File manager — read operations
One route handles every read-only file-manager operation; op selects it. This app authenticates the caller and proxies the request to the sandbox’s own file-manager REST API (including streamed downloads) — the response body/shape for a given op is whatever that sandbox-side API returns, and is not independently validated here. A large (>256KB) or binary read is refused (use download instead).
Authorizations
Personal API token, sent as Authorization: Bearer <SANDYWP_API_KEY>. Obtain one from the dashboard account menu (API keys), sandywp auth login, or POST /api/account/tokens. A missing or invalid token returns 401 auth_required. Scoped OAuth tokens are limited to the Imports family and GET /api/account/me; see the top-level conventions.
Headers
Selects which of the caller's workspaces to act in, for accounts belonging to more than one (legacy alias: X-SandyWP-Organization). Defaults to the caller's own personal workspace when omitted. Every id in this API (sandboxes, Templates, repositories) is scoped to a single workspace, so this header changes which set of resources is visible.
Path Parameters
The sandbox id.
list — one directory's entries (needs path).
tree — recursive directory tree (needs path).
read — a file's contents (needs path).
download — stream a file/zip download (needs path).
list, tree, read, download Query Parameters
Base64url-encoded (RFC 4648 §5, unpadded) path relative to the WordPress root — for example the base64url encoding of wp-content/plugins, not the plain path itself. Names stay encoded end-to-end (including in this app's own proxying to the sandbox) so that sensitive filenames are never exposed in plaintext to an intermediate WAF. Required for list, tree, read, download, write, mkdir, and delete; omitted for read without a path defaults to the WordPress root.
Response
list/tree/read return JSON metadata (or file content); download streams the file/zip with the sandbox-supplied content type.
The response is of type object.

