Use an API key from the Subscriptions screen. Each subscription can have multiple API keys, and the key base path is the workspace root. If the workspace root is /Projects/, the FileMaker WebViewer can use / as its root.

Authorization: Bearer fmfs_xxxxxxxxx
x-api-key: fmfs_xxxxxxxxx

Base URL

http://server:8080/api

Local storage needs a writable mount path on the CT, WebDAV needs connection credentials, and remote API storage needs a compatible file API endpoint.

local:
  mountPath

webdav:
  baseUrl
  rootPath
  username
  password

remote-api:
  baseUrl
  token
  rootPath
  authHeader
  authScheme

Without a path parameter this returns active files at the API key root. Use / and subfolders relative to that root; /Projects/ can be hidden behind the key.

curl -H "Authorization: Bearer API_KEY" \
  "http://server:8080/api/files"

curl -H "Authorization: Bearer API_KEY" \
  "http://server:8080/api/files?path=/Patients/P001/"

Send multipart form data with a file and optional FileMaker context JSON. Put app-specific values inside appValues. If path is omitted, upload goes to the API key base path.

curl -H "Authorization: Bearer API_KEY" \
  -F "file=@report.pdf" \
  -F 'context={"userId":"mb","appValues":{"patientId":"P001","consultId":"C001","caseId":"K001"}}' \
  http://server:8080/api/files

Creates an empty virtual folder under the API key root. Uploads also create their target path automatically.

curl -X POST \
  -H "Authorization: Bearer API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"path":"/Patients/P001/Reports/"}' \
  http://server:8080/api/paths

Removes an empty virtual folder (and any empty descendants). Refuses with 409 if any file record still lives under the path, and never deletes the API key root. Requires the files:delete permission.

curl -X DELETE \
  -H "Authorization: Bearer API_KEY" \
  "http://server:8080/api/paths?path=/Patients/P001/Reports/"

Moves a file to another path inside the API key root. Optional fileName changes the display/download name.

curl -X PATCH \
  -H "Authorization: Bearer API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"path":"/Patients/P001/Images/","fileName":"image-01.png"}' \
  http://server:8080/api/files/FILE_ID/move

{
  "ok": true,
  "id": "uuid",
  "fileName": "report.pdf",
  "storagePath": "/Patients/P001/report.pdf",
  "mimeType": "application/pdf",
  "size": 12345,
  "uploadedAt": "2026-05-30T21:00:00.000Z",
  "uploadedBy": "mb",
  "appValues": {
    "patientId": "P001",
    "consultId": "C001",
    "caseId": "K001"
  },
  "downloadUrl": "http://server:8080/api/files/id/download",
  "previewUrl": "http://server:8080/api/files/id/preview?token=..."
}

DELETE marks the file as removed and hides it from normal file listing. The admin Files view and Logs keep the record for auditing.

curl -X DELETE \
  -H "Authorization: Bearer API_KEY" \
  http://server:8080/api/files/FILE_ID

Creates a public download page for one or more files. Use expiresAt for the valid period, codeRequired for an 8-character generated access code, and maxDownloads to limit downloads. The returned url and code are safe to send by mail.

curl -X POST \
  -H "Authorization: Bearer API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"fileIds":["FILE_ID"],"title":"Report","expiresAt":"2026-06-07T22:00:00.000Z","codeRequired":true,"maxDownloads":10}' \
  http://server:8080/api/shares

These are for the admin portal/login session, not normal FileMaker API keys.

GET  /api/admin/storage
GET  /api/admin/apps
POST /api/admin/apps
POST /api/admin/apps/:id/keys
PATCH /api/admin/apps/:id/settings
DELETE /api/admin/apps/:id
POST /api/admin/apps/:id/restore
GET  /api/admin/files
GET  /api/admin/shares
POST /api/admin/shares/:id/revoke
DELETE /api/admin/shares/:id
POST /api/admin/shares/clean-revoked
GET  /api/admin/logs
POST /api/admin/logs/clear
GET  /api/admin/keys/:id/reveal
POST /api/admin/keys/:id/revoke