canonical: https://jentic.com/apis/files.com/files

# Files.com API

The Files.com API exposes 260 REST operations covering managed file transfer, secure cloud storage, and the orchestration features that wrap them - users, groups, permissions, automations, behaviors, action notifications, API keys, and bundles. Authentication is performed by sending an X-FilesAPI-Key header containing a user-scoped or site-wide API key. The API is the programmatic surface behind Files.com's enterprise MFT product, used by IT and operations teams that need to move sensitive files between partners, legacy SFTP systems, and cloud destinations.

## For AI agents

Drive Files.com managed file transfer end to end - users, folders, automations, action notifications, and API keys - via a single X-FilesAPI-Key header.

## Scope

Does not handle in-place document editing, e-signature workflows, or media transcoding - use for managed file transfer, secure share, and automation orchestration only.

## Capabilities

- Provision API keys with scoped lifetimes for downstream automations and bots
- Set up action notification exports so an agent gets a webhook when a file lands
- Manage users, groups, and folder permissions to enforce least-privilege access
- Orchestrate folder-level automations such as move, copy, and remote sync rules
- Generate share bundles with expiration and password protection for partner exchange
- Pull audit history of every file action to feed compliance and SIEM pipelines
- List and revoke API keys when a partner offboards or a token is suspected leaked

## Use cases

### Partner File Exchange Bundles

Operations teams that exchange large files with external partners can have an agent call POST /bundles to create a password-protected, time-limited share link, then deliver that link plus credentials to the partner over a secondary channel. The bundle is auto-revoked at expiry, removing the manual revocation step that often gets forgotten and avoiding stale share URLs.

Example prompt: Call POST /bundles with the source paths, an expiry of 7 days, and a generated password, then return the bundle URL and password to the workflow that requested the share.

### Compliance Audit Reporting

Compliance teams subject to SOC 2 or HIPAA reviews can have an agent walk Files.com history endpoints, pull every action against a sensitive folder over the audit window, and emit a structured report. Files.com keeps the action history server-side, so the agent does not need to maintain its own log shipping pipeline to produce the artifact.

Example prompt: Call the relevant history list endpoint with a date range and folder filter, group by user, and write a CSV of every read, write, and delete action.

### Inbound File Trigger to Workflow

Data engineering teams that drop CSVs into a Files.com folder for downstream ETL can have an agent register an action notification export so that every new file fires a webhook. The agent then fetches metadata, validates the schema, and dispatches the file to the correct ETL job - without polling.

Example prompt: Call POST /action_notification_exports with the folder path and target webhook URL, then handle each delivered event by validating and forwarding the file path to the ETL queue.

### User and Permission Lifecycle

When a partner organization onboards or offboards, an agent can call into Files.com user, group, and permission endpoints to provision the user, place them in the correct group, and grant scoped folder access. On offboard, the same agent revokes API keys and removes group membership in a single sequence, closing the access loop.

Example prompt: Create the user, add them to the partner group, grant folder permissions, then on offboard delete the user, revoke their API keys, and remove group membership.

### AI Agent Files.com Integration via Jentic

An agent connected to Jentic can search by intent across Files.com's 260 operations - for example create a secure share link - and Jentic returns only the relevant operations with their schemas. The X-FilesAPI-Key never enters the agent's context, and integration time drops from a multi-week MFT project to under an hour.

Example prompt: Search Jentic for create a files.com share bundle, load the POST /bundles schema, and execute with Jentic injecting the X-FilesAPI-Key from the vault.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/api_keys` | List API keys for the site or user |
| POST | `/api_keys` | Create a new API key |
| POST | `/action_notification_exports` | Configure a webhook export for file events |
| GET | `/action_notification_export_results` | List delivery results for action notifications |
| GET | `/api_key` | Retrieve the current API key in use |
| PATCH | `/api_key` | Update the current API key |
| DELETE | `/api_key` | Revoke the current API key |

## Key resources

- **API Keys** — Create, list, and revoke API keys with user or site-wide scope
- **Bundles** — Generate password-protected, expiring share links for files and folders
- **Action Notifications** — Webhook exports that fire on file events such as upload, modify, or delete
- **Users and Groups** — Manage user identities, group membership, and folder permissions
- **Behaviors and Automations** — Folder-level rules such as auto-encrypt, copy, and remote sync
- **History** — Audit log of every file action for compliance reporting

## Why Jentic

- **Setup:** Wiring the Files.com API by hand means managing the X-FilesAPI-Key header, rotating keys, and finding the right route among 260 managed-transfer paths yourself. Through Jentic you install once, import the Files.com API from the API Directory, store the API key once, and your agent calls it.
- **Permission scoping:** Files.com's transfer and share targets travel in the request rather than as owned-resource path ids, so limit the agent to the operations it needs, such as creating an API key or reading notification export results, and leave the rest out. Because you choose the allowed operations, a destructive action like deleting a key runs only if you include it.
- **Credential handling:** Your Files.com API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. The raw key never enters the agent's prompt, logs, or context, and rotations stay transparent to the agent.
- **Discovery method:** Agents search Jentic by intent such as 'create a share link' or 'export notification history', and Jentic returns the matching Files.com operation with its input schema, so the agent does not have to navigate the full spec.

## Related APIs

- **Dropbox API** — Consumer-friendly cloud storage rather than enterprise managed file transfer
- **Box API** — Enterprise content cloud with collaboration and governance features
- **Dropbox API** — Sync files between Dropbox and Files.com remote mounts

## FAQ

### What authentication does the Files.com API use?

Files.com uses a static API key sent in the X-FilesAPI-Key header. The key can be user-scoped or site-wide. Through Jentic, the key lives in the encrypted vault and is injected at execution; the agent only ever sees a vault reference.

### Can I create a password-protected share link with the Files.com API?

Yes. Use the bundles endpoints to create a bundle with an expiration and an optional password. The response returns the share URL, which an agent can then deliver to the recipient out of band.

### What are the rate limits for the Files.com API?

Files.com applies per-site throttling at the gateway and the spec does not publish a single fixed limit. Agents should respect 429 responses with exponential backoff and prefer paginated listing endpoints over polling /history.

### How do I trigger a workflow when a file is uploaded through Jentic?

Search Jentic for create a files.com action notification, load the POST /action_notification_exports operation, and execute it with your folder path and webhook URL. Jentic injects the X-FilesAPI-Key from the vault, so the credential never reaches the agent.

### Can I rotate or revoke a Files.com API key programmatically?

Yes. The API exposes /api_keys for listing and creating, and /api_key for managing the current credential. An agent can mint a new key, swap it into downstream consumers, and then DELETE the old one to complete a rotation.

### Is the Files.com API free to use?

API access is included with every paid Files.com plan. There is no separate API tier - the same plan limits that govern user count and storage also apply to API consumption.

### Can I limit what my agent is allowed to do with the Files.com API?

Yes. Because Jentic One is self-hosted, you decide which of the 260 Files.com operations your agent may call, so you can allow just the ones it needs, such as POST /api_keys to mint a scoped key or GET /action_notification_export_results to read delivery results. Since Files.com's transfer and share targets travel in the request body rather than as owned-resource path ids, this operation allowlist is the control that keeps the agent inside its lane. A destructive call like DELETE /api_key runs only if you explicitly include it, and your API key stays under your own instance's control.