## List objects

`GET /v1/storage/objects`

Returns completed, non-deleted storage objects with literal key-prefix filtering and cursor navigation. Without `prefix`, objects are ordered by descending `id`. With `prefix`, the bytewise order is ascending `key`, then descending `id` for equal keys.

A personal developer key sees all objects owned by that developer in the Bitrix24 account. An app key without a user token sees only that app's shared objects. An app key with a user token sees only the objects of the corresponding Bitrix24 employee.

## Parameters

| Parameter | Type | Default | Description |
|----------|-----|-----------|---------|
| `limit` | number | `50` | Number of objects per page. Maximum 500; values above 500 are truncated without an error |
| `prefix` | string | — | Filter by the start of the key. Example: `prefix=reports/2024` returns all objects whose keys start with `reports/2024` |
| `cursor` | string | — | Cursor from the previous response. Pass it unchanged. New opaque cursors are bound to the owner, prefix, and ordering mode; a legacy CUID cursor carries no such binding |
| `withTotal` | boolean | `false` | When `true`, adds an exact count for the complete filter without the cursor boundary. A full count can be expensive on a large set, so request it only on pages that need it |

The walk is complete only when `cursor` is `null`. Do not parse or synthesize the cursor. A legacy CUID cursor is accepted only for a walk without `prefix`, carries no binding, and is always evaluated within the current storage access scope. When adding a prefix, restart the walk without the old cursor.

## Examples

### curl — personal key

```bash
curl "https://vibecode.bitrix24.com/v1/storage/objects?limit=10&prefix=reports/2024" \
  -H "X-Api-Key: YOUR_API_KEY"
```

### curl — OAuth application

```bash
curl "https://vibecode.bitrix24.com/v1/storage/objects?limit=10&prefix=reports/2024" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN"
```

### JavaScript — personal key

```javascript
const res = await fetch(
  'https://vibecode.bitrix24.com/v1/storage/objects?limit=10&prefix=reports%2F2024',
  { headers: { 'X-Api-Key': 'YOUR_API_KEY' } }
)
const { data, cursor } = await res.json()
console.log(`On this page: ${data.length}, next page: ${cursor !== null}`)
```

### JavaScript — OAuth application

```javascript
const res = await fetch(
  'https://vibecode.bitrix24.com/v1/storage/objects?limit=10&prefix=reports%2F2024',
  {
    headers: {
      'X-Api-Key': 'YOUR_APP_KEY',
      'Authorization': 'Bearer USER_SESSION_TOKEN',
    },
  }
)
const { data, cursor } = await res.json()
```

## Response fields

The response does not include a `success` wrapper — the object is returned directly.

| Field | Type | Description |
|------|-----|---------|
| `data` | array | Array of objects |
| `data[].id` | string | Object identifier (CUID) |
| `data[].key` | string | Object key in storage |
| `data[].contentType` | string | Content MIME type |
| `data[].sizeBytes` | string | Size in bytes. Passed as a string due to JSON limits on large numbers |
| `data[].sha256` | string \| null | SHA-256 hash of the content, if it was computed at upload |
| `data[].visibility` | string | Visibility: `PRIVATE` or `PUBLIC` |
| `data[].uploadStatus` | string | Upload status. In the list always `COMPLETED` |
| `data[].createdAt` | string | Creation date in ISO 8601 format |
| `data[].deletedAt` | null | Always `null` — deleted objects do not appear in the list |
| `data[].contentUpdatedAt` | string (ISO 8601) | When the content last became current: a replacement, or the first completion of the upload. `null` for objects last written before this field existed |
| `cursor` | string \| null | Opaque cursor for the next page. `null` if there are no more objects |
| `total` | number | Exact number of objects in the complete filter. Present only when `withTotal=true` |

## Response example

```json
{
  "data": [
    {
      "id": "cmabcdef1234567890abcdef",
      "key": "reports/2024/annual.pdf",
      "contentType": "application/pdf",
      "sizeBytes": "204800",
      "sha256": null,
      "visibility": "PRIVATE",
      "uploadStatus": "COMPLETED",
      "createdAt": "2024-06-15T10:30:00.000Z",
      "deletedAt": null
    }
  ],
  "cursor": null
}
```

## Error response example

400 — invalid `limit`:

```json
{
  "success": false,
  "error": {
    "code": "STORAGE_INVALID_LIMIT",
    "message": "limit must be a positive integer"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|---------|
| 400 | `STORAGE_INVALID_LIMIT` | The `limit` parameter is not a positive integer |
| 400 | `STORAGE_INVALID_CURSOR` | A new opaque cursor is corrupted, modified, oversized, or belongs to another owner, prefix, or ordering mode; a legacy CUID cursor has an invalid shape, is oversized, or is used with `prefix` |
| 401 | `MISSING_API_KEY` | API key not provided |
| 403 | `STORAGE_SCOPE_REQUIRED` | The API key has no `vibe:storage` scope |

For the full list of common errors, see [Errors](/docs/errors).

## See also

- [Objects](/docs/storage/objects)
- [Download object](/docs/storage/objects/get)
- [Object metadata](/docs/storage/objects/head)
- [Upload](/docs/storage/upload)