## File search

`POST /v1/files/search`

Returns folder contents — the same as [`GET /v1/files`](./list.md), except that the conditions are passed in the request body rather than in the query string. The folder ID goes in `filter.folderId` or in a top-level `folderId` field of the body.

For full-text search across all accessible files in Bitrix24 Drive, use [POST /v1/files/fulltext-search](/docs/entities/files/fulltext-search), which accepts a query instead of filters for a single folder.

## Request fields (body)

| Field | Type | Required | Description |
|------|-----|:-----:|---------|
| `filter` | object | no | Selection conditions. `folderId` — the ID of the folder whose contents are returned. Required here or at the top level of the body.<br>[Filtering syntax](/docs/filtering). Example: `{"folderId":27,"type":"file"}` |
| `folderId` | number | no | The folder ID at the top level of the body — instead of `filter.folderId`. If both are passed, this value is used. A single value only: arrays, objects and `null` are rejected |
| `select` | array | no | List of returned fields. Example: `["id","name"]` |
| `order` | object | no | Sort by field. Example: `{"name":"asc"}` |
| `limit` | number | no | How many records to return. Default 50, maximum 5000 |
| `offset` | number | no | Offset for pagination |

## Examples

### curl — personal key

```bash
curl -X POST "https://vibecode.bitrix24.com/v1/files/search" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filter":{"folderId":27,"type":"file"},"limit":10}'
```

### curl — OAuth application

```bash
curl -X POST "https://vibecode.bitrix24.com/v1/files/search" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"filter":{"folderId":27,"type":"file"},"limit":10}'
```

### JavaScript — personal key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/files/search', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ filter: { folderId: 27, type: 'file' }, limit: 10 }),
})

const { success, data, meta } = await res.json()
console.log('Found:', data.length)
```

### JavaScript — OAuth application

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/files/search', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ filter: { folderId: 27, type: 'file' }, limit: 10 }),
})

const { success, data, meta } = await res.json()
```

## Response fields

| Field | Type | Description |
|------|-----|---------|
| `success` | boolean | Always `true` on success |
| `data` | array | Array of records — subfolders and files. All fields — see [File fields](./fields.md) |
| `data[].type` | string | Record type: `"folder"` or `"file"` |
| `meta.total` | number | Number of records matching the filter |
| `meta.hasMore` | boolean | Whether more records exist beyond `limit` |
| `meta.durationMs` | number | Request duration in milliseconds |

The `meta` fields sit next to `data`, not inside it. Paginate using `meta.hasMore`: a `data` length equal to `limit` does not rule out the last page.

## Response example

```json
{
  "success": true,
  "data": [
    {
      "id": 205,
      "name": "presentation_q1.pdf",
      "code": null,
      "storageId": 1,
      "type": "file",
      "folderId": 27,
      "size": 31232,
      "fileId": 363,
      "globalContentVersion": 1,
      "downloadUrl": "https://vibecode.bitrix24.com/v1/files/205/download",
      "deletedType": 0,
      "createdBy": 5,
      "updatedBy": 5,
      "deletedBy": null,
      "createdAt": "2023-03-15T09:29:09.000Z",
      "updatedAt": "2023-03-15T09:29:09.000Z",
      "deletedAt": null,
      "detailUrl": "https://example.bitrix24.com/docs/path/to/file/"
    }
  ],
  "meta": { "total": 1, "hasMore": false, "durationMs": 206 }
}
```

## Error response example

403 — no `disk` scope:

```json
{
  "success": false,
  "error": {
    "code": "SCOPE_DENIED",
    "message": "This endpoint requires 'disk' scope"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|---------|
| 400 | `MISSING_REQUIRED_PARAMS` | The folder ID is passed in neither `filter.folderId` nor `folderId`. Arrays, objects and `null` are treated as missing. The same code is returned when one of the fields is an empty string, even if the other one carries an ID. `message` lists the missing fields |
| 400 | `INVALID_FILTER_OPERATOR` | One of `folderId` and `filter.folderId` holds a single ID, and the other holds an array, an object or `null`. The request is rejected before Bitrix24 Drive is called |
| 403 | `SCOPE_DENIED` | The API key does not have the `disk` scope |
| 401 | `TOKEN_MISSING` | The API key has no configured portal tokens |
| 429 | `RATE_LIMITED` | Rate limit exceeded: 300 requests per minute per portal. All API keys of the portal share one limit. The current limit is returned in the `x-ratelimit-limit` header. Retry after the delay in the `Retry-After` header |

For the full list of common API errors, see [Errors](/docs/errors).

## Known specifics

Search is limited to a single folder specified in `folderId` and does not span the whole storage. The same result is returned by [`GET /v1/files`](./list.md) with parameters in the query string.

The response contains both folders (`type: "folder"`) and files (`type: "file"`) — distinguish them by the `type` field. Folders have a `realObjectId` field; files do not. The `contentProvider` field is not returned for files on Bitrix24 Drive.

## See also

- [List folder files](/docs/entities/files/list)
- [File fields](/docs/entities/files/fields)
- [Files](/docs/entities/files)
- [Filtering syntax](/docs/filtering)