List a drive item's files

GEThttps://<your-url>/api/v2/drive-items/{drive_item}/files

MCP id drive-items.files.indexAlso on this path: POST Attach an uploaded file to a drive item

Returns the files on one drive item, newest upload first, keyset-paginated: all three of its file collections (attachments, content for images pasted into the editor, and file for the single uploaded payload), so narrow with filter[collection]=file to get the payload alone.

Token scope: api:read:project_driveorapi:read:customer_driveorapi:read:organization_driveorapi:read:user_drive
Without it: 403 insufficient-token-scope.
Permission: project_drive::access
Without it: 403 insufficient-permission.
Rate cost: 1 unit, read bucket. view=detail makes it 3. Adds: each include +1, q +2.
Also: If-None-Match answers 304 when nothing changed. Never cached: private, no-store. Unknown query parameters are refused, never ignored.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: One drive item's uploaded payload, with a download URL

curl -G \
  'https://<your-url>/api/v2/drive-items/1/files' \
  --data-urlencode 'filter[collection]=file' \
  --data-urlencode 'include=url' \
  --data-urlencode 'per_page=25' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'

const response = await fetch('https://<your-url>/api/v2/drive-items/1/files?filter[collection]=file&include=url&per_page=25', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
  },
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->get('https://<your-url>/api/v2/drive-items/1/files?filter[collection]=file&include=url&per_page=25');

import requests
response = requests.request(
    'GET',
    'https://<your-url>/api/v2/drive-items/1/files?filter[collection]=file&include=url&per_page=25',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json'},
)

Response

The shape of the response, with sample values.

{
  "data": [
    {
      "id": 1,
      "name": "…",
      "mime_type": "…",
      "size": 1,
      "disk": "…",
      "collection": "…",
      "created_at": "2026-03-04T09:15:00Z",
      "updated_at": "2026-03-04T09:15:00Z",
      "…": "2 optional fields left out"
    }
  ],
  "meta": {
    "page": {
      "per_page": 1,
      "next_cursor": "…",
      "prev_cursor": "…",
      "total": 1,
      "current_page": 1,
      "last_page": 1
    },
    "warnings": [
      {
        "…": "6 fields of warnings"
      }
    ]
  },
  "links": {
    "self": "https://<your-url>/api/v2/work-items/1",
    "next": "https://<your-url>/api/v2/work-items/1",
    "prev": "https://<your-url>/api/v2/work-items/1"
  }
}

There is no organisation-wide collection of files, so this nested path is the only way to list them and filter[model_type] / filter[model_id] do not exist: the parent is the path segment. Access to the parent is decided per item (the permission for the owner type, the access inherited from its folder, then any per-item grant), and an archived drive item answers 404. The declared permission is project_drive::access; customer_drive, organization_drive and user_drive apply by owner type, and a token covering any of the four is accepted. Listing additionally requires project_management::manage_work_items for the files themselves. The API never streams bytes: pass include=url for a signed download URL per file, and attach a new file with the two-step upload flow that starts at POST drive-items/{drive_item}/uploads.

Path parameters

drive_itemintegerRequired

The DriveItem's numeric id. Accepts a soft-deleted record.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

16 parameters in 7 groups

Views

viewstring

Which field set to render.

summarydefaultdetail

Pagination

per_pageinteger1 to 100

Rows per page. At most 25 when include names a to-many relation; a larger value is 400 invalid-query-parameter.

Default: 25

cursorstring

Opaque keyset cursor from a previous page's links.next. Never construct one by hand.

pageinteger1 to 1000

Opt in to page-number paging: 1-based, at most 1000. Omit it, the default, to page by opaque cursor, which is what links.next hands you. Cannot be combined with cursor. Published only on collections that count their rows on every request.

Filters

=: equals
[gte][lt]: at least, less than

filter[collection]string

filter[created_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Creation timestamp. Pair with sort=id for a stable full export.

filter[updated_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Last-write timestamp. Use for incremental sync.

filter[collection][starts]string

Narrow to one media collection. A work item registers only attachments; a drive item registers attachments, content (inline editor images) and file (the single uploaded payload), so filter[collection]=file is how a client asks a drive item for its payload alone. One value, matched literally as a prefix: send commas and backslashes as they are, and % and _ match themselves rather than acting as wildcards.

Search

qstring

Free-text search over name. At most one substring match per request: q together with a contains filter is 400 invalid-query-parameter.

Sorting

sortstring

Up to three keys, comma-separated, each optionally prefixed with - for descending.

Default: created_at

Key	Sorts by
`created_at`	Upload timestamp, newest first.
`name`	File name, A→Z.
`id`	Id, ascending. An id never changes, so use this for a stable full export.
`updated_at`	Last-write timestamp; pair with the id tiebreaker for sync.

Prefix a key with - for descending.

Includes

includestring

Comma-separated names to inline, at most five.

Path	Adds	Cost
`url`	Signed download URL. Null where your organisation's file storage cannot sign URLs, with a `signed_url_unavailable` warning.	+1
`url_expires_at`	When the signed `url` stops working. Always `null` in v2.0: the signed URL does not expire. Request together with url.	+1

Other

trashedstring

Whether soft-deleted rows are included.

withoutdefaultwithonly

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-None-Matchstring

The ETag a read is conditional on. A match is answered 304 with no body.

Response 200

Returns a page of MediaList rows.

dataarray of MediaList

The rows, each a MediaList.

meta.pagePage

per_page, next_cursor, prev_cursor, total, current_page, last_page.

meta.warningsarray of object

Non-fatal notes about this request. Switch on code, never on detail.

linksPageLinks

self, next, prev.

Each row is a MediaList: 10 fields.

Headers

ETag: A weak validator (W/"…") of the rendered page.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning