---
title: "Read the vault root — top-level folders plus loose files"
method: GET
path: "/api/folders"
tags: ["files"]
---

# Read the vault root — top-level folders plus loose files

`GET /api/folders`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/folders`
- Auth: HTTP bearer

Clerk session or agt_ token with `files:read`. The traversal entrypoint: returns the folders and the un-foldered files the caller can see. Drill in with GET /api/folders/{id}.

## Response `200`

The root listing.

- FolderListingResponse: One level of the vault tree. `folder` is null at the synthetic root. `path` is the breadcrumb from the root down to this folder (empty at root).
  - `ok` boolean, required
  - `folder` FolderPublic: A vault folder as the caller may see it (lib/folders-types.ts::FolderPublic).
    - `id` string, required
    - `name` string, required
    - `description` string
    - `owner` string, required: Clerk user id of the creator.
    - `ownerName` string
    - `parent` string, nullable, required: Parent folder id, or null at the root.
    - `visibility` 'private' | 'ic-members' | 'grantees', required
    - `grantees` string[], required
    - `tags` string[], required
    - `createdAt` string, date-time, required
    - `mine` boolean, required
    - `can_manage` boolean, required: True iff the caller may rename, re-share, or delete it.
    - `file_count` integer: Direct child files.
    - `subfolder_count` integer: Direct sub-folders.
  - `path` object[], required: Breadcrumb, root → here.
    - `id` string
    - `name` string
  - `subfolders` FolderPublic[], required
    - `id` string, required
    - `name` string, required
    - `description` string
    - `owner` string, required: Clerk user id of the creator.
    - `ownerName` string
    - `parent` string, nullable, required: Parent folder id, or null at the root.
    - `visibility` 'private' | 'ic-members' | 'grantees', required
    - `grantees` string[], required
    - `tags` string[], required
    - `createdAt` string, date-time, required
    - `mine` boolean, required
    - `can_manage` boolean, required: True iff the caller may rename, re-share, or delete it.
    - `file_count` integer: Direct child files.
    - `subfolder_count` integer: Direct sub-folders.
  - `files` FilePublic[], required
    - `id` string, required
    - `filename` string, required
    - `contentType` string, required
    - `size` integer, required: Bytes.
    - `sha256` string
    - `folder_id` string, nullable, required: Containing folder, or null at the vault root.
    - `uploadedBy` string, required: Clerk user id of the uploader.
    - `uploadedByName` string
    - `uploadedAt` string, date-time, required
    - `visibility` 'private' | 'ic-members' | 'grantees', required
    - `grantees` string[], required: Clerk user ids explicitly admitted to this file.
    - `label` string
    - `description` string
    - `tags` string[], required
    - `mine` boolean, required: True iff the requesting caller uploaded this file.
    - `can_manage` boolean, required: True iff the requesting caller may update, delete, or re-share it.
  - `subject` string: Only on the share-link path: the audit label the grant was minted with.
  - `via` 'clerk' | 'agent'

## Other responses

- `401`: No auth.
- `403`: Scope/tier not authorized.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)