List drive items

GEThttps://<your-url>/api/v2/drive-items

MCP id drive-items.indexAlso on this path: POST Create a drive item

Returns the drive items the caller may read: the rows plnnrly's file browser lists.

Token scope: api:read:project_driveorapi:read:customer_driveorapi:read:organization_driveorapi:read:user_drive
Without it: 403 insufficient-token-scope.
Permission: project_drive::access
Without it: 403 insufficient-permission.
Rate cost: 1 unit, read bucket. view=detail makes it 3. Adds: with_total=1 +2, each include +1 (to-many +3), q +2.
Also: If-None-Match answers 304 when nothing changed. Never cached: private, no-store. Unknown query parameters are refused, never ignored.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: One project's drive root, with owners expanded

curl -G \
  'https://<your-url>/api/v2/drive-items' \
  --data-urlencode 'filter[owner_type]=project' \
  --data-urlencode 'filter[owner_id]=1' \
  --data-urlencode 'filter[folder_id][null]=true' \
  --data-urlencode 'include=owner,tags' \
  --data-urlencode 'with_total=1' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'

const response = await fetch('https://<your-url>/api/v2/drive-items?filter[owner_type]=project&filter[owner_id]=1&filter[folder_id][null]=true&include=owner%2Ctags&with_total=1', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
  },
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->get('https://<your-url>/api/v2/drive-items?filter[owner_type]=project&filter[owner_id]=1&filter[folder_id][null]=true&include=owner%2Ctags&with_total=1');

import requests
response = requests.request(
    'GET',
    'https://<your-url>/api/v2/drive-items?filter[owner_type]=project&filter[owner_id]=1&filter[folder_id][null]=true&include=owner%2Ctags&with_total=1',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json'},
)

Response

The shape of the response, with sample values.

{
  "data": [
    {
      "id": 1,
      "title": "Kick-off notes",
      "group": "…",
      "kind": "document",
      "source": "builtin",
      "folder_id": 1,
      "drive_folder": null,
      "owner_type": "project",
      "owner_id": 1,
      "owner": {
        "id": 1
      },
      "content_record_type": "drive_document",
      "content_record_id": 1
    }
  ],
  "meta": {
    "page": {
      "per_page": 1,
      "next_cursor": "…",
      "prev_cursor": "…",
      "total": 1
    },
    "warnings": [
      {
        "…": "6 fields of warnings"
      }
    ]
  },
  "links": {
    "self": "https://<your-url>/api/v2/work-items/1",
    "next": "https://<your-url>/api/v2/work-items/1",
    "prev": "https://<your-url>/api/v2/work-items/1"
  }
}

14 more fields, listed under Response

Access is decided per item (the permission for the owner type, the access inherited from its folder, then any per-item grant), and it applies before any filter you send, so this collection can be read across the whole organisation without leaking an item the caller cannot open. Narrow it to one drive with the owner_type/owner_id pair, which must be sent together, and to one folder with filter[folder_id]; the default order_column sort is only meaningful once you have, because positions are scoped per (owner_type, owner_id, folder_id) and an organisation-wide sort by it interleaves every drive. Pass trashed=with or trashed=only to see archived items; that needs only this endpoint's permission, never the restore ability. total is omitted unless you pass with_total=1. The declared permission is project_drive::access; customer_drive, organization_drive and user_drive apply by owner type, and a token covering any of the four is accepted.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

41 parameters in 7 groups

Views

viewstring

Which field set to render.

summarydefaultdetail

Pagination

Cursor pagination only. Follow links.next.

per_pageinteger1 to 100

Rows per page. At most 25 when include names a to-many relation; a larger value is 400 invalid-query-parameter.

Default: 25

cursorstring

Opaque keyset cursor from a previous page's links.next. Never construct one by hand.

with_totalboolean

Whether meta.page.total is counted for this request.

Default: false

Filters

=: equals
[in]: any of a comma-separated list
[null]: true or false: whether it is empty
[gte][lt]: at least, less than
[ne]: not equal

filter[archived_by]integer=[in][null]

The user who archived the item. Pair it with trashed=only for an archive view.

A comma-separated list of at most 100 values.

filter[content_record_id]integer=[in][null]

Id of the document body. Must be sent together with content_record_type.

A comma-separated list of at most 100 values.

filter[content_record_type]string

Type of body the item points at. drive_document is the only value. Must be sent together with content_record_id.

filter[created_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Creation timestamp. Pair with sort=id for a stable full export.

filter[created_by]integer=[in][null]

Author of the item.

A comma-separated list of at most 100 values.

filter[folder_id]integer=[in][null]

Folder the item sits in. Pass null to list the items at the drive root.

A comma-separated list of at most 100 values.

filter[general_access]string=[ne][in]

Baseline sharing tier, which applies only while inherits_permissions is false.

A comma-separated list of at most 100 values.

everyone_editeveryone_viewrestricted

New values may be added.

filter[inherits_permissions]boolean

Whether the item takes its permissions from its folder.

filter[kind]string=[ne][in]

What the item is.

A comma-separated list of at most 100 values.

document
pdf
image
audio
video
office
other

New values may be added.

filter[owner_id]integer=[in]

Id of the record whose drive this is, within the owner_type given. Must be sent together with owner_type. For organization it is your own organisation's id.

A comma-separated list of at most 100 values.

Search

qstring

Free-text search over title. At most one substring match per request: q together with a contains filter is 400 invalid-query-parameter.

Sorting

sortstring

Up to three keys, comma-separated, each optionally prefixed with - for descending.

Default: order_column

Key	Sorts by
`order_column`	Sort position within the owner and folder, as shown in the drive tree. Positions count per drive and folder, so this order is only meaningful once the collection is narrowed with `filter[owner_type]`, `filter[owner_id]` and `filter[folder_id]`; across the whole organisation it interleaves every drive.
`title`	Item title, A to Z.
`id`	Id, ascending. An id never changes, so use this for a stable full export.
`updated_at`	Last-write timestamp; pair with the id tiebreaker for sync.

Prefix a key with - for descending.

Includes

includestring

Comma-separated names to inline, at most five.

Path	Adds	Cost
`drive_folder`	The folder this item sits in; absent for items at the drive root.	+1
`owner`	The project, customer, organisation or user whose drive this item lives in.	+1
`tags`	Tags on this item. An item takes at most 50, so this is the whole set.	to-many · +3

Other

trashedstring

Whether soft-deleted rows are included.

withoutdefaultwithonly

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-None-Matchstring

The ETag a read is conditional on. A match is answered 304 with no body.

Response 200

Returns a page of DriveItemList rows.

dataarray of DriveItemList

The rows, each a DriveItemList.

meta.pagePageOptionalTotal

per_page, next_cursor, prev_cursor, total.

meta.warningsarray of object

Non-fatal notes about this request. Switch on code, never on detail.

linksPageLinks

self, next, prev.

Each row is a DriveItemList: 27 fields.

Headers

ETag: A weak validator (W/"…") of the rendered page.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning

idinteger

Unique identifier.

titlestring≤ 255

Item title.

groupstring or null≤ 255

Free-text grouping label shown in the drive tree.

kindstring

What this item is. Everything created through the API is a document; the other kinds come from uploads in plnnrly.

document
pdf
image
audio
video
office
other

New values may be added.

sourcestring

Where the item came from: builtin for an editor document, upload for a file uploaded in plnnrly.

builtinupload

New values may be added.

folder_idinteger or null

Folder this item sits in, or null at the drive root.

drive_folderRef or DriveFolderSummary or null

The folder this item sits in; absent for items at the drive root.

owner_typestring

The kind of record owner points at; it says which branch of owner applies.

projectcustomerorganizationuser

New values may be added.

owner_idinteger

The id of the record owner points at.

ownerRef or ProjectSummary or CustomerSummary or UserSummary

The project, customer, organisation or user whose drive this item lives in. An organisation-owned item renders as a bare {"id": N} reference.

Which form you get depends on owner_type.

project: ProjectSummary
customer: CustomerSummary
organization: Ref
user: UserSummary

content_record_typestring or null

The kind of record content_record points at; it says which branch of content_record applies.

drive_document

New values may be added.

content_record_idinteger or null

The id of the record content_record points at.

content_recordRef or null

The body this item points at: a drive document for an editor document, null for an item with no body yet. Renders as a bare {"id": N} reference; read the body from GET /api/v2/drive-documents/{drive_document}.

Which form you get depends on content_record_type.

drive_document: Ref

order_columnintegerServer-assigned

Sort position, assigned by the server. Positions count per drive and folder, so the sequence is only meaningful once the collection is narrowed to one drive and one folder. Reordering is not exposed in v2.0.

created_byinteger or nullServer-assigned

Author; always the authenticated user at create time. Null on legacy rows and where the author has since been deleted.

archived_byinteger or nullServer-assigned

The user who archived this item; set on delete and cleared on restore.

inherits_permissionsboolean

Whether this item takes its permissions from its folder.

general_accessstring

Baseline sharing tier, consulted only while inherits_permissions is false.

everyone_editeveryone_viewrestricted

New values may be added.

accessstring or null

The calling user's effective access level on this item, after the permission for the owner type, the access inherited from folders and any per-item grant.

viewedit

New values may be added.

created_attimestamp (YYYY-MM-DDThh:mm:ssZ)

Creation timestamp.

updated_attimestamp (YYYY-MM-DDThh:mm:ssZ)

Last-write timestamp; use for incremental sync.

deleted_attimestamp (YYYY-MM-DDThh:mm:ssZ) or null

When this item was archived, or null while it is live.

comments_countinteger≥ 0

Comments on this item.

files_countinteger≥ 0

Files attached to this item, counting the attachments list in plnnrly, the single uploaded file and the images embedded in the document body.

tags_countinteger≥ 0

Tags on this item.

linksDriveItemLinks

Show 3 child fields

links.selfurl

The canonical URI of this record.

links.commentsurl

Comments on this drive item.

links.filesurl

Files stored on this drive item.

tagsarray of TagSummary≤ 50Only with include

Tags on this item. An item takes at most 50 tags, so the include lists them all. tag_ids replaces the whole set.

Wrapped in { data, meta }; meta.truncated says whether the cap was hit and meta.count is the full count.

Show 2 child fields

tags.idinteger

Unique identifier.

tags.titlestring≤ 255

Tag title as shown in the UI.

Errors

403 Forbidden.

forbidden-by-policy insufficient-permission insufficient-token-scope

8 errors every operation can return: 304, 400, 401, 404, 406, 429, 500, 503

304 Not modified.

400 Bad request.

idempotency-key-required invalid-cursor invalid-query-parameter malformed-request unsupported-parameter

401 Unauthenticated.

token-expired unauthenticated

404 Not found.

endpoint-not-found resource-not-found

406 Not acceptable.

not-acceptable

429 Too many requests.

rate-limit-exceeded

500 Server error.

internal-error

503 Service unavailable.

tenant-unavailable

This path allows GET, POST. Anything else answers 405.

Something wrong or missing on this page? Tell us