4klyft API (1.0.0)

Creates a resumable upload session. Returns the session id; clients then PATCH /storage/uploads/{id} with Upload-Offset headers to deliver chunks, and POST /storage/uploads/{id}/finalize to assemble.

Returns current offset, total size, status, and other session metadata. Used by clients to resume after a disconnect.

Mark the session abandoned and clean up any transient chunk blobs.

Append raw octet-stream bytes at the offset declared in the Upload-Offset header. Must match the server-side offset exactly; mismatch returns HTTP 409 with the expected offset.

Concatenate all received chunks into the final stored file and emit FileUploaded. Idempotent on retry as long as the session has not been abandoned.

Retrieve a paginated list of storage drives with optional filters.

Create a new storage drive.

Returns whether the drive has stored credentials and a redacted set of public hints. Never returns secret material.

Store encrypted credentials for an S3, S3-compatible, SFTP, or Azure Blob drive. The "type" field discriminates which fields apply.

Retrieve a single storage drive by its ID.

Activate a suspended drive.

Disconnect a drive, making it unavailable.

Suspend an active drive.

Update the label of a drive.

Returns the authorization URL the browser must navigate to plus the signed state token to be mirrored back on the callback.

Refresh the OAuth access token for a drive

Fetch file metadata by its storage name.

List files and folders within a drive at the given path.

Delete a file from the specified drive.

Mint a short-lived signed URL that streams the file via the public access endpoint. The URL can be embedded in /

Upload a file to the specified drive.

Create a new folder in the specified drive.

Delete a folder and all its contents from the specified drive.

Public endpoint: streams the file bytes; the signed token IS the auth (signature + expiry).

Same as the token stream, with a trailing /{filename} so external consumers see a real file extension. The token is the auth; the filename is ignored.

Declares an upload intent for a purpose + config and returns the intent — its id, resolved slots (each with accepted types/size/count constraints), and expiry. Idempotent per (purpose, config, identity): a reload returns the same active intent rather than duplicating staged files. Consumer features reference only the returned intent id.

Returns the intent status, its slots, and the files staged into each slot so far.

Marks the intent complete once every required slot has met its minimum file count. The consumer feature then references the intent id to read the staged files. Pass {"saveToDrive": true} to PROMOTE each staged file into the tenant's document drive (durable, browsable, re-readable) instead of leaving it ephemeral — the response staged then carries the document URIs.

Uploads one file (multipart form field file) into the named slot. The server sniffs the mime type from the bytes and validates it plus the size against the slot constraints — a client-declared content type is never trusted. P2 replaces this proxied path with a presigned direct-to-driver URL.