---
title: "List Folders"
method: GET
path: "/api/folders"
tags: ["domains"]
---

# List Folders

`GET /api/folders`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/folders`
- Auth: none declared

List folders the caller REACHES, directly or by inheritance.

Augmented with derived counts and a member preview so the sidebar can
render avatar stacks and stat cards without N+1 calls.

TOS-2131: this used to query ``library_members`` directly for the caller's
active rows, which demanded a grant on the exact folder. Since TOS-2049 a
grant on a folder also grants on every descendant (TOS-1824 §1.5), so an
inheritance-only folder resolved through ``/api/folders/resolve`` but was
absent from this list - and the SPA matches address deep links against this
list, so the deep link 404'd on a folder the API said the caller reached.
``services/access/domain_reach`` is THE definition of that rule; this
surface now reads it instead of re-implementing membership.

Not keyset-paginated (TOS-3280 audit): unlike documents/segments/members,
the folders one identity reaches is bounded by admin-granted membership
and tree depth, not by content volume, and the preview-fetch below already
documents the expected scale as "<200 folders per user". Paginating it would
also mean restructuring ``reachable_domains_subquery``/
``administered_library_ids`` (services/access/), which this endpoint only
reads.

## Headers

- `x-impersonate-identity-id` string, nullable

## Response `200`

Successful Response

- LibraryResponse[]
  - `id` string, uuid, required
  - `name` string, required
  - `my_role` string, required
  - `is_direct_member` boolean
  - `can_administer` boolean
  - `owner_identity_id` string, uuid, nullable
  - `owner_identity_display_name` string, nullable
  - `owner_identity_avatar_url` string, nullable
  - `owner_identity_kind` string, nullable
  - `is_private` boolean
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `deleted_at` string, date-time, nullable
  - `document_count` integer
  - `member_count` integer
  - `last_activity_at` string, date-time, nullable
  - `members_preview` MemberPreviewResponse[]
    - `identity_id` string, uuid, required
    - `display_name` string, required
    - `avatar_url` string, nullable, required
    - `kind` string, required
  - `parent_id` string, uuid, nullable
  - `slug` string, nullable
  - `display_name` string, nullable
  - `path` string, nullable
  - `address` string, nullable
  - `org_identity_id` string, uuid, nullable
  - `org_display_name` string, nullable
  - `owner_org_identity_id` string, uuid, nullable
  - `owner_org_display_name` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/ce2c2ce318b1?raw)