List drive folders

GEThttps://<your-url>/api/v2/drive-folders

MCP id drive-folders.indexAlso on this path: POST Create a drive folder

Returns the drive folders the caller may read: the tree plnnrly's file browser draws.

Token scope: api:read:project_driveorapi:read:customer_driveorapi:read:organization_driveorapi:read:user_drive
Without it: 403 insufficient-token-scope.
Permission: project_drive::access
Without it: 403 insufficient-permission.
Rate cost: 1 unit, read bucket. view=detail makes it 3. Adds: with_total=1 +2, each include +1, q +2.
Also: If-None-Match answers 304 when nothing changed. Never cached: private, no-store. Unknown query parameters are refused, never ignored.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: One project's drive root, with owners expanded

curl -G \
  'https://<your-url>/api/v2/drive-folders' \
  --data-urlencode 'filter[owner_type]=project' \
  --data-urlencode 'filter[owner_id]=1' \
  --data-urlencode 'filter[parent_id][null]=true' \
  --data-urlencode 'include=owner' \
  --data-urlencode 'with_total=1' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'

const response = await fetch('https://<your-url>/api/v2/drive-folders?filter[owner_type]=project&filter[owner_id]=1&filter[parent_id][null]=true&include=owner&with_total=1', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
  },
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->get('https://<your-url>/api/v2/drive-folders?filter[owner_type]=project&filter[owner_id]=1&filter[parent_id][null]=true&include=owner&with_total=1');

import requests
response = requests.request(
    'GET',
    'https://<your-url>/api/v2/drive-folders?filter[owner_type]=project&filter[owner_id]=1&filter[parent_id][null]=true&include=owner&with_total=1',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json'},
)

Response

The shape of the response, with sample values.

{
  "data": [
    {
      "id": 1,
      "name": "Kick-off",
      "parent_id": 1,
      "parent_folder": null,
      "owner_type": "project",
      "owner_id": 1,
      "owner": {
        "id": 1
      },
      "order": 1,
      "created_by": 1,
      "inherits_permissions": false,
      "general_access": "everyone_edit",
      "access": "view"
    }
  ],
  "meta": {
    "page": {
      "per_page": 1,
      "next_cursor": "…",
      "prev_cursor": "…",
      "total": 1
    }
  },
  "links": {
    "self": "https://<your-url>/api/v2/work-items/1",
    "next": "https://<your-url>/api/v2/work-items/1",
    "prev": "https://<your-url>/api/v2/work-items/1"
  }
}

4 more fields, listed under Response

Access is decided per folder (the permission for the owner type, the access inherited from the nearest ancestor that does not inherit, then any per-folder grant), and it applies before any filter you send, so this collection can be read across the whole organisation without leaking a folder the caller cannot open. Narrow it to one drive with the owner_type/owner_id pair, which must be sent together, and to one level with filter[parent_id]; filter[parent_id][null]=true is the drive root, and a bare id is that folder's direct children, which is how a client walks the tree. The default name sort is stable across the organisation; the order sort is only meaningful once you have narrowed to one drive and one level, because positions are scoped per (owner_type, owner_id, parent_id). A folder is hard-deleted, so there is no trashed parameter. total is omitted unless you pass with_total=1. The declared permission is project_drive::access; customer_drive, organization_drive and user_drive apply by owner type, a token covering any of the four is accepted, and the per-folder rule is what actually decides.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

26 parameters in 6 groups

Views

viewstring

Which field set to render.

summarydefaultdetail

Pagination

Cursor pagination only. Follow links.next.

per_pageinteger1 to 100

Rows per page. At most 25 when include names a to-many relation; a larger value is 400 invalid-query-parameter.

Default: 25

cursorstring

Opaque keyset cursor from a previous page's links.next. Never construct one by hand.

with_totalboolean

Whether meta.page.total is counted for this request.

Default: false

Filters

=: equals
[in]: any of a comma-separated list
[null]: true or false: whether it is empty
[gte][lt]: at least, less than
[ne]: not equal

filter[created_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Creation timestamp. Pair with sort=id for a stable full export.

filter[created_by]integer=[in][null]

Author of the folder. Null on legacy rows.

A comma-separated list of at most 100 values.

filter[general_access]string=[ne][in]

Baseline sharing tier, which applies only while inherits_permissions is false.

A comma-separated list of at most 100 values.

everyone_editeveryone_viewrestricted

New values may be added.

filter[inherits_permissions]boolean

Whether the folder takes its permissions from its parent.

filter[owner_id]integer=[in]

Id of the record whose drive this is, within the owner_type given. Must be sent together with owner_type. For organization it is your own organisation's id.

A comma-separated list of at most 100 values.

filter[owner_type]string

Which drive the folder lives in: project, customer, organization or user. Must be sent together with owner_id.

filter[parent_id]integer=[in][null]

Folder this one sits in. Pass null to list the folders at the drive root, or an id to list one level of the tree.

A comma-separated list of at most 100 values.

filter[updated_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Last-write timestamp. Use for incremental sync.

Search

qstring

Free-text search over name. At most one substring match per request: q together with a contains filter is 400 invalid-query-parameter.

Sorting

sortstring

Up to three keys, comma-separated, each optionally prefixed with - for descending.

Default: name

Key	Sorts by
`name`	Folder name, A to Z.
`order`	Sort position within the drive and level, as shown in the drive tree. Positions count per drive and level, so this order is only meaningful once the collection is narrowed with `filter[owner_type]`, `filter[owner_id]` and `filter[parent_id]`; across the whole organisation it interleaves every drive and every level.
`id`	Id, ascending. An id never changes, so use this for a stable full export.
`updated_at`	Last-write timestamp; pair with the id tiebreaker for sync.

Prefix a key with - for descending.

Includes

includestring

Comma-separated names to inline, at most five.

Path	Adds	Cost
`owner`	The project, customer, organisation or user whose drive this folder lives in.	+1
`parent_folder`	The folder this one sits in; absent for folders at the drive root.	+1

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-None-Matchstring

The ETag a read is conditional on. A match is answered 304 with no body.

Response 200

Returns a page of DriveFolderList rows.

dataarray of DriveFolderList

The rows, each a DriveFolderList.

meta.pagePageOptionalTotal

per_page, next_cursor, prev_cursor, total.

linksPageLinks

self, next, prev.

Each row is a DriveFolderList: 16 fields.

Headers

ETag: A weak validator (W/"…") of the rendered page.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning

idinteger

Unique identifier.

namestring≤ 255

Folder name as shown in the drive tree.

parent_idinteger or null

Folder this one sits in, or null at the drive root.

parent_folderRef or DriveFolderSummary or null

The folder this one sits in; absent for folders at the drive root.

owner_typestring

The kind of record owner points at; it says which branch of owner applies.

projectcustomerorganizationuser

New values may be added.

owner_idinteger

The id of the record owner points at.

ownerRef or ProjectSummary or CustomerSummary or UserSummary

The project, customer, organisation or user whose drive this folder lives in. An organisation-owned folder renders as a bare {"id": N} reference.

Which form you get depends on owner_type.

project: ProjectSummary
customer: CustomerSummary
organization: Ref
user: UserSummary

orderintegerServer-assigned

Sort position within the drive and level, as shown in the drive tree. Positions count per drive and level, so the sequence is only meaningful once the collection is narrowed to one drive and one level. It is not assigned on create, so a folder created through the API stays at 0 until it is positioned in plnnrly; reordering is not exposed in v2.0.

created_byinteger or nullServer-assigned

Author; always the authenticated user at create time. Null on legacy rows and where the author has since been deleted.

inherits_permissionsboolean

Whether this folder takes its permissions from its parent.

general_accessstring

Baseline sharing tier, consulted only while inherits_permissions is false.

everyone_editeveryone_viewrestricted

New values may be added.

accessstring or null

The calling user's effective access level on this folder, after the permission for the owner type, the access inherited from folders and any per-folder grant.

viewedit

New values may be added.

created_attimestamp (YYYY-MM-DDThh:mm:ssZ)

Creation timestamp.

updated_attimestamp (YYYY-MM-DDThh:mm:ssZ)

Last-write timestamp; use for incremental sync.

drive_items_countinteger≥ 0

Live drive items directly in this folder that the caller may see. Archived items are not counted, and neither are items in subfolders.

linksDriveFolderLinks

Show 2 child fields

links.selfurl

The canonical URI of this record.