zazzy
API reference

List the authenticated organization's files

Returns metadata for the authenticated organization's ready files — newest first — paginated with the shared cursor envelope: pass `?limit=` (default 50, max 100) and the `nextCursor` from a previous response as `?cursor=` to page forward. `nextCursor` is `null` on the last page. Pass `?purpose=` (`avatar`, `logo`, or `attachment`) to narrow to one purpose. Only files that finished uploading are listed; pending and deleted files are omitted, and no download URLs are returned. Requires the `read` scope.

GET
/files

Authorization

apiKey
AuthorizationBearer <token>

A bearer API key minted in Account settings → API keys. Send it as Authorization: Bearer <token>. The scheme match is case-insensitive; the token is taken verbatim. A missing, malformed, unknown, revoked, or expired key is rejected with an indistinguishable 401.

In: header

Query Parameters

cursor?string

An opaque cursor from a previous response's nextCursor. Omit for the first page.

limit?integer

Page size. Clamped to [1, 100] (values outside the range are clamped, not rejected); defaults to 50 when omitted.

Range1 <= value <= 100
purpose?string

Narrow to one purpose: avatar, logo, or attachment. An unrecognized value is rejected with a 400. Omit for every purpose.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/files"
{  "data": [    {      "id": "file_01HZY1QG4T",      "name": "invoice-2026-02.pdf",      "size": 48213,      "purpose": "attachment",      "createdAt": "2026-02-11T14:03:00.000Z"    },    {      "id": "file_01HZY0M4A1",      "name": "avatar.png",      "size": 20480,      "purpose": "avatar",      "createdAt": "2026-01-04T09:12:00.000Z"    }  ],  "nextCursor": "MjAyNi0wMS0wNFQwOToxMjowMC4wMDBafGZpbGVfMDFIWlkwTTRBMQ"}
{  "error": {    "code": "VALIDATION",    "message": "Invalid pagination cursor."  }}
{  "error": {    "code": "UNAUTHORIZED",    "message": "Invalid API key."  }}
{  "error": {    "code": "FORBIDDEN",    "message": "This API key lacks the required 'read' scope."  }}
{  "error": {    "code": "RATE_LIMITED",    "message": "API rate limit exceeded. Retry after the window resets."  }}
{  "error": {    "code": "INTERNAL",    "message": "An unexpected error occurred."  }}

List the authenticated organization's audit events GET

Returns the authenticated organization's audit events — newest first — paginated with the shared cursor envelope: pass `?limit=` (default 50, max 100) and the `nextCursor` from a previous response as `?cursor=` to page forward. `nextCursor` is `null` on the last page. Narrow the result with `?action=` (exact action name), `?actorId=` (exact acting user id), and the inclusive `?from=`/`?to=` ISO 8601 date range. Requires the `read` scope.

Get the authenticated key and organization GET

Returns the API key the request authenticated with and the organization that owns it — an integration can call this to confirm *which* key and org a token resolves to. Requires the `read` scope.