---
title: "List a Pen's files"
method: GET
path: "/v2/pens/{id}/files"
tags: ["Files"]
---

# List a Pen's files

`GET /v2/pens/{id}/files`

## Request

- Base URL: `https://api.codepen.io`
- URL: `https://api.codepen.io/v2/pens/{id}/files`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

The files of the saved head, with `content`.

## Response `200`

The files.

- File[]
  - `bytes` integer, required
  - `content` string, nullable, required: Null for binary files, which are read from `url`.
  - `content_hash` string, required
  - `content_type` string, required: The media type the file is served with, from its extension.
  - `download_url` string, uri, nullable, required: The file's exact bytes for anyone holding the URL, on the API host (`GET /v2/pens/{id}/download/{path}`), for one hour from this response: no API key, session or Referer needed. Served as an attachment with the file's `content_type`. A new URL comes with every read; an expired one answers `403`. Null for the files of a Pen made in the classic editor.
  - `id` string, required: Stable across versions, renames and edits.
  - `is_binary` boolean, required
  - `name` string, required
  - `path` string, required
  - `url` string, uri, nullable, required: Where the file is served raw on the Pen's content domain. It follows the Pen's own access rules: a Private, Protected or Collaborators Pen needs a browser session and a Pen owned by a Free account needs a CodePen Referer, neither of which an API client has, so read files through `content` or `download_url`. Null for the files of a Pen made in the classic editor.

## Other responses

- `401`: `UNAUTHENTICATED`: a missing or invalid key, a deleted owner, or a Team key for a Team that is not PRO.
- `404`: `NOT_FOUND`: no such item, or one that is not the key owner's, public or not. A path that is not an endpoint at all answers `404` with the v1 body `{ "error": "not found" }` instead.
- `429`: `RATE_LIMITED`: the owner exceeded the plan's requests in an hour, its reads today, or today's allowance of Pen or Collection creates. No `Retry-After` or rate-limit headers are sent; the body carries `retry_after_seconds`, `limit` and `reset_at`.
- `500`: `INTERNAL`: unexpected, and reported; the message is generic.

---

[API](https://skmtc.dev/codepen/apis/codepen-api.md) - [All operations](https://skmtc.dev/codepen/apis/codepen-api/llms.txt) - [OpenAPI document](https://skmtc.dev/codepen/apis/codepen-api/revisions/108fe91e3ef5?raw)