Skip to main content
POST
File manager — write operations

Authorizations

Authorization
string
header
required

Personal API token, sent as Authorization: Bearer <SANDYWP_API_KEY>. Obtain one from the dashboard account menu (API keys), sandywp auth login, or POST /api/account/tokens. A missing or invalid token returns 401 auth_required. Scoped OAuth tokens are limited to the Imports family and GET /api/account/me; see the top-level conventions.

Headers

X-SandyWP-Workspace
string

Selects which of the caller's workspaces to act in, for accounts belonging to more than one (legacy alias: X-SandyWP-Organization). Defaults to the caller's own personal workspace when omitted. Every id in this API (sandboxes, Templates, repositories) is scoped to a single workspace, so this header changes which set of resources is visible.

Path Parameters

id
string
required

The sandbox id.

op
enum<string>
required

write — create/overwrite a file (needs path + JSON body {contentBase64}). mkdir — create a directory (needs path). rename — move/rename (needs from + to). copy — copy (needs from + to). delete — delete a file/directory (needs path). Irreversible. upload — upload a file (needs path + a multipart body).

Available options:
write,
mkdir,
rename,
copy,
delete,
upload

Query Parameters

path
string

Base64url-encoded (RFC 4648 §5, unpadded) path relative to the WordPress root — for example the base64url encoding of wp-content/plugins, not the plain path itself. Names stay encoded end-to-end (including in this app's own proxying to the sandbox) so that sensitive filenames are never exposed in plaintext to an intermediate WAF. Required for list, tree, read, download, write, mkdir, and delete; omitted for read without a path defaults to the WordPress root.

from
string

Base64url-encoded source path. Required for rename and copy.

to
string

Base64url-encoded destination path. Required for rename and copy.

Body

Required JSON body {"contentBase64": "..."} for op=write. op=upload instead takes a multipart/form-data body carrying the file bytes. mkdir, rename, copy, and delete take no body — every parameter they need travels in the query string.

contentBase64
string
required

Base64-encoded file content. Only used for op=write.

Response

Operation result, proxied verbatim from the sandbox's file-manager API.

The response is of type object.