File endpoints

API endpoints for file upload, download, and management.

Two types of file APIs

Dashboard API

For uploading and managing files (requires a dashboard JWT).

Server API

For listing and downloading files from your own server (requires your secret key, ap_web_sec_…).

Server-side only

The list and download endpoints below return file encryption keys, so they only accept your website integration secret key (ap_web_sec_…), not the app key (ap_…). Call them only from your own server. Never put the secret key in a shipped client, game, desktop app or browser code.

Find the secret key on your app's Integrations page under Website integration (the integration must be enabled). Shipped clients download files through the Vaultix client SDK with the signed-in app user's session.

Server: list filesSecret key · server only

GET/api/files?product_id={product_id}

HeadersHTTPCopy

X-API-Key: ap_web_sec_xxxxxxxxxxxxx
# or: Authorization: Bearer ap_web_sec_xxxxxxxxxxxxx

Response · 200JSONCopy

[
  {
    "id": "file_xxxxxxxxxxxxx",
    "name": "update.exe",
    "size": 1048576,
    "product_id": "prod_xxxxxxxxxxxxx",
    "created_at": "2025-11-02T12:00:00Z"
  },
  {
    "id": "file_yyyyyyyyyyyyy",
    "name": "config.json",
    "size": 2048,
    "product_id": "prod_xxxxxxxxxxxxx",
    "created_at": "2025-11-01T10:30:00Z"
  }
]

Server: download a fileSecret key · server only

GET/api/files/{file_id}/download

HeadersHTTPCopy

X-API-Key: ap_web_sec_xxxxxxxxxxxxx
# or: Authorization: Bearer ap_web_sec_xxxxxxxxxxxxx

Response headers

Content-Type: application/octet-stream
X-Encryption-Key: [obfuscated_key]
X-Encryption-IV: [obfuscated_iv]
X-File-Name: update.exe

Response body

Encrypted file data (binary). The client must:

De-obfuscate the encryption key and IV using the JTI from the JWT
Decrypt the file data using AES-256-GCM with the de-obfuscated key and IV

The C++ client handles this automatically.

Server: download by nameSecret key · server only

GET/api/files/by-name/{file_name}

Alternative to downloading by ID. Useful when you know the file name but not the ID.

ExampleHTTPCopy

GET /api/files/by-name/update.exe?product_id=prod_xxxxxxxxxxxxx
X-API-Key: ap_web_sec_xxxxxxxxxxxxx

Returns the same encrypted file data with encryption headers.

Access control

Downloads through the client SDK are protected by:

JWT validation (the app user must be authenticated)
Subscription check (the user must have an active subscription to the product)
HWID binding (if enabled for the app)
Subscription expiry (the subscription must not be expired or paused)

The server endpoints above are protected by your secret key alone. Anyone holding it can read every file and its key, so keep it on your server and regenerate it in the dashboard if it ever leaks.

Vaultix · Features · Pricing · Documentation · Changelog · llms.txt