Skip to main content
GET
File manager — read operations

Authorizations

Authorization
string
header
required

Personal API token, sent as Authorization: Bearer <SANDYWP_API_KEY>. Obtain one from the dashboard account menu (API keys), sandywp auth login, or POST /api/account/tokens. A missing or invalid token returns 401 auth_required. Scoped OAuth tokens are limited to the Imports family and GET /api/account/me; see the top-level conventions.

Headers

X-SandyWP-Workspace
string

Selects which of the caller's workspaces to act in, for accounts belonging to more than one (legacy alias: X-SandyWP-Organization). Defaults to the caller's own personal workspace when omitted. Every id in this API (sandboxes, Templates, repositories) is scoped to a single workspace, so this header changes which set of resources is visible.

Path Parameters

id
string
required

The sandbox id.

op
enum<string>
required

list — one directory's entries (needs path). tree — recursive directory tree (needs path). read — a file's contents (needs path). download — stream a file/zip download (needs path).

Available options:
list,
tree,
read,
download

Query Parameters

path
string

Base64url-encoded (RFC 4648 §5, unpadded) path relative to the WordPress root — for example the base64url encoding of wp-content/plugins, not the plain path itself. Names stay encoded end-to-end (including in this app's own proxying to the sandbox) so that sensitive filenames are never exposed in plaintext to an intermediate WAF. Required for list, tree, read, download, write, mkdir, and delete; omitted for read without a path defaults to the WordPress root.

Response

list/tree/read return JSON metadata (or file content); download streams the file/zip with the sandbox-supplied content type.

The response is of type object.