List workspace files

GET /api/v1/workspaces/{workspaceId}/files?limit=50&cursor=…

Requires files:read. Returns file metadata for the key's workspace, newest first. It does not return file content and there is no scope that does — this endpoint tells you what exists, not what is in it.

{
  "files": [
    {
      "id": "…",
      "name": "supplier-invoice-2210.pdf",
      "contentType": "application/pdf",
      "size": 184320,
      "validationStatus": "…",
      "createdAt": "…"
    }
  ],
  "hasMore": true,
  "nextCursor": "eyJvZmZzZXQiOiI1MCJ9"
}

name

The original filename, normalised. Control characters and bidirectional-override characters are stripped when the file is stored, so a filename cannot be used to disguise its extension in a listing.

size

Bytes.

validationStatus

What the upload checks concluded. Files are verified by signature rather than by extension, so a renamed executable is rejected at upload rather than listed here as a document.

hasMore

Whether another page exists. Read this rather than comparing the array length against your limit.

nextCursor

Opaque. Pass it back verbatim. null when there is nothing more.

Ordering

Newest first, by creation time and then by identifier. The second key matters: without it two files created in the same instant could swap places between pages and one of them would never be returned.