List tool files you can reach

Lists every file the caller can reach, newest first, never an expired one: the files they own, the files an owner shared with them by name (directly, through a team they are in, or organization-wide), and the files they reach through the source: use or better on the connection the file came through, or on the toolbox it ran in (the toolbox only while it still pins the file’s connection with a working delegation). A file is treated like the connection or toolbox it came out of: if you can use what made it, you see it. No permission is required beyond organization membership, and there is no admin view: an org owner sees what they own or reach, like anyone else.

A file your organization’s restrictions block is still listed, flagged restricted_by with can_open: false, the way a blocked connection stays in GET /connection. can_open is also false on a row reached through a toolbox whose delegation no longer holds or whose source connection has been deleted, and on every such row when the restriction lookup failed. The content route stays the authority.

Cost. An unfiltered page does work proportional to the number of connections and toolboxes the caller can use times the page size, not to the number of files. A connector_slug filter narrows that and stays cheap; a rare substring q and created_before can still scan much of what the caller reaches before a page fills (bounded by the 7-day retention).

A caller that already ran the tool has the id from the tool result and can skip this entirely. ?q=, ?scope=, ?connection_id=, ?connector_slug=, ?type= and ?created_before= are all applied before paging. Every row says how the caller reaches it (access, and access_via, which for a file may also be connection or toolbox), whether it will open (can_open, restricted_by) and what they may do to it (can_delete, can_share, can_see_shares, can_revoke_share, all owner-only). A row the caller does not own omits the owner’s provenance (connection_id, toolbox_id, tool_name and delegated_by_user_id) and access_summary; it keeps the file, connector_slug, tool_resource and tool_method (the words for “from …”), created_by and the caller’s own access_via.