Version: 3.2
Last Updated: March 11th, 2026
Getting Started
The LobFile API will allow you (or an application you are writing/using) to automate tasks like uploading and managing your files.
To use this API, you need an API Key. Access to the API is free, no matter what plan tier you have. Your API key can be found on the Account Info section of the dashboard once you have created an account, verified your Email, and logged in.
If you find this service useful, or if you need more performance out of LobFile (like faster downloads or more account space), please consider subscribing to one of the Plans that are available.
If you find any issues or find the documentation to be incomplete or not working, feel free to send me a message in Discord or via Email.
Rate Limits
LobFile is configured with a global rate limit of 2 requests per second per IP. If you exceed this rate limit you will receive a HTTP status code of 429.
Please be respectful with your use of the API in your integration and use case. If for some reason you need a higher rate limit, let me know on Discord or via Email.
API Requests
The only API endpoint that requires formData instead of JSON is UPLOAD . All other API endpoints receive and return JSON data.
Be sure to review and follow the examples provided in this documentation when building your integration. They will provide working cURL examples to show you the correct structure for requests and the expected responses.
API Responses
All HTTP requests will respond with the most relevant HTTP status code. A HTTP status code of 200 means the request was fully successful, and that the JSON response from the server will certainly be valid.
API response bodies are always application/json. However, you must plan for cases where the server cannot return valid JSON (for example, server issues, network edge errors, or rate limits). Your integration should detect non-JSON responses and handle them gracefully.
All responses include a 'success' boolean. When success is false, an 'error' array field will be present with details as to what happened. Otherwise, expect whatever fields are documented for the specific endpoint.
Example JSON (200 Success):
{
"success": true,
"region": "Chicago, IL, USA"
}Example JSON (401 Error):
{
"success": false,
"error": {
"message": "Your LobFile account is not yet activated.",
"code": "ACCOUNT_NOT_VERIFIED"
}
}Authentication
All requests to the LobFile API must be authenticated with your API key. Include it in the "X-API-Key" header on every request. Do not send your key in query parameters or request bodies.
You can find your key on the Account info section of the dashboard after creating an account, verifying your Email, and signing in.
// cURL example (GET):
curl -sS \ -H "X-API-Key: YOUR_API_KEY" \ https://lobfile.com/api/v3/rest/get-account-info
FILE
Endpoint: https://lobfile.com/file/:filename
Request Method: GET
Request Parameter Type: NONE
Auth Header: None (public)
Purpose: Download a file from LobFile by filename (with or without extension), or fetch its SHA256 digest.
NOTES
- Valid request format:
/file/:filename[.extension][.sha256] - The file extension is optional: both
/file/exampleand/file/example.pngwill work. - Append
.sha256to a filename to get its SHA256 digest (plain text, not JSON). - Mirrors supported for all files:
RESPONSE
| Field | Type | Description |
|---|---|---|
| - | Binary | For file requests, the response body is the raw file content (not JSON). |
| - | text/plain | For .sha256 requests, returns a single-line digest string. |
Download file with extension:
curl -fSL https://lobfile.com/file/example.png -o example.png
Download file without extension:
curl -fSL https://lobfile.com/file/example -o example.png
Fetch SHA256 digest (returns plain text, not JSON):
curl -s https://lobfile.com/file/example.png.sha256
UPLOAD
Endpoint: https://lobfile.com/api/v3/upload
Request Method: POST
Request Parameter Type: multipart/form-data
Auth Header: X-API-Key
Purpose: Upload a file to LobFile.
NOTES
- Upload limitations (file size, file type, etc.) depend on your account tier.
- Almost all file extensions are allowed, except on the Free tier.
- You may optionally provide a
sha_256field so the server can verify the file digest.
POST FIELDS
| Field | Type | Description |
|---|---|---|
| file | multipart/form-data | The file contents you want to upload. |
| sha_256 | string | Optional. Server verifies the uploaded file’s SHA256 matches this hex digest. |
RESPONSE JSON
| Field | Type | Description |
|---|---|---|
| success | boolean | Indicates whether the upload succeeded. |
| url | string | Full URL to the uploaded file (on success). |
| error | string | Present on failure with error message. |
Upload a file:
curl -sS -X POST https://lobfile.com/api/v3/upload \ -H "X-API-Key: YOUR_API_KEY" \ -F "file=@/path/to/example.png"
Upload a file with SHA256 verification:
curl -sS -X POST https://lobfile.com/api/v3/upload \ -H "X-API-Key: YOUR_API_KEY" \ -F "file=@/path/to/example.png" \ -F "sha_256=YOUR_SHA256_DIGEST"
Example success JSON:
{
"success": true,
"url": "https://lobfile.com/file/example.png"
}Example error JSON:
{
"success": false,
"error": "Invalid API key"
}GET-FILE-LIST
Endpoint: https://lobfile.com/api/v3/rest/get-file-list
Request Method: GET
Request Parameter Type: GET
Auth Header: X-API-Key
Purpose: Retrieve the account’s file list and usage/limits metadata.
NOTES
- Supports server-side sorting and pagination with safe defaults (see tables below).
- Usage and limit values include monthly bandwidth fields in bytes:
account_usage.bandwidth_used_monthandaccount_limits.max_bandwidth_monthly.
QUERY PARAMETERS
| Field | Type | Description |
|---|---|---|
| column | String | Sort column. Allowed: upload_time, name, favorite, size, hits, access_time, file_extension. Default: upload_time. |
| direction | String | Sort direction. Allowed: asc, desc. Default: desc. |
| page | Integer | 1-based page number. Default: 1. |
| limit | Integer | Page size (max 500). Default: 200. |
Results are ordered by the chosen column/direction; items flagged for deletion are excluded.
RESPONSE JSON
| Field | Type | Description |
|---|---|---|
| success | Bool | Request result. |
| error | Object | Present on failure: message, code. |
| preferred_domain | String | Domain to use when building file links. |
| show_file_extensions | Bool | Whether links include file extensions. |
| sorting.column | String | Applied sort column. |
| sorting.direction | String | Applied sort direction. |
| sorting_options.columns[] | Array<String> | All allowed columns. |
| sorting_options.directions[] | Array<String> | All allowed directions. |
| pagination.page | Integer | Current page (1-based). |
| pagination.limit | Integer | Requested page size. |
| pagination.total_files | Integer | Total files in account. |
| account_usage.space_used | Integer | Bytes used by all files. |
| account_usage.slots_used | Integer | Number of files. |
| account_usage.bandwidth_used_month | Integer | Bandwidth consumed so far this month (bytes). |
| account_limits.space_quota | Integer | Max bytes allowed for the account. |
| account_limits.slots_quota | Integer | Max number of files allowed. |
| account_limits.max_file_size | Integer | Maximum upload size per file (bytes). |
| account_limits.max_file_download_speed | Integer | Max download rate in Mbps. |
| account_limits.max_bandwidth_monthly | Integer | Max monthly bandwidth allowance (bytes). |
| file_list[n][name] | String | Unique file name/ID. |
| file_list[n][original_name] | String | File's original name. |
| file_list[n][extension] | String | File extension. |
| file_list[n][size] | Integer | Size in bytes. |
| file_list[n][content_type] | String | MIME type of the file. |
| file_list[n][hits] | Integer | Number of downloads. |
| file_list[n][sha256] | String | SHA256 checksum. |
| file_list[n][is_favorite] | Bool | Marked as favorite. |
| file_list[n][time_added] | String | Upload timestamp. |
| file_list[n][last_accessed] | String | Last access timestamp. |
Timestamps are returned as strings; treat as UTC unless otherwise noted by the API.
Retrieve the account file list (defaults: upload_time desc, page 1, limit 200):
curl -sS -X GET "https://lobfile.com/api/v3/rest/get-file-list" \ -H "X-API-Key: YOUR_API_KEY"
Retrieve the account file list (sort by name asc, page 2, limit 100):
curl -sS -X GET "https://lobfile.com/api/v3/rest/get-file-list?column=name&direction=asc&page=2&limit=100" \ -H "X-API-Key: YOUR_API_KEY"
Example error (invalid key):
HTTP/1.1 401
{
"success": false,
"error": {
"message": "Invalid API key",
"code": "AUTH_INVALID_KEY"
}
}TOGGLE-FAVORITE
Endpoint: https://lobfile.com/api/v3/rest/toggle-favorite
Request Method: POST
Request Parameter Type: application/json
Auth Header: X-API-Key
Purpose: Toggle a specific file’s favorite status. The response includes the new boolean value.
NOTES
- “Favorite” files are highlighted in the UI and excluded from Continuous Uploading deletions.
- This endpoint toggles the current state; it does not require you to pass a target boolean.
- Provide the file name without an extension.
JSON BODY FIELDS
| Field | Type | Description |
|---|---|---|
| file | String | The file name/ID to toggle favorite on (do not include an extension). |
RESPONSE JSON
| Field | Type | Description |
|---|---|---|
| success | Bool | Request result. |
| error | String | Present on failure with a short message describing the error. |
| file_info.name | String | The file name that was updated. |
| file_info.is_favorite | Bool | The new favorite state after toggling. |
Toggle a file as favorite:
curl -sS -X POST "https://lobfile.com/api/v3/rest/toggle-favorite" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{"file":"example"}'Example success JSON:
{
"success": true,
"file_info": {
"name": "example",
"is_favorite": true
}
}DELETE-FILES
Endpoint: https://lobfile.com/api/v3/rest/delete-files
Request Method: DELETE
Request Parameter Type: application/json
Auth Header: X-API-Key
Purpose: Delete one or more files owned by the authenticated account.
NOTES
- Request body must be a JSON object with a
filesarray of file names/IDs (strings). - Files become unavailable immediately after deletion. Files already deleted, quarantined, or not owned by you are ignored.
- Endpoint returns only the names that were actually deleted in
deleted; repeating the same request is effectively idempotent.
JSON BODY FIELDS
| Field | Type | Description |
|---|---|---|
| files | Array<String> | List of file names/IDs to delete. Example: { "files": ["s1ID", "9qsq67Q"] } |
RESPONSE JSON
| Field | Type | Description |
|---|---|---|
| success | Bool | Request result. |
| deleted | Array<String> | Names/IDs that were actually deleted this call. |
| error | Object | Present on failure: message, code. |
Delete a single file:
curl -sS -X DELETE "https://lobfile.com/api/v3/rest/delete-files" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{ "files": ["s1ID"] }'Delete multiple files:
curl -sS -X DELETE "https://lobfile.com/api/v3/rest/delete-files" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{ "files": ["P9uRkgR8", "9qs7q67Q"] }'Example success JSON:
{
"success": true,
"deleted": [
"example"
]
}Example invalid body (shows error shape):
HTTP/1.1 400
{
"success": false,
"error": {
"message": "Invalid request body. Expected JSON object with 'files' array.",
"code": "INVALID_INPUT"
}
}GET-ACCOUNT-INFO
Endpoint: https://lobfile.com/api/v3/rest/get-account-info
Request Method: GET
Request Parameter Type: NONE
Auth Header: X-API-Key
Purpose: Retrieve the authenticated account’s profile, limits, and usage.
NOTES
- Response groups data under
account.info,account.limits, andaccount.usage. - Units: sizes are in bytes; download speed is in megabits per second (Mbps). Timestamps are strings (automatically using whatever timezone you have set in your account settings).
- Monthly bandwidth values are included in
account.limits.max_bandwidth_monthlyandaccount.usage.bandwidth_used_month. - Your API key is included in the response under
account.info.api_key, treat it as a secret.
QUERY PARAMETERS
| Field | Type | Description |
|---|---|---|
| This endpoint does not accept query parameters. | ||
RESPONSE JSON
| Field | Type | Description |
|---|---|---|
| success | Bool | Request result. |
| error | Object | Present on failure: message, code. |
| account.info.email | String | Account email address. |
| account.info.level | String | Account level/tier. |
| account.info.api_key | String | The account’s API key. |
| account.info.time_created | String | Account creation time (UTC). |
| account.limits.space_quota | Integer | Max bytes allowed for the account. |
| account.limits.slots_quota | Integer | Max number of active files. |
| account.limits.max_file_size | Integer | Max upload size per file (bytes). |
| account.limits.max_file_download_speed | Integer | Max download speed (Mbps). |
| account.limits.max_bandwidth_monthly | Integer | Max monthly bandwidth allowance (bytes). |
| account.usage.space_used | Integer | Total bytes used by active files. |
| account.usage.slots_used | Integer | Number of active files. |
| account.usage.bandwidth_used_month | Integer | Bandwidth consumed so far this month (bytes). |
On failure, error.message and error.code are returned.
Fetch account info:
curl -sS -X GET "https://lobfile.com/api/v3/rest/get-account-info" \ -H "X-API-Key: YOUR_API_KEY"
Example (truncated) success JSON:
{
"success": true,
"account": {
"info": {
"email": "you@example.com",
"level": "PlanName",
"api_key": "••••••••••••",
"time_created": "2024-01-02 03:04:05"
},
"limits": {
"space_quota": 1234,
"slots_quota": 1234,
"max_file_size": 1234,
"max_file_download_speed": 1234,
"max_bandwidth_monthly": 1234
},
"usage": {
"space_used": 1233,
"slots_used": 1233,
"bandwidth_used_month": 1233
}
}
}GET-ACCOUNT-SETTINGS
Endpoint: https://lobfile.com/api/v3/rest/get-account-settings
Request Method: GET
Request Parameter Type: NONE
Auth Header: X-API-Key
Purpose: Retrieve the authenticated account’s settings.
NOTES
- Response groups data under
account.settings. - Units: sizes are bytes; filename length is a count of characters; inactivity is in days; timezone is an IANA ID (e.g.
America/Los_Angeles).
QUERY PARAMETERS
| Field | Type | Description |
|---|---|---|
| This endpoint does not accept query parameters. | ||
RESPONSE JSON
| Field | Type | Description |
|---|---|---|
| success | Bool | Request result. |
| error | Object | Present on failure: message, code. |
| account.settings.preferred_domain | String | Default link domain. |
| account.settings.return_file_extension | Bool | Whether to include file extensions in URLs. |
| account.settings.continuous_uploading | Bool | Continuous uploading (favorites excluded from deletion). |
| account.settings.preferred_filename_length | Integer | Desired filename length (characters). |
| account.settings.inactivity_auto_delete_days | Integer | Auto-delete inactive files after X days (favorites excluded). |
| account.settings.timezone_auto | Bool | Auto-detect timezone from browser. |
| account.settings.timezone | String | Explicit IANA timezone (if not auto). |
| account.settings_options.preferred_domain_options[] | Array<String> | Selectable domains (UI only). |
| account.settings_options.return_file_extension_options[] | Array<Bool> | Allowed values for “include extensions”. |
| account.settings_options.continuous_uploading_options[] | Array<Bool> | Allowed values for continuous uploading. |
| account.settings_options.preferred_filename_length_options | Array<Integer> | Min/max filename length, e.g. [4, 32]. |
| account.settings_options.inactivity_auto_delete_days_options | Array<Integer> | Range of valid days, e.g. [0, 90]. |
| account.settings_options.timezone_auto_options[] | Array<Bool> | Allowed values for auto timezone. |
| account.settings_options.timezone_options[] | Array<String> | IANA timezone choices (filtered list; UI only). |
Note: account.settings_options is only present when authenticated via session (web UI).
Fetch account settings:
curl -sS -X GET "https://lobfile.com/api/v3/rest/get-account-settings" \ -H "X-API-Key: YOUR_API_KEY"
Example (truncated) success JSON:
{
"success": true,
"account": {
"settings": {
"preferred_domain": "lobfile.com",
"return_file_extension": true,
"continuous_uploading": false,
"preferred_filename_length": 12,
"inactivity_auto_delete_days": 30,
"timezone_auto": true,
"timezone": "America/Los_Angeles"
}
}
}