File manager — write operations
One route handles every mutating file-manager operation; op selects it. Proxied verbatim to the sandbox’s own file-manager REST API like the GET operation above — the exact response shape per op is not independently validated by this app. Irreversible for delete.
Authorizations
Personal API token, sent as Authorization: Bearer <SANDYWP_API_KEY>. Obtain one from the dashboard account menu (API keys), sandywp auth login, or POST /api/account/tokens. A missing or invalid token returns 401 auth_required. Scoped OAuth tokens are limited to the Imports family and GET /api/account/me; see the top-level conventions.
Headers
Selects which of the caller's workspaces to act in, for accounts belonging to more than one (legacy alias: X-SandyWP-Organization). Defaults to the caller's own personal workspace when omitted. Every id in this API (sandboxes, Templates, repositories) is scoped to a single workspace, so this header changes which set of resources is visible.
Path Parameters
The sandbox id.
write — create/overwrite a file (needs path + JSON body {contentBase64}).
mkdir — create a directory (needs path).
rename — move/rename (needs from + to).
copy — copy (needs from + to).
delete — delete a file/directory (needs path). Irreversible.
upload — upload a file (needs path + a multipart body).
write, mkdir, rename, copy, delete, upload Query Parameters
Base64url-encoded (RFC 4648 §5, unpadded) path relative to the WordPress root — for example the base64url encoding of wp-content/plugins, not the plain path itself. Names stay encoded end-to-end (including in this app's own proxying to the sandbox) so that sensitive filenames are never exposed in plaintext to an intermediate WAF. Required for list, tree, read, download, write, mkdir, and delete; omitted for read without a path defaults to the WordPress root.
Base64url-encoded source path. Required for rename and copy.
Base64url-encoded destination path. Required for rename and copy.
Body
Required JSON body {"contentBase64": "..."} for op=write. op=upload instead takes a multipart/form-data body carrying the file bytes. mkdir, rename, copy, and delete take no body — every parameter they need travels in the query string.
Base64-encoded file content. Only used for op=write.
Response
Operation result, proxied verbatim from the sandbox's file-manager API.
The response is of type object.

