---
title: "Create a Team folder"
method: POST
path: "/api/team/v1/folders"
tags: ["Team folders"]
---

# Create a Team folder

`POST /api/team/v1/folders`

## Request

- Base URL: `https://mdflow.cz`
- URL: `https://mdflow.cz/api/team/v1/folders`
- Auth: HTTP bearer

Creates a folder in a Team workspace where the token has write access. A top-level folder needs `workspace_id` — a Team token can span several workspaces, so MDflow never guesses one and answers 400 without it. A subfolder inherits its parent's workspace; a conflicting `workspace_id` is a 400. Duplicate sibling names are automatically disambiguated.

## Request body

- CreateTeamFolderInput
  - `name` string, required
  - `description` string, nullable: Empty text is stored as null.
  - `parent_id` string, uuid, nullable: Parent folder for a subfolder; its workspace is used.
  - `workspace_id` string, uuid: Team workspace for a top-level folder. Required when parent_id is not set (MDflow never guesses a workspace); must match the parent's workspace when it is.

## Response `201`

Created Team folder.

- TeamFolder
  - `id` string, uuid, required
  - `workspace_id` string, uuid, required: The Team workspace this folder belongs to. Never changes.
  - `parent_id` string, uuid, nullable, required: Parent folder, or null for a top-level folder.
  - `name` string, required
  - `description` string, nullable, required: The primary retrieval signal for the documents inside.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Request body was malformed or failed validation, no workspace could be determined, or workspace_id contradicts the parent folder.
- `401`: Missing, malformed, invalid, or revoked Team access token — including a personal `mdf_` token sent to a Team route, and a token whose creator has left the team. The body includes a `message` with Team token guidance, and the response carries a `WWW-Authenticate` challenge.
- `403`: The Team access token is valid but the operation exceeds its effective access: a write from a read-only token or from a creator whose current workspace permission is read-only, a write while the Team account is not active (setup, grace, or read_only), or any request while the account is being deleted. No plan check is involved — eligibility comes from the Team seat. The body includes a `message` with guidance.
- `404`: The parent folder is not in a workspace the token can read, or the target workspace is outside the token's grant.
- `429`: The token or authenticated user exceeded a 60 requests per minute rate limit.
- `500`: Unexpected server error, or the live membership lookup failed. Retry rather than discarding the token — this is never a revocation signal.

---

[API](https://skmtc.dev/mdflow/apis/mdflow-public-api.md) · [All operations](https://skmtc.dev/mdflow/apis/mdflow-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mdflow/apis/mdflow-public-api/revisions/3691fc5d1688?raw)