires authorization and explicit rights.
  • PASSWORD requires the folder password (passed as password).
• Files and folders created through the API can also be managed in the Files.fm UI at https://files.fm/filebrowser.
• API requests may be rate-limited or blocked by automated web firewall checks if request patterns look abusive.
• Business and Enterprise integrations needing higher limits, dedicated access rules, or production support should contact [email protected].

Authorization

Authentication is handled centrally by api/authenticate_user.php, which is included by both the V2 router and the V1 scripts. It accepts the following methods (checked in roughly this order). Any one of them is enough; always use HTTPS.

When authenticate_user.php is called as a standalone endpoint (no API_APP constant), it returns a JSON object:

{
  "Success": true,
  "Message": null,
  "SessionID": "PHPSESSID_VALUE"
}

Generating an API access token

Pass get_user_access_token to a successful login call (for example api/login.php or api/authenticate_user.php) to mint a token for the authenticated user; it is returned as UserData.user_access_token. Tokens can also be created and revoked in account settings at https://files.fm/account#api_keys. Keep tokens confidential and rotate them if leaked.

Two-factor authentication (2FA)

If the account requires 2FA, a successful credential check does not immediately grant a session. The API sends a confirmation link by email and waits briefly for the same IP to be confirmed:

• Standalone JSON response while pending: {"Success": false, "Status": "two_factor_auth_required", "Message": "Two-factor auth required"}.
• When included by another API script: the request exits with HTTP 403 and a TWO_FACTOR_REQURIED: 1 header.

Confirm the emailed link from the same IP, then retry the request. A token-based login for a service account bypasses the 2FA demand.

Security notes

• Abusive or blacklisted source IPs and password-guessing patterns are throttled or blocked.
• Account creation via api/register.php is disabled; OAuth/SSO first-login auto-provisioning is the only API path that creates accounts.

HTTP Status Codes

Endpoint Summary

These are all the actions accepted by the V2 router api/v2/index.php. All use the /api_v2/{action} URL. All require authorization except upload_file and download_file (which can also work with a folder upload key or LINK access respectively).

Restore/undelete is not a V2 action; use the legacy scripts api/undelete_folder.php and api/undelete_file.php (see "Legacy V1 Endpoints").

The metadata/listing actions get_file_info, get_folder_info, and get_folder_content accept an optional get_access_rights flag that adds an access_rights object to each item (see those endpoints).

Quick Start

For new integrations, use the V2 storage quickstart, with token authentication in POST form fields. DVS uses a separate JSON API and tasks quickstart; MCP Bearer auth is not REST V2 auth.

V2 does not decode arbitrary JSON request bodies. Use application/x-www-form-urlencoded or multipart upload as documented. V2 errors can have an empty body; check HTTP status before parsing JSON. No universal REST request quota or idempotency-key contract is published. Reconcile uncertain writes before retrying.

A legacy create -> upload -> list -> download flow for existing V1 integrations. For new integrations, use the V2 quickstart linked above. Passwords in URL examples below are compatibility illustrations; use token authentication in POST fields for automation.

1. Create a folder

GET /api/get_upload_id.php

https://api.files.fm/api/get_upload_id.php?user=demo&pass=demo&folder_name=my_folder_name&access_type=LINK

The response includes a folder hash and keys (add_key, delete_key). Store them for later calls.

{"hash":"k7m2q9r4t6v8w3xy","delete_key":"4f27a1d86c90be3571432aef69d8c504","add_key":"a93c520b7408ed16f25d69401b7ace38","UserID":11315}

Public folder link: https://files.fm/u/{folder_hash}. Public file link: https://files.fm/f/{file_hash}.

2. Upload a file

POST /save_file.php?up_id={folder_hash}&key={add_key}&get_file_hash

curl -i -F 'file=@/tmp/local-file.txt' 'https://api.files.fm/save_file.php?up_id=k7m2q9r4t6v8w3xy&key=a93c520b7408ed16f25d69401b7ace38&get_file_hash'

Upload one file per request. With get_file_hash, the response is the uploaded file hash.

3. List folder contents

GET /api/get_file_list_for_upload.php?hash={folder_hash}&include_folders=1

4. Download a file

GET /down.php?i={file_hash}

5. Log in (session + ROOT keys)

GET|POST /api/login.php?user=demo&pass=demo

ROOT Folder and Account Info

Every account has a single ROOT folder: DisplayName = "ROOT", ParentID = 0. It is always private, cannot be renamed or deleted, and is the implicit parent when create_folder is called without parent_folder_hash.

To obtain the ROOT hash/keys and account details, authenticate and request user data. Calling api/authenticate_user.php (standalone, with any auth method) returns a UserData object. Add get_user_access_token to also mint an API token.

GET https://api.files.fm/api/authenticate_user.php?user=demo&pass=demo&get_user_access_token=1

UserData fields:

Note: the lightweight api/login.php endpoint returns the ROOT info as a plain-text cookie string (PHPSESSID, user, hash, ID, email, root_upload_hash, root_upload_key), not JSON. Use api/authenticate_user.php for the structured UserData object.

REST Endpoints

create_folder

Creates a new folder in the user's account and sets its access rights.

POST https://api.files.fm/api_v2/create_folder

Authorization: mandatory.

Parameters:

Example:

curl -sS --max-time 25 -X POST 'https://api.files.fm/api_v2/create_folder' \
  -d 'user=YOUR_USERNAME' \
  -d 'user_access_token=YOUR_API_TOKEN' \
  -d 'folder_name=MY_FOLDER_NAME' \
  -d 'access_type=PRIVATE'

Success response:

{
  "folder_hash": "k7m2q9r4t6v8w3xy",
  "folder_edit_key": "xxxxxxxx",
  "folder_upload_key": "xxxxx",
  "folder_name": "Name given"
}

Response fields:

Folder access link example:

https://files.fm/u/{folder_hash}

Errors: standard status codes from the REST overview.

upload_file

Uploads a file to an existing folder. Create a target folder before uploading. Do not upload files directly to ROOT; it is always private. Upload limits may apply by account tier.

POST https://api.files.fm/api_v2/upload_file
Content-Type: multipart/form-data

Authorization: optional if folder_upload_key is provided and valid; otherwise authenticate the user.

Parameters:

Upload using folder upload key:

curl -X POST 'https://api.files.fm/api_v2/upload_file' \
  -F 'folder_hash=TARGET_FOLDER_HASH' \
  -F 'folder_upload_key=TARGET_ADD_KEY' \
  -F 'file=@/path/to/local/file.pdf'

Upload using account credentials/token:

printf 'upload_file API test at %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" | \
curl -sS --max-time 40 -X POST 'https://api.files.fm/api_v2/upload_file' \
  -F 'user=YOUR_USERNAME' \
  -F 'user_access_token=YOUR_API_TOKEN' \
  -F 'folder_hash=TARGET_FOLDER_HASH' \
  -F 'file=@-;filename=api_v2_upload_test.txt;type=text/plain'

Success response:

{
  "file_hash": "p4s7u2w9x3y6z8ab",
  "file_delete_key": "70f25e31fa7963c4a2bb761e1f9d8095",
  "file_name": "api_v2_upload_test (2).txt",
  "timestamp_uploaded": 1777638342,
  "timestamp_last_modified": 1777638342
}

Response fields:

Additional upload-specific errors:

Documented file-size limits:

Documented folder-size limits: Enterprise, Business, Pro, Lifetime, and Personal are unlimited; Free is 5 GB.

download_file

Downloads raw file contents by file hash.

POST https://api.files.fm/api_v2/download_file

Authorization:

Parameters:

Response:

• Success: raw binary file contents.
• Content-Type: automatically set based on file type.
• Content-Disposition: inline or attachment depending on client and access settings.

Public LINK example:

https://files.fm/f/demo

Legacy V1 compatibility endpoint, available but not recommended for new integrations:

https://api.files.fm/down.php?i=p4s7u2w9x3y6z8ab

Direct file path links may also be used where configured:

https://files.fm/pa/username/folder1/subfolder/filename.jpg

Errors: standard status codes from the REST overview.

delete_folder

Deletes a folder from a user account.

POST https://api.files.fm/api_v2/delete_folder

Authorization: required.

Parameters:

Response:

{"status":"ok"}

or:

{"status":"error"}

To restore a deleted folder, use the legacy api/undelete_folder.php script (see "Legacy V1 Endpoints"). Undelete is available for PRO, BUSINESS, and ENTERPRISE accounts.

Errors: standard status codes from the REST overview.

delete_file

Deletes a file.

POST https://api.files.fm/api_v2/delete_file

Authorization: required.

Parameters:

Response: no additional data documented.

To restore a deleted file, use the legacy api/undelete_file.php script (see "Legacy V1 Endpoints"). Undelete is available for PRO, BUSINESS, and ENTERPRISE accounts.

Errors: standard status codes from the REST overview.

get_folder_content

Returns the direct contents of a folder, including files and subfolders.

POST https://api.files.fm/api_v2/get_folder_content

Authorization: required.

Parameters:

Response: JSON array of file/folder objects.

[
  {
    "type": "file",
    "hash": "p4s7u2w9x3y6z8ab",
    "name": "example.pdf",
    "size": 12345,
    "timestamp_uploaded": 1777638342,
    "timestamp_last_modified": 1777638342,
    "delete_key": "xxxxxx",
    "add_files_key": null
  },
  {
    "type": "folder",
    "hash": "c8d3f7h2j9k4m6np",
    "name": "Subfolder",
    "size": 0,
    "timestamp_uploaded": 1777638342,
    "timestamp_last_modified": 1777638342,
    "delete_key": "yyyyyy",
    "add_files_key": "zzzzz"
  }
]

Response fields:

Errors: standard status codes from the REST overview.

move_file

Moves a file into another folder in the same account.

POST https://api.files.fm/api_v2/move_file

Authorization: mandatory.

Parameters:

Response: no additional data documented.

Errors: standard status codes. Status 405 may be returned if the target folder does not exist or the operation is not allowed.

get_file_info

Returns metadata for a file.

POST https://api.files.fm/api_v2/get_file_info

Authorization: required.

Parameters:

Success response:

{
  "hash": "p4s7u2w9x3y6z8ab",
  "name": "example.pdf",
  "size": 12345,
  "timestamp_uploaded": 1777638342,
  "timestamp_last_modified": 1777638342,
  "delete_key": "xxxxxx",
  "parent_folder_hash": "c8d3f7h2j9k4m6np",
  "access_type": "LINK",
  "password_protected": false,
  "price_set": false
}

Response fields:

Errors: standard status codes from the REST overview.

get_folder_info

Returns metadata for a folder.

POST https://api.files.fm/api_v2/get_folder_info

Authorization: required.

Parameters:

Success response:

{
  "hash": "k7m2q9r4t6v8w3xy",
  "name": "Folder name",
  "size": 12345,
  "timestamp_uploaded": 1777638342,
  "timestamp_last_modified": 1777638342,
  "delete_key": "xxxxxx",
  "parent_folder_hash": "c8d3f7h2j9k4m6np",
  "add_files_key": "zzzzz",
  "file_count": 10,
  "subfolder_count": 2,
  "access_type": "LINK",
  "password_protected": false,
  "price_set": false
}

Response fields:

Errors: standard status codes from the REST overview.

get_esignatures

Returns e-signature records for a file.

POST https://api.files.fm/api_v2/get_esignatures

Authorization: required.

Parameters:

Success response:

[
  {
    "file_hash": "p4s7u2w9x3y6z8ab",
    "signing_timestamp": "xxxxxxxxx",
    "signer_name": "Signer Name"
  }
]

Response fields:

Errors: standard status codes from the REST overview.

esignature_share

Shares a file to be signed by other users. Optional next_share_emails can prefill the next share dialog so the recipient can re-share the file.

POST https://api.files.fm/api_v2/esignature_share

Authorization: required.

Parameters:

Success response:

{
  "status": "ok",
  "sent_emails": "[email protected]",
  "next_share_emails": "[email protected]"
}

Response fields:

Errors: standard status codes from the REST overview.

rename_file

Renames an existing file and returns the final stored filename.

POST https://api.files.fm/api_v2/rename_file

Authorization: required. Supported auth methods are the same as other API V2 actions, including user + pass, valid session, and token/session flows supported by Files.fm authentication.

Parameters:

Access and behavior:

• Caller must have edit rights for the file.
• Deleted or missing files return an error.
• The filename is normalized and made unique inside the folder.
• If the requested name equals the current name, API returns success with unchanged name.

Success response:

{
  "file_hash": "p4s7u2w9x3y6z8ab",
  "file_name": "renamed_from_curl_test.txt"
}

file_name is the final name after normalization and uniqueness handling.

Common errors:

Example:

curl -X POST 'https://api.files.fm/api_v2/rename_file' \
  --data-urlencode 'file_hash=YOUR_FILE_HASH' \
  --data-urlencode 'file_name=New file name.pdf' \
  --data-urlencode 'user=YOUR_USERNAME' \
  --data-urlencode 'pass=YOUR_PASSWORD'

rename_folder

Renames an existing folder that the authenticated user is allowed to edit.

POST https://api.files.fm/api_v2/rename_folder

Authorization: required.

Parameters:

Access and behavior:

• Caller must be authenticated.
• Folder must exist and must not be deleted.
• Caller must have folder allow_edit rights.
• ROOT folder (ParentID = 0) cannot be renamed.
• Folder name is normalized and made unique inside the parent folder.
• Successful rename triggers the standard folder change event pipeline, including ETag/update side effects.

Success response:

{
  "folder_hash": "k7m2q9r4t6v8w3xy",
  "folder_name": "rf_evt_renamed_1777640861"
}

folder_name is the final name after normalization and uniqueness handling.

Common errors:

Example:

curl -X POST 'https://api.files.fm/api_v2/rename_folder' \
  --data-urlencode 'folder_hash=YOUR_FOLDER_HASH' \
  --data-urlencode 'folder_name=New folder name' \
  --data-urlencode 'user=YOUR_USERNAME' \
  --data-urlencode 'pass=YOUR_PASSWORD'

End-to-End Encryption Key Endpoints

These advanced V2 actions support client-side end-to-end encryption (E2E) of files and folders. They store and retrieve wrapped (encrypted) symmetric keys and the public keys needed to unwrap them. Files.fm uses a hybrid post-quantum scheme: each user publishes a KEM public key (key encapsulation), a DSA public key (signatures), plus classical x25519 and ed25519 public keys. The server only stores public keys and already-wrapped key material; it never sees plaintext content keys.

These endpoints are primarily used by the Files.fm web client. They are documented here for completeness; most integrations do not need them.

Common rules for all six actions:

• POST to https://api.files.fm/api_v2/{action}.
• Authorization is required, and userID must equal the authenticated user's id, otherwise 403.
• Standard error status codes apply (400 missing parameter, 403 mismatch/permission, 404 not found, 500 failure).

save_user_encryption_keys

Stores the authenticated user's public encryption keys.

POST https://api.files.fm/api_v2/save_user_encryption_keys

Success response:

{"success": true}

save_file_encryption_key

Stores the wrapped encryption key for a file (owner is both sender and receiver). Marks the file as encrypted. Requires edit rights on the file.

POST https://api.files.fm/api_v2/save_file_encryption_key

Success response:

{"success": true}

get_file_encryption_key

Returns the wrapped encryption key and the sender's public keys for a file. Requires download rights on the file. Set isEncryptedFolder when the file lives in an encrypted folder so the owner-created key is returned.

POST https://api.files.fm/api_v2/get_file_encryption_key

Success response:

{
  "encryptionKey": "...",
  "keySignature": "...",
  "fileSignature": "...",
  "senderPublicKEMKey": "...",
  "senderPublicDSAKey": "...",
  "senderPublicX25519Key": "...",
  "senderPublicED25519Key": "...",
  "senderUserID": 11315
}

save_upload_encryption_key

Stores the wrapped encryption key for a folder (upload). Marks the folder as encrypted. Requires edit rights on the folder.

POST https://api.files.fm/api_v2/save_upload_encryption_key

Success response:

{"success": true}

get_upload_encryption_key

Returns the wrapped encryption key and the sender's public keys for a folder. Requires download rights on the folder. Set isEncryptedFolder to fetch the owner-created key.

POST https://api.files.fm/api_v2/get_upload_encryption_key

Success response:

{
  "encryptionKey": "...",
  "keySignature": "...",
  "senderPublicKEMKey": "...",
  "senderPublicDSAKey": "...",
  "senderPublicX25519Key": "...",
  "senderPublicED25519Key": "...",
  "senderUserID": 11315
}

get_share_encryption_key

Returns the caller's wrapped key for a file or folder plus the recipient's public keys, so the client can re-wrap the content key for sharing. Provide exactly one of fileHash or uploadHash. Requires download rights on the shared item.

POST https://api.files.fm/api_v2/get_share_encryption_key

Success response:

{
  "encryptionKey": "...",
  "keySignature": "...",
  "receiverKEMKey": "...",
  "receiverDSAKey": "...",
  "receiverX25519Key": "...",
  "receiverED25519Key": "...",
  "receiverUserID": 44961
}

Legacy V1 Endpoints

These endpoints predate API V2. They remain fully supported and many have no V2 equivalent (thumbnails, recursive tree, ZIP download, versions, sharing, embedding). They live under https://api.files.fm/api/{script}.php (or at the root for save_file.php, down.php, thumb*.php). All of them authenticate through api/authenticate_user.php, so any auth method from the Authorization section works. Most return JSON; a few return plain text (noted per endpoint).

Authentication and session (V1)

login.php

GET|POST https://api.files.fm/api/login.php?user=demo&pass=demo

Logs the user in and returns a plain-text cookie string with the session and ROOT folder info:

cookie:PHPSESSID=...; user=demo; hash=...; ID=11315; [email protected]; root_upload_hash=...; root_upload_key=...

Returns error: incorrect login on failure. For a structured JSON UserData object (and to mint an API token), call api/authenticate_user.php instead (see "ROOT Folder and Account Info").

sesslogin.php

GET|POST https://api.files.fm/api/sesslogin.php?PHPSESSID=...&username=demo&redirect_url=https://files.fm/filebrowser

Cross-domain web login helper: validates the session and redirect_url (must be a failiem.lv/files.fm/files.me/file.fm host), logs the user in on the current and partner domains, then issues an HTTP redirect. Intended for browser SSO flows, not REST clients.

validate_session.php

GET https://api.files.fm/api/validate_session.php

Returns whether the current session is logged in:

{"Success": true, "Message": null, "SessionID": "..."}

test_session.php

GET https://api.files.fm/api/test_session.php

Prints the _COOKIE and _SESSION arrays. Used only for internal development/diagnostics. NA.

Folders: create and keys (V1)

get_upload_id.php (create folder)

GET https://api.files.fm/api/get_upload_id.php

Creates a folder and returns its hash and keys. This is the backend behind the V2 create_folder action.

Parameters: user, pass (optional), folder_name (optional), parent_hash (optional, defaults to ROOT when authenticated), access_type (PRIVATE or LINK).

https://api.files.fm/api/get_upload_id.php?user=demo&pass=demo&folder_name=My_Folder&parent_hash=k7m2q9r4t6v8w3xy

{"hash":"c8d3f7h2j9k4m6np","delete_key":"4f27a1d86c90be3571432aef69d8c504","add_key":"a93c520b7408ed16f25d69401b7ace38","UserID":44961,"FolderName":"my_foldername"}

If used anonymously, UserID may be false, and the anonymous folder is auto-deleted after about one month.

get_upload_keys.php

GET https://api.files.fm/api/get_upload_keys.php?hash=k7m2q9r4t6v8w3xy&user=demo&pass=demo

Returns the folder's add and delete keys:

{"AddFileKey":"a93c520b7408ed16f25d69401b7ace38","DeleteKey":"4f27a1d86c90be3571432aef69d8c504"}

get_add_key.php

GET https://api.files.fm/api/get_add_key.php?hash=k7m2q9r4t6v8w3xy

Requires an active user session. Returns only the folder add key:

{"add_key":"a93c520b7408ed16f25d69401b7ace38"}

get_file_keys.php

GET https://api.files.fm/api/get_file_keys.php

Returns file edit keys (a folder edit key also works where supported). Contact Files.fm for full documentation and enabled access.

get_ids_and_keys_from_paths.php

POST https://api.files.fm/api/get_ids_and_keys_from_paths.php?upload_hash={parent_hash}&add_key={parent_add_key}

Resolves a list of directory paths under a parent folder to their ids and add keys, creating any missing folders. POST Directories[] entries (one path per entry). Optional access_type (PRIVATE, LINK, PASSWORD, PUBLIC) and addto/addhash for public-upload contexts.

{
  "Success": true,
  "Directories": {
    "/test": {"id": 123, "add_key": "a93c520b7408ed16f25d69401b7ace38"},
    "/test/sub1": {"id": 234, "add_key": "c016a72f8395bd40e17846ca53f29ed7"}
  },
  "Error": null
}

Files: upload and replace (V1)

save_file.php (upload)

POST https://api.files.fm/save_file.php?up_id={folder_hash}&key={add_key}&get_file_hash

Uploads one file (multipart field file). This is the backend behind the V2 upload_file action. With get_file_hash, returns the new file hash. Optional watermark_text (and related watermark params) for image uploads. Upload one file per request.

curl -i -F 'file=@/tmp/local-file.txt' 'https://api.files.fm/save_file.php?up_id=k7m2q9r4t6v8w3xy&key=a93c520b7408ed16f25d69401b7ace38&get_file_hash'

save_file.php (replace)

POST https://api.files.fm/save_file.php?up_id={folder_hash}&key={add_key}

Pass do=update and replace_file_hash={file_hash} to replace an existing file. Supports file versions for BUSINESS and ENTERPRISE accounts; the ETag changes after replacement. Contact Files.fm for the full replacement flow.

Listing and metadata (V1)

get_file_list_for_upload.php (List folder child items)

GET https://api.files.fm/api/get_file_list_for_upload.php?hash={folder_hash}&include_folders=1

Returns direct child files/folders and metadata for one folder (not recursive). This is the backend behind the V2 get_folder_content action.

[{"hash":"p4s7u2w9x3y6z8ab","name":"File1.jpg","Size":"106361"},{"hash":"q2r5t8v3w7x4y9za","name":"File2.jpg","Size":"62249"}]

Empty folder returns [].

Anonymous link access. This V1 endpoint also accepts unauthenticated requests for folders whose access type is LINK or PUBLIC: pass only the folder hash (no credentials). The listing is strictly view-only — delete_key/add_key are never returned, PRIVATE folders and password-protected folders (without a session password) are rejected, and PRIVATE files inside a public folder are filtered out. To deter automated enumeration, anonymous requests are rate-limited per IP (HTTP 429 / {"error":"rate_limited"} when exceeded) and intentionally delayed by ~2 seconds each. Authenticated requests (session, user+pass, or user+user_access_token) are not throttled or delayed. The V2 get_folder_content action does not allow anonymous access — it always requires authentication.

get_upload_tree.php (recursive tree / search)

GET https://api.files.fm/api/get_upload_tree.php?Hash={folder_hash}&DeleteKey={folder_delete_key}

Returns all subdirectories and their contents recursively, with file/folder metadata. Also used as the basis for folder search.

{
  "error": null,
  "data": {
    "Type": "Folder", "ID": "4759592", "Hash": "k7m2q9r4t6v8w3xy",
    "AddFileKey": "a93c520b7408ed16f25d69401b7ace38", "DeleteKey": "4f27a1d86c90be3571432aef69d8c504", "ParentID": "4962316",
    "CreatedDate": "2014-02-20 22:55:30", "ModifiedDate": null, "Name": "Example folder",
    "Children": [
      {"Type": "Folder", "ID": "4799549", "Hash": "c8d3f7h2j9k4m6np", "AddFileKey": "c016a72f8395bd40e17846ca53f29ed7", "DeleteKey": "e2836407b5ad19fc83617e20a94d52cb", "ParentID": "4759592", "CreatedDate": "2014-03-01 18:50:13", "ModifiedDate": null, "Name": "Child folder", "Children": false}
    ]
  }
}

upload_list.php (ROOT children)

GET https://api.files.fm/api/upload_list.php?user=demo&pass=demo

Returns the direct children of the user's ROOT folder (metadata only, no add/delete keys): hash, date, description, files, size, views, valid_to_date.

[{"hash":"k7m2q9r4t6v8w3xy","date":"2012-12-05 19:00:19","description":"","files":"2","size":"168610","views":"1","valid_to_date":""}]

get_file_info.php

Two modes:

GET  https://api.files.fm/api/get_file_info.php?hash={file_hash}&del_key={file_delete_key}
POST https://api.files.fm/api/get_file_info.php   (action=get_file_hash_by_name)

The GET mode returns rich file metadata (requires the file's delete key):

{"success": true, "file_info": {"Name": "photo.jpg", "ContentType": "image/jpeg", "Extension": "jpg", "ExtensionType": "image", "Size": "106361", "RealSize": 106361, "CustomInfo": {"Width": 1024, "Height": 768}}}

The POST mode (action=get_file_hash_by_name, upload_hash, file_name; requires a logged-in user with view rights) resolves a file name to its hash:

{"success": true, "file_info": {"hash": "p4s7u2w9x3y6z8ab"}}

get_uploads_exist.php

POST https://api.files.fm/api/get_uploads_exist.php

Authenticated. POST a JSON body {"hashes": ["...","..."]} and receive a map of folder hash to existence (only folders owned by the user with an add key count as existing):

{"k7m2q9r4t6v8w3xy": true, "c8d3f7h2j9k4m6np": true, "b6c9d2f5h8j3k7mn": false}

get_storage_data.php

GET https://api.files.fm/api/get_storage_data.php

Authenticated. Returns the signed-in user's storage usage and quota (MB):

{"success": true, "message": null, "data": {"used_mb": 5.39, "quota_mb": "2000", "available_mb": "2000", "free_mb": 1994.61}}

Search (web/ajax)

ajax/search.php

GET|POST https://files.fm/ajax/search.php

Full-text search across the authenticated user's files and folders (own, shared, in a specific folder, and optionally deleted items). Served from the files.fm web host and authenticated by session, so pass PHPSESSID as a cookie or query parameter. Storage subscribers are searched via the Sphinx full-text index; other accounts fall back to a SQL LIKE search. Two request styles are supported.

1. Simplified API mode (recommended for integrations). Pass result_format=JSON and query; the script builds the search definition and returns a clean JSON array. Optionally pass folder_hash to restrict the search to one folder (subfolders included). When folder_hash is omitted or set to ROOT, it searches your own files plus organization-shared files.

GET https://files.fm/ajax/search.php?result_format=JSON&query=document&PHPSESSID=YOUR_SESSION_ID

2. Full mode (used by the file browser UI). Pass a URL-encoded search_json object plus table paging/sorting parameters.

GET https://files.fm/ajax/search.php?search_json=%7B...%7D&PHPSESSID=...&table_page=0&table_size=1000&table_column[3]=1

The decoded search_json from the file-browser example:

{
  "Mode": "simple",
  "Query": "document",
  "Types": {},
  "Sections": { "MY": true, "SHARED_WITH_ME": true, "DELETED": false, "THIS_FOLDER": false },
  "ThisFolder": ""
}

search_json fields:

Other query parameters:

result_format=JSON response: a JSON array of result items.

[
  {
    "type": "file",
    "name": "document.pdf",
    "hash": "p4s7u2w9x3y6z8ab",
    "size": 12345,
    "mod_date": "2026-05-01 12:00:00",
    "path": "/folder/sub/document.pdf",
    "public_access_type": "PRIVATE",
    "parent_hash": "k7m2q9r4t6v8w3xy",
    "content_type": "application/pdf",
    "file_count": null,
    "subfolder_count": null,
    "access_rights": null
  }
]

Response fields (result_format=JSON):

The default WEB_TABLESORTER response is an object { "status": "ok", "total_rows": N, "headers": [...], "rows": [...], "page_count": N, "total_time": 0.12 } where rows contain pre-rendered HTML for the web UI. Errors return { "status": "error" }.

Rename and access type (V1)

change_file.php (rename file)

GET|POST https://api.files.fm/api/change_file.php?file_hash={file_hash}&folder_hash={folder_hash}&file_display_name=NewName.txt

Updates a file's display name.

{"Success":true,"Error":null,"Message":"Fields updated"}

change_upload.php (rename folder)

GET|POST https://api.files.fm/api/change_upload.php?Hash={folder_hash}&upload_display_name=New%20Name

Authenticated; requires edit rights. Renames a folder (DisplayName). The ROOT folder cannot be renamed. You may pass UploadID instead of Hash.

{"Success":true,"Error":null,"Message":null}

upload_access_type.php (change folder access type)

GET https://api.files.fm/api/upload_access_type.php?h={folder_hash}&type=PRIVATE

Authenticated; requires permission. type is one of PRIVATE, PASSWORD, LINK, PUBLIC.

{"success": true, "error": ""}

Delete and restore (V1)

delete_file.php

GET|POST https://api.files.fm/api/delete_file.php?hash={file_hash}&del_key={delete_key}

Deletes a file by hash and delete key (the key may be the parent folder delete key or the file's own key). This is the backend behind the V2 delete_file action.

{"success":1}

Failure returns {"success":0}. Legacy combined endpoint: GET https://api.files.fm/list.php?i={folder_hash}&k={delete_key}&f={file_hash}.

delete_upload.php (delete folder)

GET|POST https://api.files.fm/api/delete_upload.php?u={folder_hash}&del_key={delete_key}

Deletes a folder (and its files/subfolders) owned by the authenticated user. This is the backend behind the V2 delete_folder action. Optional delete_only_subfolders=1 deletes only the subfolders. Supports jsonp/callback.

{"success":1,"error":0,"deleted_id":1234}

Failure returns {"success":0,"error":1,"deleted_id":null}. Legacy combined endpoint: GET https://api.files.fm/list.php?i={folder_hash}&k={delete_key}&t=ok.

multi_delete.php

POST https://api.files.fm/api/multi_delete.php

Authenticated. Deletes many files and folders in one transaction. POST JSON {"items": {"files": ["..."], "folders": ["..."]}}, up to 200 items per call. Rolls back if any item fails or the user lacks delete rights.

{"success": true, "error": "", "error_code": null}

undelete_file.php

GET|POST https://api.files.fm/api/undelete_file.php?hash={file_hash}

Restores a deleted file. Requires a logged-in paying user (storage subscriber). Optional return_new_path=true and return_new_folder_id=true add path/folder info to the response.

{"status":"ok"}

undelete_folder.php

GET|POST https://api.files.fm/api/undelete_folder.php?hash={folder_hash}

Restores a deleted folder (and its recoverable files). Requires a logged-in paying user. Optional return_new_path=true. Returns {"status":"ok"} or {"status":"error"}. Undelete is available for PRO, BUSINESS, and ENTERPRISE accounts; the restoration window depends on account type.

multi_restore.php

POST https://api.files.fm/api/multi_restore.php

Authenticated. Restores many deleted files/folders owned by the user. POST JSON {"items": {"files": ["..."], "folders": ["..."]}}, up to 200 items per call.

{"success": true, "error": "", "error_code": null}

delete_items_from_recyclebin.php (permanent delete)

POST https://api.files.fm/api/delete_items_from_recyclebin.php

Permanently deletes items from the recycle bin. Authenticated; requires the account password for confirmation. POST password and items = {"files": ["..."], "folders": ["..."]}.

{"status":"ok"}

Incorrect password returns {"status":"error","error_code":1}. This is destructive and not recoverable.

restore_version_file.php (file versions)

GET https://api.files.fm/api/restore_version_file.php?hash={file_hash}&del_key={delete_key}&version_id={version_id}

Restores a previous version of a file as the current version. Requires a logged-in user. File versions are a BUSINESS/ENTERPRISE feature.

Download, thumbnails, and previews (V1)

down.php (download)

GET https://api.files.fm/down.php?i={file_hash}

Downloads a file by hash. This is the backend behind the V2 download_file action. Direct download limits depend on account type and security settings.

thumb.php (small thumbnail)

GET https://api.files.fm/thumb.php?i={file_hash}

Small image thumbnail, approximately 400x271 px.

Large thumbnails

GET https://api.files.fm/thumb_show.php?i={file_or_folder_hash}
GET https://api.files.fm/thumb_video_picture.php?i={file_hash}
GET https://api.files.fm/thumb_folder.php?i={folder_hash}

Large thumbnails (approximately 1500 px) for images, video poster frames, and folder covers.

Streamable video preview / document PDF preview

Files.fm can generate an MP4 streaming preview (HD or custom quality; watermarked when a price is set) and PDF previews for document/archive formats (DOC, XLS, EDOC, ZIP, etc.). Requires the file hash and enabled access. Contact Files.fm for full documentation. See also the "previews and conversion" integration section.

Download folder as ZIP

GET https://api.files.fm/server_scripts/zip/zip_streamer/upload_zip_streamer.php?uhash={folder_hash}

Streams all files in a folder as a ZIP. For password-protected folders add &password=my_password. Limits may apply.

embed_urls.php (path-access URL)

GET https://api.files.fm/api/embed_urls.php?i={file_hash}

Returns the human-readable path-access URL for a file:

{"path_access_url": "https://files.fm/pa/username/folder1/subfolder/filename.jpg"}

Share links (browser preview)

https://files.fm/u/{folder_hash}
https://files.fm/f/{file_hash}

Localized domains are supported, for example https://es.files.fm/u/{folder_hash} and https://de.files.fm/u/{folder_hash}.

Sharing management

Files.fm sharing grants named recipients (registered users, email addresses, or — for enterprise organizations — organization user groups) fine-grained access to a file or folder. Access rights are stored per recipient in upload_sharing: CanView, CanRead (download), CanWrite (edit), CanAdd, CanDelete, and CanShare. Two endpoints cover the lifecycle: ajax/share.php creates shares (and sends notification emails), and api/sharing.php lists and adjusts existing shares.

Both are session-authenticated (pass PHPSESSID); they are the same pipeline the V2 esignature_share action builds on.

ajax/share.php (grant access)

POST https://files.fm/ajax/share.php

Grants access to one or more recipients on a single file or folder, optionally sends share-notification emails, and (for end-to-end encrypted items) stores per-recipient wrapped encryption keys. Served from the files.fm web host and authenticated by session.

Target the item with one of:

• file_view_hash (or file_hash) — share a single file.
• upload_hash — share a folder.

Parameters (POST):

Granting the delete right (and folder add/write rights) causes the generated share URL to embed the corresponding delete/add keys.

Response:

{
  "status": "ok",
  "items": {
    "[email protected]": {
      "item_type": "email",
      "value": "[email protected]",
      "email": "[email protected]",
      "is_valid_email": true,
      "user_id": 12345,
      "org_id": 0,
      "can_email": true,
      "have_to_send_enterprise_invite_email": false,
      "enterprise_invite_email_link": ""
    }
  },
  "message": null,
  "invalid_emails": "",
  "unsubscribed_emails": "",
  "sent_emails": "[email protected]"
}

status is ok on success or error on failure. message may be null, no-access-rights, already_shared, marked_as_spam, free_emails_exhausted, or wrong_dates. items is keyed by each recipient's value.

Security note: the share URLs returned and emailed can embed file/folder delete and add keys depending on the granted rights — treat the response and the emails as sensitive.

sharing.php (sharing modal and management)

GET https://api.files.fm/api/sharing.php?Action={action}&...

Session-authenticated endpoint that backs the sharing dialog: it lists existing shares for an item and toggles individual access rights. The session user must hold the allow_sharing right on the target item.

Select the item with one of UploadID, FileID, UploadHash, FileHash, or DvsDocumentId.

Actions (Action parameter):

UpdateUploadSharing parameters:

{"Success": true, "AccessRights": {"CanView": 1, "CanRead": 1, "CanWrite": 0, "CanDelete": 0, "CanShare": 0, "CanAdd": 0}}

Setting all rights to 0 effectively removes an assignee's access — there is no separate delete-share endpoint. GetModalWindow and GetSharingTable return pre-rendered HTML for the web UI rather than structured data, so for programmatic listing build on UpdateUploadSharing plus your own bookkeeping.

Organization role/module permissions (the org RBAC table updated by api/permissions.php) are a separate concern from per-file sharing and belong to the Organization Management API (out of scope here).

save_sharing_confirmation.php

GET https://api.files.fm/api/save_sharing_confirmation.php?item_type=FILE&item_id={id}&confirm=1

Confirms (or declines) a pending share for the authenticated user (or via a signed user_id+hash link). item_type is FILE or UPLOAD; set confirm=1 to accept. Optional redirect_after_save=1 redirects to the file browser instead of returning JSON.

{"Success": true, "Error": null, "Message": null}

Utility and account (V1)

Disabled endpoints

Account creation via api/register.php is disabled. New accounts are created through the website or OAuth/SSO first-login auto-provisioning.

Other Files.fm APIs

Calendar and address-book integrations use the CalDAV and CardDAV API at https://calendar.failiem.lv/. It supports discovery, event/contact CRUD, and synchronization using DAV XML and iCalendar/vCard data. These are separate protocol endpoints, not REST V2 actions; the REST OpenAPI specification does not describe them. The calendar workspace's /calendar/api.php is an internal session/CSRF-based JSON interface, not a documented public REST API.

Organization and dealer management has its own separate API, documented in Files.fm_OrgManagement_API.pdf (served from the api/ directory) and implemented by api/manage_organizations.php. It is out of scope for this document. See the public DMS/DVS reference, MCP connector, and WebDAV/FTP protocols. Internal web AJAX endpoints are not a substitute for the documented public API; additional integration requirements should be discussed with [email protected].

Supplemental Integration Sections

The remaining sections come from the same PDF and document related options: embedded e-signature forms, Files.fm AI endpoint usage, pre-built upload forms, embedding, previews, conversion, watermarking, and server-side AI analysis.

E-Signature Form Integration

The Files.fm e-signature form can be integrated into your system using JavaScript and embedded as an iframe within your website or web application.

The embedded form communicates with your application through callback events, enabling seamless interaction and status handling during the signing process. This allows users within your IT environment to digitally sign files stored in Files.fm using supported electronic signature methods, including the Latvian State Radio and Television Centre (LVRTC) e-signature and Smart-ID, when enabled for the corresponding business account.

In addition to embedded usage, Files.fm also supports generating secure signing links that can be shared with external parties. These links allow recipients to sign documents without requiring access to your internal systems or a Files.fm user account, making the solution suitable for both internal workflows and external document signing scenarios.

https://files.fm/api/demo/esigning_api_demo_v.2.0/

The integration example is written in the web programming language PHP and can be downloaded here: https://files.fm/u/4dcrp5wy3

How to use the example:

1. Download the file "esigning_api_demo_v.2.0.zip".
   

2. Unzip this file and place it on your computer in web server's ( Apache + PHP ) folder.
   

3. Open the config.php file and enter your Files.fm account username and password.
   

4. Open the index.php file through your browser.
   

Initializing the form

To initialize the e-signature form on the client side in the browser, on your page:

1. JavaScript resources must be included (for example, in the HTML head tag of the page):

<script type="text/javascript" src="https://api.files.fm/esignature/form.js"></script>

2. Create a JavaScript object of the class FailiemlvEsignatureForm, passing the form settings. All settings are optional.

objMyFailiemlvEsignatureForm = new FailiemlvEsignatureForm({
    callbacks: {
        on_signing_finished: function (result) { /* ... */ },
        on_form_closed: function (data) { /* ... */ }
    },
    emobile_signing: {
        open_new_tab: false
    },
    allowed_signing_formats: {
        edoc: true,
        pdf: true,
        asice: false
    },
    default_signing_format: "edoc",
    signature_validation: {
        enabled: true
    },
    sign_files_separate: {
        allow_select: true,
        default: false
    }
});

Form settings parameters

Opening the form

Before opening the form on the server side of the client system, the files to be signed must be uploaded using the Files.fm data API.

If you need to sign multiple files :

1.  a new folder must be created (see Request for folder creation - create_folder );
   

2.  The files to be signed must be uploaded to the created folder (see Request for file upload - upload_file
   

).

If you need to sign a single file :

1. select an existing folder in your Files.fm account or create a new folder (see Request for folder creation

• create_folder ) to which to upload the file;

2. The file to be signed must be uploaded to the created or existing folder (see Request for file upload - upload_file ).

The form can be opened by calling the showForm function on the previously created object of the class FailiemLv_eSignature_Form .

To sign multiple files, pass the folder of the uploaded files:

objMyFailiemlvEsignatureForm.showForm( folder_hash, folder_edit_key );

To sign a single file, pass the file instead:

objMyFailiemlvEsignatureForm.showForm( null, null, file_hash, file_delete_key );

Function parameters

Receiving the signing result

As mentioned above, Initializing the Form , when initializing the form (creating a JavaScript object of the form), you must specify a callback function on your page in the parameters , which should be called when the signing process is complete ("on_signing_finished"). When calling this function, its first parameter will be passed an object with data about the signing result. The signing can be successful or unsuccessful.

Signing result object data

Upon receiving a notification that the signing has been completed, if the signing has been successful, you can download the signed files from the Files.fm system and save them to your system .

It is recommended to download the file on the server side of your system with an API request (see Request for file download - download_file ).

After downloading the signed files, it is recommended to delete the previously uploaded file folder or file from the Files.fm system by making a Delete API request from your system server . (see Request for deleting

a folder - delete_folder ). The folder or file identifier is passed in the function call parameter ("folder_hash", "file_hash").

It is also recommended to delete the folder after an unsuccessful signing.

Receiving the form close event

As mentioned above , Initializing a Form , when initializing a form (creating a JavaScript object of the form), you must specify a callback function on your page in the parameters that should be called when the user closes the form (" on_form_closed "). When calling this function, its first parameter will be passed an object with data about the file folder or file opened in the form:

• if signing is performed for multiple files , an object with data about the folder opened in the form will be submitted;
• If signing is performed for a single file , an object with data about the file opened in the form will be passed.

File or folder data opened in the form

Upon receiving a form closing notification, it is recommended to delete the previously uploaded file folder or file from the Files.fm system via your system's server side with an API request (see Request to delete a folder

• delete_folder ). The folder or file identifier is passed in the function call parameter ("folder_hash", "file_hash").

Files.fm AI API (Ollama-compatible)

Files.fm provides a hosted Ollama-compatible Large Language Model API at https://ai.files.fm. It is a drop-in replacement for Ollama's HTTP interface, so existing tools, SDKs, and automation platforms (such as n8n) can use Files.fm-hosted models without running local GPU infrastructure, in a GDPR-compliant way. It follows the standard Ollama /api/generate and /api/chat schema and semantics. For automations, prefer the https://ai.files.fm/api/generate endpoint. Generate your API keys at https://files.fm/account#api_keys.

Supported models

If you need other models, ask us.

Authentication

Authentication uses a Bearer token in the HTTP Authorization header:

Authorization: Bearer UserID:RandomString

• UserID is the Files.fm user id (for example, a service account used for automation).
• RandomString is the API token (generated in account settings or issued by a Files.fm account manager).
• Keep tokens confidential and stored securely. Disable old tokens and generate new ones if a token is lost.

Endpoints

POST https://ai.files.fm/api/generate
POST https://ai.files.fm/api/chat

Headers:

Content-Type: application/json
Authorization: Bearer UserID:RandomString

Request format (Ollama-compatible)

The request body follows the standard Ollama format (see https://docs.ollama.com/api/introduction).

Example — /api/generate with gpt-oss:20b:

curl --location 'https://ai.files.fm/api/generate' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer UserID:RandomString' \
  --data '{
    "model": "gpt-oss:20b",
    "prompt": "What is Files.fm? Answer in one sentence.",
    "think": "low",
    "stream": false
  }'

Example — /api/chat:

curl --location 'https://ai.files.fm/api/chat' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer UserID:RandomString' \
  --data '{
    "model": "gpt-oss:20b",
    "messages": [
      { "role": "user", "content": "What is Files.fm? Answer in one sentence." }
    ],
    "think": "low",
    "stream": false
  }'

Example — gemma4:12b:

curl --location 'https://ai.files.fm/api/chat' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer UserID:RandomString' \
  --data '{
    "model": "gemma4:12b",
    "messages": [
      { "role": "user", "content": "What is Files.fm? Answer in one sentence." }
    ],
    "stream": false
  }'

/api/generate response format

When stream is false, the API returns a JSON object (see https://docs.ollama.com/api/generate):

{ "response": "Generated text output from the model.", "done": true }

/api/chat response format

The response matches Ollama's standard structure:

{
  "message": {
    "role": "assistant",
    "content": "Files.fm is a secure cloud storage and file sharing platform for individuals and businesses."
  }
}

The generated content is available at message.content.

Using Files.fm AI with n8n

Use Files.fm AI inside n8n for automation tasks such as text summarization, classification, OCR post-processing, internal AI assistants, and document/form analysis. The HTTP Request node provides maximum compatibility and control.

n8n HTTP Request configuration:

Body example:

{
  "model": "gpt-oss:20b",
  "prompt": "Summarize the following text in one concise sentence",
  "think": "low",
  "stream": false
}

Response:

{ "response": "generated text" }

Extract the generated output with the expression {{$json.response}}. It can be forwarded to email nodes, Slack/Microsoft Teams, databases or CRMs, Files.fm document workflows, or webhooks/APIs.

Operational notes:

• The API is stateless; no session handling is required.
• Streaming is optional but not recommended for automation workflows.
• Designed for server-side and backend use.
• Suitable for GDPR-sensitive environments (EU-hosted).
• No local GPU, model downloads, or runtime management required.

Pre-Built File Upload Form

For rapid and straightforward file upload integration, Files.fm provides a pre-built, configurable file upload form that can be embedded into your website or application-similar in concept to the e-signature form.

This approach enables you to receive uploaded files quickly without implementing a full custom upload flow, while still allowing configuration and customization per use case.

Key Capabilities

The pre-built upload form supports:

• Single-button or multi-step file uploads

• Custom input fields for collecting metadata alongside uploaded files

• Folder-based file organization

• Secure, link-based access control

• Seamless integration with existing Files.fm storage and workflows

Use Cases

The upload form is well suited for scenarios such as:

• Collecting files from external users or customers

• Receiving documents, images, or videos with structured metadata

• Rapid prototyping or low-code integrations

• Replacing custom upload implementations with a managed solution

The form can be configured to match your specific requirements, including the number of fields, validation rules, and destination folders.

Learn more and configure your form: https://files.fm/upload-form

See an example in action: https://files.fm/demopro/?upload

Additional Resources and Examples

If you need further clarification, contact [email protected]. The V2 format is preferred; feel free to request additional information or features.

• Basic file upload example (raw code): https://files.fm/api/demo/
• Inspect the upload form flow (e.g. in Chrome DevTools): https://files.fm/upload_iframe.php?uid=15802530&uid_hash=YOUR_UID_HASH

Embedding folder contents (gallery)

Embed a folder as a slideshow iframe:

<iframe src="https://files.fm/u/cecguq8jzq&view=slideshow&autoplay=false" height="315" width="100%" style="max-width:560px; border:1px solid transparent;"></iframe>

Or embed via the gallery script tag:

<script type="text/javascript" src="https://files.fm/gallery_module/v1/js/?hash=k7m2q9r4t6v8w3xy&user=13b73&ihash=YOUR_IHASH&view=horizontal" id="files_fm_upload_script_tag"></script>

File conversion and previews

Files.fm automatically generates previews and converted formats for a wide range of file types. Previews enable fast viewing, embedding, and content inspection without downloading the original files. All preview generation is handled server-side within the Files.fm infrastructure.

Image previews and thumbnails

For image files (including RAW formats), Files.fm generates JPEG-based previews in multiple sizes:

• Thumbnail (small) - optimized for lists and galleries.
• Preview (normal) - resized image, typically up to ~1500 px on the longest edge.

These are available for embedding and quick viewing while preserving the original file unchanged.

Document previews

PDF documents can be previewed directly in the browser using the built-in PDF viewer, without downloads.

Files.fm can generate PDF previews for common office and document formats, including but not limited to:

.doc, .docx, .odp, .ods, .odt, .pps, .ppsx, .ppt, .pptx,
.rtf, .xls, .xlsx, .dotx, .asice, .edoc, .zip

Text-based files can be previewed directly in the browser or downloaded as-is. Supported formats include:

.txt, .php, .js, .html, .css, .xml, .csv, .ini, .log,
.asp, .asm, .c, .cc, .cmake, .cpp, .cs, .h, .java, .jsp,
.json, .pl, .py, .rb, .script, .sh, .swift, .sql, .vb,
.xhtml, .xsd, .xsl, .yaml, .yml, .inf

Video previews and streaming

For video files, Files.fm provides automatic preview and streaming support:

• If a video is not in MP4 format, or the original MP4 exceeds supported bitrate thresholds, Files.fm can generate a streaming-optimized MP4 preview.
• Preview videos are suitable for in-browser playback and embedding.

For large-scale or high-traffic video hosting, Files.fm recommends the Files.fm JavaScript Video Player, which supports P2P-assisted streaming to optimize bandwidth usage and performance.

Applying a watermark

Files.fm supports text-based watermarks on JPEG and PNG images. Apply one by including the watermark_text parameter in the save_file.php request, for example &watermark_text=YourTextHere.

When a price is set or removed for an image or video file, Files.fm automatically regenerates the file previews (thumbnails) and applies a watermark using the file owner's username. This ensures consistent branding and content protection for monetized or restricted-access media.

AI analysis (server-side)

Files.fm provides server-side AI processing for images, videos, audio, and text content stored on the platform. All analysis runs within the Files.fm infrastructure - no client-side processing or external AI services are required.

Depending on account type and configuration, the platform can perform:

• Optical Character Recognition (OCR) - extracting text and numbers from images and video frames.
• Image and video content analysis - object detection, face detection, and scene understanding.
• Automatic content description - AI-generated summaries and captions.
• Auto-tagging and categorization - generation of searchable metadata.
• Sentiment and emotion analysis - of detected faces or textual content.
• Text analysis with LLMs - summarization, classification, translation, and semantic analysis of documents and text files.

Processing model:

• All AI features operate asynchronously and server-side.
• Results are stored as metadata associated with files and can be used for search, filtering, moderation, or automation workflows.
• No raw data is sent to third-party AI providers unless explicitly agreed.

Availability - AI features are optional and may require specific account plans or add-ons, feature enablement by Files.fm, and additional configuration depending on use case (e.g. face recognition, moderation, OCR pipelines). For availability, configuration, or API-level access, contact [email protected].