File browser

The file browser endpoints browse, preview, download, share and delete files in the storage backend (S3, MinIO or the local filesystem).

Auth: Every /api/file-browser endpoint (browse, metadata, signed-url, delete, download, upload) requires builder access (superadmin or the engineer role). Serving a file at /api/files/{filePath} requires the signed token from a signed URL (?token=).

Browse files

GET /api/file-browser/browse

Lists files and directories at a given prefix.

Query parameters

Parameter	Type	Required	Description
prefix	string	No	Directory prefix to list (e.g. screenshots/acme/)
pageSize	number	No	Max results (default: 100)
continuationToken	string	No	Cursor token from a previous response’s nextToken field. S3 and GCS use opaque cursor strings; local storage uses numeric offsets.

Example request

curl "https://lt.acme.dev/api/file-browser/browse?prefix=screenshots/&pageSize=100" \
  -H "Authorization: Bearer $LT_TOKEN"

Response 200

{
  "files": [
    { "path": "screenshots/page.png", "size": 32698, "modified_at": "2026-05-09T21:39:42.629Z" }
  ],
  "directories": ["screenshots/acme/"],
  "nextToken": null
}

Get file metadata

GET /api/file-browser/metadata/{filePath}

Returns metadata for a single file. The content type is inferred from the file extension when the storage backend returns a generic type.

Path parameters

Parameter	Type	Description
filePath	string	File path, slashes included

Example request

curl https://lt.acme.dev/api/file-browser/metadata/screenshots/page.png \
  -H "Authorization: Bearer $LT_TOKEN"

Response 200

{
  "path": "screenshots/page.png",
  "size": 32698,
  "modified_at": "2026-05-09T21:39:42.000Z",
  "content_type": "image/png"
}

Response 404: { "error": "File not found" }

Generate signed URL

POST /api/file-browser/signed-url

Generates a time-limited URL for sharing a file.

Request body

Field	Type	Required	Description
path	string	Yes	File path
expiresIn	number	Yes	Expiry in seconds. Allowed: 3600, 21600, 86400, 604800, 2592000

Example request

curl -X POST https://lt.acme.dev/api/file-browser/signed-url \
  -H "Authorization: Bearer $LT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "path": "screenshots/page.png", "expiresIn": 3600 }'

Response 200

{ "url": "https://...", "expiresAt": "2026-05-10T21:39:42.000Z" }

Delete file

DELETE /api/file-browser/delete/{filePath}

Permanently deletes a file from storage.

Path parameters

Parameter	Type	Description
filePath	string	File path, slashes included

Example request

curl -X DELETE https://lt.acme.dev/api/file-browser/delete/screenshots/page.png \
  -H "Authorization: Bearer $LT_TOKEN"

Response 200

{ "deleted": true, "path": "screenshots/page.png" }

Response 404: { "error": "File not found" }

Download file

GET /api/file-browser/download/{filePath}

Downloads a file with Content-Disposition: attachment. The response body is the file stream.

Path parameters

Parameter	Type	Description
filePath	string	File path, slashes included

Example request

curl -OJ https://lt.acme.dev/api/file-browser/download/screenshots/page.png \
  -H "Authorization: Bearer $LT_TOKEN"

Response 200: The file bytes.

Response 404: { "error": "File not found" }