API Overview

How the TMA Cloud REST API authenticates, protects and answers requests.

Base URLCopy Anchor Link

All API endpoints are prefixed with /api unless otherwise specified.

AuthenticationCopy Anchor Link

Most endpoints need a signed-in session: the token cookie that POST /api/login sets. It is httpOnly, so page scripts cannot read it. See Authentication API.

CSRF HeaderCopy Anchor Link

Every state-changing request under /api (POST, PUT, PATCH, DELETE) must carry the header:

X-Requested-With: XMLHttpRequest

Requests without it are rejected with 403:

{ "message": "Forbidden: missing CSRF header" }

Safe methods (GET, HEAD, OPTIONS) are exempt. Because the auth token is a cookie, a cross-origin page could otherwise trigger writes on a signed-in user's behalf; a browser will not attach a custom header cross-origin without a preflight the server refuses, so the header is what blocks that. The desktop app sends X-TMA-Desktop-Client instead, which is accepted in its place.

The check is not applied to the public routes (GET /api/signup-status), the OnlyOffice routes under /api/onlyoffice, the version routes under /api/version, the share routes under /s, or POST /api/files/download/bulk/form, which checks a ticket from a guarded request instead (see Files).

AuthorizationCopy Anchor Link

Endpoints act on the caller's account rather than the individual login, so an account owner and its sub-users share the same files and quota. File endpoints additionally check the caller's permission and return 403 when it is missing. See Authorization.

API SectionsCopy Anchor Link

• Authentication - Login, signup, sessions
• Sessions - Session management
• Files - File operations
• Sharing - Share links
• Users - User management
• OnlyOffice - Document editing
• Monitoring - Health and metrics
• Errors - Error handling
• Examples - Code examples

Rate LimitingCopy Anchor Link

Separate limits apply to sign-in, uploads and the general API. See Rate Limits.

ResponsesCopy Anchor Link

A success returns the data as JSON. A queued file operation returns 202 with a jobId to poll. An error returns a status and a message; see Error Handling and Error Codes.

Related TopicsCopy Anchor Link

• Authentication - Authentication concepts
• API Examples - Code examples
• Error Codes - Error reference