---
title: "Call page.list_files"
method: POST
path: "/api/v1/tools/page.list_files"
tags: ["page"]
---

# Call page.list_files

`POST /api/v1/tools/page.list_files`

## Request

- Base URL: `https://app.goosybear.ai`
- URL: `https://app.goosybear.ai/api/v1/tools/page.list_files`
- Auth: HTTP bearer

Answer a member's question about which FILES a site is built from — 'what files does this site have?', 'show me the code', 'which file is the hero in?', 'where does the pricing copy live?'. No site id is needed — it works on the site the member has open on screen. It is for showing and explaining the source; a change the member asks for goes to `page.edit`, whose coding agent finds the place itself. It is the same tree the Files board shows, for every site whose files we hold, however it was made or brought in. A site we hold no source for answers kind: no_source_snapshot; say so rather than inventing files. A BIG PROJECT ANSWERS IN PAGES: total is the real file count, and when more files follow the result carries next_cursor — call again with cursor: next_cursor and the same path_prefix and contains to read on (if the site's files changed in between, the cursor is refused: start again from the first page and read it over rather than joining the lists), or pass path_prefix (`app/`, `components/`, `src/pages/`) to walk one directory at a time. NEVER guess a path: if you have not seen it listed here, page or narrow until you have. CHECK can_write: when it is false this site's files are READ-ONLY here — answer questions about them and offer no edit, because every edit will refuse it. To answer WHERE some words live — the date, headline or sentence a member asks about — pass contains with a short fragment of them: only the files holding it are listed, each with match_line and match_text. Not for what is inside one file, or for making a change — that is `page.read_file` or `page.edit`.

Every result names the workspace it ran in. Say which workspace the answer is about. When the account has more than one workspace and none is selected, this tool refuses with `workspace_ambiguous` and lists the choices — offer them, never pick one.

## Headers

- `x-request-id` string

## Request body

- object
  - `site_id` string, uuid: Optional site UUID. You are NOT shown the id of the site open on screen — it never appears in your context, so there is nothing to copy and nothing to look up. OMIT IT ENTIRELY and this call lists the files of that on-screen site; that is the PRIMARY path, not a fallback, and the turn's own surface resolves it server-side. Pass it only when the member explicitly named a DIFFERENT site and you took its id from page.list. Never pass a board, board-item, thread or any other id that merely happens to be nearby — those name different objects and will be refused.
  - `path_prefix` string: Optional. List only the paths that start with this — `app/`, `components/`, `src/pages/`. Use it on a large project to walk one directory at a time; omit it for the first call, which shows the top of the tree and the true total.
  - `cursor` string: Optional. Where to continue: when a result carries next_cursor there are more files — call again with cursor set to it and the same site_id, path_prefix and contains to read the rest. Omit it for the first page. Never guess a path you have not seen listed; page or narrow instead.
  - `contains` string: Optional. Find WHERE some words live: only the text files whose contents contain this (case-insensitive, within one line) are listed, each with match_line and match_text — the first line it appears on. Use a short fragment of the words that are on the page NOW, e.g. 'Sept 22' to find the date a member asked to change; then page.read_file that file around match_line. total counts the matching files.
  - `workspace` string: Which workspace to run in — its slug. Omit to use your default. With more than one reachable workspace and no default, the call is refused and the choices are listed.

## Response `200`

The call was admitted and dispatched. `ok` says whether the tool succeeded — a refusal the tool itself produced is still a 200, exactly as it is a successful JSON-RPC result over MCP.

- union
  - object: The tool ran and answered.
    - `ok` true, required
    - `site_id` string, uuid, required
    - `kind` 'source_snapshot' | 'no_source_snapshot', required
    - `source_ref` string
    - `reason` 'bundle' | 'not_generated'
    - `can_write` boolean, required
    - `files` object[], required
      - `path` string, required
      - `size` integer, required
      - `kind` 'page' | 'style' | 'script' | 'config' | 'image' | 'other', required
      - `match_line` integer
      - `match_text` string
    - `truncated` boolean, required
    - `total` integer, required
    - `next_cursor` string
    - `workspace` string, required: The slug of the workspace this call ran in.
    - `working_in` object, required: Which workspace this call ran in, and how that was decided. Present on every workspace-scoped result.
      - `label` string, required: The chip words — e.g. "working in: Acme Main".
      - `note` string, required: Why this workspace — e.g. "your default", "this call only".
      - `workspace` string, required: The resolved workspace's slug.
      - `source` 'call-override' | 'key-pin' | 'stored-default' | 'sole-reachable', required: Which rung of the R7 precedence resolved the workspace.
  - ToolRefusal: A call that was admitted and dispatched, and did not succeed.
    - `ok` false, required
    - `code` string, required: The typed reason — e.g. `workspace_ambiguous`, `invalid_arguments`, or the tool's own failure code.
    - `message` string, required: A sentence a person can act on.
    - `workspaces` string[]: On a workspace refusal: the slugs this key may pass as `workspace`.
    - `issues` object[]: On `invalid_arguments`: which fields failed, and why.
      - `path` string, required
      - `message` string, required
    - `path` string: On an authoring refusal: where in your call's input it points, e.g. `steps.<key>.params.<field>`.
    - `fix` string: On an authoring refusal: the change to your call that would pass.
    - `instruction` string: On an authoring refusal: what to do next with it.

## Other responses

- `400`: The request could not be used: the body is present but not a JSON object (`tenant_api.malformed_body`); it is a top-level array carrying more messages than this endpoint accepts (`tenant_mcp.batch_too_large`); or the `Idempotency-Key` header is malformed (`tenant_api.idempotency_key_invalid`), disagrees with the body's `idempotency_key` (`tenant_api.idempotency_key_conflict`), or was sent to an action that cannot replay a retry (`tenant_api.idempotency_unsupported`). Nothing ran.
- `401`: No bearer credential, or one that did not resolve. Deliberately ONE undifferentiated answer for absent / unknown / revoked / expired, so the endpoint is never an oracle over the key space.
- `403`: The credential is good but the surface is not open to it — the platform or account API switch is off, or the holder lacks the `api.access` capability. The `code` says which.
- `404`: No such tool. The body names no tool and is identical for every unrecognised name.
- `429`: Over this key's per-minute cap. Carries `Retry-After` and `error.retry_after_seconds`.

---

[API](https://skmtc.dev/goosybear/apis/goosy-bear-api.md) · [All operations](https://skmtc.dev/goosybear/apis/goosy-bear-api/llms.txt) · [OpenAPI document](https://skmtc.dev/goosybear/apis/goosy-bear-api/revisions/6d82fb124064?raw)