{ "info": { "_postman_id": "9bfd52fb-a168-486e-b1d5-2aab20718397", "name": "FileCap API", "description": "Full FileCap public / integration API collection.\n\nGroups:\n- 1. Legacy API (JSP) – the historic endpoints invoked by mail plugins and 3rd-party integrations. Each JSP forwards to a modern REST endpoint under `/FileCap/api/...`, but the JSP URL remains supported.\n- 2. Transfer – upload, validate, reply, connection check.\n- 3. Invite – send invites and pre-generate invite IDs.\n- 4. Settings – portal/plugin settings, password rules, verification options.\n- 5. Validation – sender / recipient / file / domain validators.\n- 6. Business Rules (DLP) – scan attachments and text against the policy engine.\n- 7. Block transfer – revoke / inspect transfers.\n- 8. Device registration – register and verify a device for API access.\n\nSet the `baseURL` variable to e.g. `https://filecap.example.com` (no trailing slash). All paths are appended after `/FileCap`.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "_exporter_id": "25721039" }, "item": [ { "name": "1. Legacy API (JSP)", "description": "Historic public API exposed through `.jsp` URLs. Each JSP performs a server-side forward to its modern `/api/...` counterpart. Backward-compatible: the JSP URL keeps working but new integrations should prefer the modern endpoints in the next folders.", "item": [ { "name": "Upload files (process_upload.jsp)", "request": { "method": "POST", "header": [], "body": { "mode": "formdata", "formdata": [ {"key": "APIKey", "value": "{{apiKey}}", "description": "The FileCap server API key.", "type": "text"}, {"key": "deviceApiKey", "value": "", "description": "Optional; per-device API key when the integration is registered as a device.", "type": "text", "disabled": true}, {"key": "ids", "value": "263478632784632748237513", "description": "The transfer ID. Must be unique per transfer.", "type": "text"}, {"key": "from", "value": "kees@example.com", "description": "Email address of the sender.", "type": "text"}, {"key": "fromName", "value": "Kees Janssen", "description": "Optional; display name of the sender.", "type": "text", "disabled": true}, {"key": "subject", "value": "API Test", "description": "Subject of the transfer.", "type": "text"}, {"key": "comment", "value": "This is a test", "description": "Message body for the transfer.", "type": "text"}, {"key": "encryptMessage", "value": "true", "description": "Optional; when true the comment/message is encrypted (plain text only).", "type": "text", "disabled": true}, {"key": "rec0", "value": "kees@receiver.com", "description": "First TO recipient. Use rec0, rec1, rec2... for multiple recipients.", "type": "text"}, {"key": "rec1", "value": "henk@receiver2.com", "description": "Additional TO recipient.", "type": "text", "disabled": true}, {"key": "cc0", "value": "", "description": "Optional CC recipient (cc0, cc1, ...).", "type": "text", "disabled": true}, {"key": "bcc0", "value": "", "description": "Optional BCC recipient (bcc0, bcc1, ...).", "type": "text", "disabled": true}, {"key": "nameRec0", "value": "", "description": "Optional display name for rec0 (nameRec0, nameRec1, ...).", "type": "text", "disabled": true}, {"key": "storeDays_value", "value": "5", "description": "Optional; how many days the transfer stays on the server.", "type": "text", "disabled": true}, {"key": "downloadLoadable_value", "value": "10", "description": "Optional; maximum number of file downloads.", "type": "text", "disabled": true}, {"key": "password", "value": "test1234", "description": "Optional; mandatory when encryptMessage = true or when the server policy requires a password.", "type": "text", "disabled": true}, {"key": "useSmsTextAuthentication", "value": "true", "description": "Optional; when true the recipient must enter an SMS verification code (recipient must have a mobileNr).", "type": "text", "disabled": true}, {"key": "mobileNr", "value": "", "description": "Optional; recipient mobile number when SMS verification is used.", "type": "text", "disabled": true}, {"key": "dontNotify", "value": "true", "description": "Optional; when true the FileCap server will NOT send a notification e-mail to the recipient (the integrating system must handle notifications).", "type": "text", "disabled": true}, {"key": "nrOfFilesInTransfer", "value": "", "description": "Optional; explicit number of files in the transfer.", "type": "text", "disabled": true}, {"key": "userAgent", "value": "MyPlugin", "description": "Optional; identifies the calling client.", "type": "text", "disabled": true}, {"key": "version", "value": "1.0", "description": "Optional; client version.", "type": "text", "disabled": true}, {"key": "fileMetadata", "value": "[{\"filename\":\"document.pdf\",\"mimetype\":\"application/pdf\",\"size\":102400}]", "description": "REQUIRED. JSON array describing every file part in the transfer. One entry per file with `filename`, `mimetype` and `size` (bytes). The `filename` MUST exactly match the `filename` of the corresponding file part. IMPORTANT: this field MUST appear in the multipart body BEFORE the file parts (file01, file02, ...). The server streams the body and uses fileMetadata to look up each file's expected size; on S3 storage missing/late metadata produces 'File metadata required'.", "type": "text"}, {"key": "file01", "value": "", "description": "First file part. Use file01, file02, file03... for multiple files. MUST appear AFTER the fileMetadata field in the multipart body.", "type": "file"}, {"key": "file02", "value": "", "description": "Additional file part.", "type": "file", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/process_upload.jsp", "host": ["{{baseURL}}"], "path": ["FileCap", "process_upload.jsp"] }, "description": "Upload one or more files in a single transfer. The body must be `multipart/form-data`.\n\nForwards to `/FileCap/api/transfer/v1/send-outlook-transfer`. The response is plain text:\n- `true` on success.\n- `false|` on failure.\n\n**Field ordering**\n\nThe server streams the multipart body and processes parts in the order they arrive. The `fileMetadata` field MUST be sent BEFORE the `file01`, `file02`, ... parts; when a file part is read the server looks up its expected size in the metadata list and rejects the upload with `File metadata required` (S3 storage) or a NullPointerException (FREE-tier portals) if the metadata has not yet been seen.\n\n**Known error codes**\n- `VIRUS_FOUND` – a virus was detected in one of the files; the transfer was cancelled.\n- `NO_RECIPIENT_GIVEN` – no recipients were supplied.\n- `FILETYPE_NOT_ALLOW` – file type is forbidden by MIME or extension policy.\n- `PASSWORD_MANDATORY_BUT_NOT_GIVEN` – password is required but missing.\n- `CANNOT_SEND_MAIL` – the FileCap server could not send mail (mail server / relay misconfiguration).\n- `API_KEY_INVALID` – the supplied APIKey is not valid.\n- `GENERAL_ERROR` – unknown error; check the server log for a stack trace." }, "response": [] }, { "name": "Send invite (invite.jsp)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "APIKey", "value": "{{apiKey}}", "description": "The FileCap server API key.", "type": "text"}, {"key": "deviceApiKey", "value": "", "description": "Optional; per-device API key.", "type": "text", "disabled": true}, {"key": "id", "value": "iiiii26347863278463274823755", "description": "Invite ID. Must always start with `iiiii`.", "type": "text"}, {"key": "senderEmail", "value": "kees@example.com", "description": "E-mail address of the person who needs to receive the invite (the inviter).", "type": "text"}, {"key": "receiverEmail", "value": "piet@company.com", "description": "E-mail address of the person who needs to receive the files (normally your own e-mail address).", "type": "text"}, {"key": "receiverMobileNr", "value": "", "description": "Optional; mobile number of the receiver when SMS verification is required.", "type": "text", "disabled": true}, {"key": "message", "value": "", "description": "Optional; free-form message attached to the invite.", "type": "text", "disabled": true}, {"key": "notify", "value": "true", "description": "Optional; when `false` the FileCap server will not send an e-mail (the calling system must handle notifications).", "type": "text", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/invite.jsp", "host": ["{{baseURL}}"], "path": ["FileCap", "invite.jsp"] }, "description": "Send a FileCap invite to an external user. Forwards to `/FileCap/api/invite/old`.\n\nResponse is plain text:\n- `true` on success.\n- `false|` on failure.\n\nKnown error codes:\n- `CANNOT_SEND_MAIL` – mail server cannot process the message.\n- `CANNOT_ADD_INVITE_TO_DB` – server could not persist the invite ID.\n- `UNKNOWN_ERROR` – an exception was raised; check the server log." }, "response": [] }, { "name": "Request mail plugin settings (mailPluginSettings.jsp)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "APIKey", "value": "{{apiKey}}", "description": "The FileCap server API key.", "type": "text"}, {"key": "userAgent", "value": "OutlookPlugin", "description": "Optional; identifies the calling client.", "type": "text", "disabled": true}, {"key": "version", "value": "1.0", "description": "Optional; client version.", "type": "text", "disabled": true}, {"key": "lang", "value": "NL", "description": "Optional; locale (e.g. NL, EN).", "type": "text", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/mailPluginSettings.jsp", "host": ["{{baseURL}}"], "path": ["FileCap", "mailPluginSettings.jsp"] }, "description": "Request the FileCap server settings used by mail plugins (Outlook classic etc.). Forwards to `/FileCap/api/settings/outlook-windows`.\n\nResponse is XML and contains plug-in configuration: maximum file size, allowed extensions, password policy, verification methods, branding, etc." }, "response": [] }, { "name": "Check if a file may be sent (checkFile.jsp)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "APIKey", "value": "{{apiKey}}", "description": "The FileCap server API key.", "type": "text"}, {"key": "filename", "value": "test.exe", "description": "Filename to be checked.", "type": "text"}, {"key": "sender", "value": "kees@example.com", "description": "E-mail address of the sender.", "type": "text"}, {"key": "mime", "value": "application/exe", "description": "MIME type of the file.", "type": "text"}, {"key": "fileID", "value": "", "description": "Optional; identifier of the file.", "type": "text", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/checkFile.jsp", "host": ["{{baseURL}}"], "path": ["FileCap", "checkFile.jsp"] }, "description": "Verify – before uploading – whether a single file is allowed by the server policy (extension/MIME blocklists, sender restrictions). Forwards to `/FileCap/api/validate/file`.\n\nResponse is plain text: `true` when allowed, `false|` when blocked." }, "response": [] }, { "name": "Show files in a transfer (checkTransfer.jsp)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "APIKey", "value": "{{apiKey}}", "description": "The FileCap server API key.", "type": "text"}, {"key": "deviceApiKey", "value": "", "description": "Optional; per-device API key.", "type": "text", "disabled": true}, {"key": "id", "value": "263478632784632748237513", "description": "Transfer ID.", "type": "text"}, {"key": "email", "value": "", "description": "Optional; recipient e-mail – when supplied the response is scoped to this recipient.", "type": "text", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/checkTransfer.jsp", "host": ["{{baseURL}}"], "path": ["FileCap", "checkTransfer.jsp"] }, "description": "Inspect a transfer that was created earlier. Forwards to `/FileCap/api/validate/transfer`. Used by mail plugins to check the status / contents of a previously created transfer." }, "response": [] }, { "name": "Check domain (domainCheck.jsp)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "email", "value": "piet@receiver.com", "description": "Recipient e-mail address whose domain has to be validated.", "type": "text"}, {"key": "sender", "value": "kees@example.com", "description": "Sender e-mail address.", "type": "text"} ] }, "url": { "raw": "{{baseURL}}/FileCap/domainCheck.jsp", "host": ["{{baseURL}}"], "path": ["FileCap", "domainCheck.jsp"] }, "description": "Verify whether the sender domain is allowed to send to the recipient domain (whitelist / IP rules). Forwards to `/FileCap/api/validate/domain`. Response is plain text: `true` when allowed, `false|` otherwise." }, "response": [] } ] }, { "name": "2. Transfer", "description": "Modern transfer endpoints. The `/transfer/send-outlook-transfer` endpoint replaces the legacy `process_upload.jsp` flow but returns a structured JSON `ApiResult` instead of plain text. The `/transfer/v1/send-outlook-transfer` endpoint is the path the legacy JSP forwards to (text response).", "item": [ { "name": "Send Outlook transfer (modern, JSON response)", "request": { "method": "POST", "header": [], "body": { "mode": "formdata", "formdata": [ {"key": "APIKey", "value": "{{apiKey}}", "description": "FileCap server API key.", "type": "text"}, {"key": "deviceApiKey", "value": "", "description": "Optional device API key.", "type": "text", "disabled": true}, {"key": "ids", "value": "263478632784632748237513", "description": "Transfer ID (alias: `transferId`).", "type": "text"}, {"key": "from", "value": "kees@example.com", "description": "Sender e-mail (aliases: `fromEmail`, `senderEmail`, `senderEmailAddress`).", "type": "text"}, {"key": "fromName", "value": "Kees Janssen", "description": "Optional sender display name (alias: `senderName`).", "type": "text", "disabled": true}, {"key": "subject", "value": "Modern API test", "type": "text"}, {"key": "comment", "value": "This goes through the JSON endpoint.", "type": "text"}, {"key": "encryptMessage", "value": "false", "description": "Optional; encrypts the message body (alias: `useEncryption`).", "type": "text", "disabled": true}, {"key": "rec0", "value": "piet@receiver.com", "description": "TO recipient (alias: `recipient`). Use rec0..recN.", "type": "text"}, {"key": "cc0", "value": "", "description": "CC recipient (cc0..ccN).", "type": "text", "disabled": true}, {"key": "bcc0", "value": "", "description": "BCC recipient (bcc0..bccN).", "type": "text", "disabled": true}, {"key": "maxDownloads", "value": "10", "description": "Maximum download count (alias: `downloadLoadable_value`).", "type": "text", "disabled": true}, {"key": "maxDaysToStore", "value": "5", "description": "Retention in days (alias: `storeDays_value`).", "type": "text", "disabled": true}, {"key": "password", "value": "", "description": "Optional transfer password.", "type": "text", "disabled": true}, {"key": "useSmsTextAuthentication", "value": "false", "description": "Enable SMS verification (alias: `enableToken`).", "type": "text", "disabled": true}, {"key": "verificationMethod1", "value": "", "description": "Primary verification method – e.g. EMAIL_ACCESS_CODE, SMS, PASSWORD.", "type": "text", "disabled": true}, {"key": "verificationMethod2", "value": "", "description": "Optional secondary verification method.", "type": "text", "disabled": true}, {"key": "dontNotify", "value": "false", "description": "When true, FileCap suppresses recipient notifications.", "type": "text", "disabled": true}, {"key": "nrOfFilesInTransfer", "value": "1", "type": "text", "disabled": true}, {"key": "userAgent", "value": "MyIntegration/1.0", "type": "text", "disabled": true}, {"key": "version", "value": "1.0", "type": "text", "disabled": true}, {"key": "fileMetadata", "value": "[{\"filename\":\"document.pdf\",\"mimetype\":\"application/pdf\",\"size\":102400}]", "description": "REQUIRED. JSON array describing every file part. One entry per file with `filename`, `mimetype` and `size` (bytes). `filename` MUST match the file-part filename exactly. IMPORTANT: must appear BEFORE the file parts in the multipart body.", "type": "text"}, {"key": "file01", "value": "", "description": "First file part. Use file01..fileNN. Place AFTER the fileMetadata field.", "type": "file"} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/transfer/send-outlook-transfer", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "transfer", "send-outlook-transfer"] }, "description": "Modern Outlook plugin upload endpoint. `multipart/form-data` request, JSON response.\n\n**Field ordering**: the `fileMetadata` field MUST be sent BEFORE the file parts; the server streams the body and looks up each file's expected size in the metadata list as the file part arrives.\n\nResponse:\n```\n{\n \"success\": true,\n \"value\": { \"transferId\": \"...\", \"generatedPassword\": \"...\" },\n \"errorMessage\": null\n}\n```\nOn failure `success` is `false` and `errorMessage` contains the reason. Rate-limited per session (`SendOutlookTransfer`)." }, "response": [] }, { "name": "Send Outlook transfer (legacy v1, text response)", "request": { "method": "POST", "header": [], "body": { "mode": "formdata", "formdata": [ {"key": "APIKey", "value": "{{apiKey}}", "type": "text"}, {"key": "ids", "value": "263478632784632748237513", "type": "text"}, {"key": "from", "value": "kees@example.com", "type": "text"}, {"key": "subject", "value": "API Test", "type": "text"}, {"key": "comment", "value": "Legacy v1 endpoint", "type": "text"}, {"key": "rec0", "value": "piet@receiver.com", "type": "text"}, {"key": "fileMetadata", "value": "[{\"filename\":\"document.pdf\",\"mimetype\":\"application/pdf\",\"size\":102400}]", "description": "REQUIRED. JSON array describing every file part (filename, mimetype, size). MUST be sent BEFORE the file parts.", "type": "text"}, {"key": "file01", "value": "", "description": "File part. Place AFTER the fileMetadata field.", "type": "file"} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/transfer/v1/send-outlook-transfer", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "transfer", "v1", "send-outlook-transfer"] }, "description": "Plain-text variant of the Outlook upload (returns `true` / `false|ERROR_CODE`). This is the endpoint that `process_upload.jsp` forwards to; use it when you need the legacy text response style.\n\n**Field ordering**: the `fileMetadata` field MUST be sent BEFORE the file parts." }, "response": [] }, { "name": "Validate upload (pre-flight)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"lang\": \"NL\",\n \"fileMetadataList\": [\n {\n \"fileName\": \"report.pdf\",\n \"fileSize\": 102400,\n \"mimeType\": \"application/pdf\"\n }\n ]\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/transfer/validate-upload", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "transfer", "validate-upload"] }, "description": "Validate the metadata of an upload before sending bytes. Checks server quota, allowed extensions/MIME, max size, etc.\n\nReturns `ApiResult` (only `success` and `errorMessage`). The aliased path `/transfer/validateUpload` works as well." }, "response": [] }, { "name": "Validate files", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"lang\": \"NL\",\n \"fileMetadataList\": [\n { \"fileName\": \"clean.pdf\", \"fileSize\": 1024, \"mimeType\": \"application/pdf\" },\n { \"fileName\": \"forbidden.exe\", \"fileSize\": 2048, \"mimeType\": \"application/x-msdownload\" }\n ]\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/transfer/validate-files", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "transfer", "validate-files"] }, "description": "Per-file validation. Returns `ApiResult` with one entry per file, indicating whether it is allowed and – if not – the rule that was violated." }, "response": [] }, { "name": "Validate recipient", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"senderEmailAddress\": \"kees@example.com\",\n \"recipientEmailAddress\": \"piet@receiver.com\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/transfer/validate-recipient", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "transfer", "validate-recipient"] }, "description": "Validate the sender / recipient combination against domain whitelists, IP allow-lists and `emailMaySend` / `emailMayReceive` rules.\n\nResponse is `ApiResult`. Possible error messages: `VALIDATION_ERROR_DOMAIN_INVALID`, `VALIDATION_ERROR_EMAIL_ADDRESS`." }, "response": [] }, { "name": "Send reply", "request": { "method": "POST", "header": [], "body": { "mode": "formdata", "formdata": [ {"key": "ids", "value": "263478632784632748237513", "description": "ID of the original transfer being replied to.", "type": "text"}, {"key": "from", "value": "piet@receiver.com", "type": "text"}, {"key": "subject", "value": "RE: API Test", "type": "text"}, {"key": "comment", "value": "Reply with attachments.", "type": "text"}, {"key": "replyToAll", "value": "false", "description": "Reply to every recipient of the original transfer.", "type": "text", "disabled": true}, {"key": "fileMetadata", "value": "[{\"filename\":\"reply.pdf\",\"mimetype\":\"application/pdf\",\"size\":51200}]", "description": "REQUIRED when file parts are attached. JSON array describing every file part (filename, mimetype, size). MUST appear BEFORE the file parts in the multipart body.", "type": "text"}, {"key": "file01", "value": "", "description": "Optional file part. Place AFTER the fileMetadata field.", "type": "file"} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/transfer/send-reply", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "transfer", "send-reply"] }, "description": "Send a secure reply to an existing transfer. `multipart/form-data` request, JSON `ApiResult` response. Rate-limited (`SendReply`).\n\n**Field ordering**: when file parts are attached, the `fileMetadata` field MUST be sent BEFORE them." }, "response": [] }, { "name": "Check connection", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": {"mode": "raw", "raw": "{}"}, "url": { "raw": "{{baseURL}}/FileCap/api/transfer/checkConnection", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "transfer", "checkConnection"] }, "description": "Lightweight liveness probe. Always returns `ApiResult.success(\"connected\")` when the FileCap portal is reachable." }, "response": [] } ] }, { "name": "3. Invite", "description": "Endpoints for sending FileCap invites (asking a 3rd party to upload files for you).", "item": [ { "name": "Send invite (modern JSON)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"apiKey\": \"{{apiKey}}\",\n \"deviceApiKey\": \"\",\n \"sender\": {\n \"emailAddress\": \"kees@example.com\",\n \"name\": \"Kees Janssen\"\n },\n \"invitees\": [\n \"piet@company.com\",\n \"jan@partner.com\"\n ],\n \"message\": \"Please upload the requested documents.\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/invite", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "invite"] }, "description": "Modern JSON variant of the legacy `invite.jsp` flow. Accepts a list of invitees in a single call and returns `ApiResult`. Rate-limited at 10 requests / minute." }, "response": [] }, { "name": "Send invite (legacy form, /invite/old)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "APIKey", "value": "{{apiKey}}", "type": "text"}, {"key": "deviceApiKey", "value": "", "type": "text", "disabled": true}, {"key": "id", "value": "iiiii26347863278463274823755", "description": "Invite ID – must start with `iiiii`.", "type": "text"}, {"key": "senderEmail", "value": "kees@example.com", "type": "text"}, {"key": "receiverEmail", "value": "piet@company.com", "type": "text"}, {"key": "receiverMobileNr", "value": "", "type": "text", "disabled": true}, {"key": "message", "value": "", "type": "text", "disabled": true}, {"key": "notify", "value": "true", "type": "text", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/invite/old", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "invite", "old"] }, "description": "Direct call to the endpoint that `invite.jsp` forwards to. Returns plain-text `true` / `false|`." }, "response": [] }, { "name": "Generate invite ID", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"apiKey\": \"{{apiKey}}\",\n \"deviceApiKey\": \"\",\n \"sender\": {\n \"emailAddress\": \"kees@example.com\"\n }\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/invite/generate-id", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "invite", "generate-id"] }, "description": "Pre-generate an invite ID (the value used in the `id` field of the legacy invite call, prefixed with `iiiii`). Returns `ApiResult`. Aliased path: `/invite/generateInviteId`." }, "response": [] } ] }, { "name": "4. Settings", "description": "Server settings used by clients/plugins: password policy, recipient verification options, branding, plugin settings.", "item": [ { "name": "Password rules (detailed, JSON)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"apiKey\": \"{{apiKey}}\",\n \"lang\": \"NL\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/settings/getPasswordRules", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "settings", "getPasswordRules"] }, "description": "Detailed description of the password requirements. Returns `ApiResult` with `enabled`, `title`, and an array of rules (each rule: `description`, `requirement`)." }, "response": [] }, { "name": "Password rules (GET, public)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseURL}}/FileCap/api/settings/password-rules?lang=NL", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "settings", "password-rules"], "query": [{"key": "lang", "value": "NL"}] }, "description": "Public, unauthenticated GET version of the password rules endpoint. Same `ApiResult` body." }, "response": [] }, { "name": "Password policy (short)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"apiKey\": \"{{apiKey}}\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/settings/getPasswordPolicy", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "settings", "getPasswordPolicy"] }, "description": "Short summary of password requirements: minimum length, character classes, expiration, reuse policy." }, "response": [] }, { "name": "Mail plugin settings (XML, /outlook-windows)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "APIKey", "value": "{{apiKey}}", "type": "text"}, {"key": "userAgent", "value": "OutlookPlugin", "type": "text", "disabled": true}, {"key": "version", "value": "1.0", "type": "text", "disabled": true}, {"key": "lang", "value": "NL", "type": "text", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/settings/outlook-windows", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "settings", "outlook-windows"] }, "description": "Path that `mailPluginSettings.jsp` forwards to. Returns the plug-in configuration as XML." }, "response": [] }, { "name": "Recipient verification options", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"apiKey\": \"{{apiKey}}\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/settings/recipient-verification-options", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "settings", "recipient-verification-options"] }, "description": "Lists the verification methods that can be applied to a transfer (e.g. `NONE`, `EMAIL_ACCESS_CODE`, `SMS`, `PASSWORD`) and which ones are mandatory by current policy." }, "response": [] }, { "name": "App settings", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"apiKey\": \"{{apiKey}}\",\n \"lang\": \"NL\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/settings/app-settings", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "settings", "app-settings"] }, "description": "Generic settings bundle for client apps: enabled features, max upload size, branding, supported languages, etc. Returns `ApiResult`." }, "response": [] }, { "name": "Web portal settings", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseURL}}/FileCap/api/settings?lang=NL", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "settings"], "query": [{"key": "lang", "value": "NL"}] }, "description": "Returns `ApiResult` for the web portal (theme, locale options, feature flags). Allowed for portal types MAIN, SUB, FREE." }, "response": [] }, { "name": "Is shared access code available", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"transferId\": \"263478632784632748237513\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/settings/is-shared-access-code-available", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "settings", "is-shared-access-code-available"] }, "description": "Returns a raw boolean (`true` / `false`) – not wrapped in `ApiResult` – indicating whether a shared access code has been configured for the given transfer." }, "response": [] } ] }, { "name": "5. Validation", "description": "Lightweight validators that mail plugins can call before composing or sending a message. All endpoints return plain text (`true` / `false|`).", "item": [ { "name": "Check file (form, /validate/file)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "APIKey", "value": "{{apiKey}}", "type": "text"}, {"key": "filename", "value": "test.exe", "type": "text"}, {"key": "sender", "value": "kees@example.com", "type": "text"}, {"key": "mime", "value": "application/exe", "type": "text"}, {"key": "fileID", "value": "", "type": "text", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/validate/file", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "validate", "file"] }, "description": "Direct call to the path that `checkFile.jsp` forwards to. Validates a single file by name + MIME against the policy engine." }, "response": [] }, { "name": "Check transfer (/validate/transfer)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "APIKey", "value": "{{apiKey}}", "type": "text"}, {"key": "deviceApiKey", "value": "", "type": "text", "disabled": true}, {"key": "id", "value": "263478632784632748237513", "type": "text"}, {"key": "email", "value": "", "type": "text", "disabled": true} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/validate/transfer", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "validate", "transfer"] }, "description": "Direct call to the path that `checkTransfer.jsp` forwards to." }, "response": [] }, { "name": "Check domain (/validate/domain)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/x-www-form-urlencoded", "type": "text"}], "body": { "mode": "urlencoded", "urlencoded": [ {"key": "email", "value": "piet@receiver.com", "type": "text"}, {"key": "sender", "value": "kees@example.com", "type": "text"} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/validate/domain", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "validate", "domain"] }, "description": "Direct call to the path that `domainCheck.jsp` forwards to." }, "response": [] }, { "name": "Check sender may send (/validate/email-may-send)", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "text/plain", "type": "text"}], "body": { "mode": "raw", "raw": "kees@example.com" }, "url": { "raw": "{{baseURL}}/FileCap/api/validate/email-may-send", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "validate", "email-may-send"] }, "description": "Returns a raw boolean (`true` / `false`) for the question \"is this sender allowed to send via FileCap?\". The body is the bare e-mail address as `text/plain`." }, "response": [] } ] }, { "name": "6. Business Rules (DLP)", "description": "Endpoints for the policy / DLP engine. Both endpoints require either DEVICE or API_KEY authentication and are rate-limited at 60 requests / minute.", "item": [ { "name": "Scan attachment", "request": { "method": "POST", "header": [], "body": { "mode": "formdata", "formdata": [ {"key": "APIKey", "value": "{{apiKey}}", "type": "text"}, {"key": "file", "value": "", "description": "Single file part to scan.", "type": "file"} ] }, "url": { "raw": "{{baseURL}}/FileCap/api/business-rules/scan-attachment", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "business-rules", "scan-attachment"] }, "description": "Run a DLP / business-rules scan against a single attachment. Returns `ApiResult` with whether the file is allowed and any policy violations." }, "response": [] }, { "name": "Scan text", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"text\": \"Hello, this is the message body that needs to be scanned for sensitive data.\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/business-rules/scan-text", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "business-rules", "scan-text"] }, "description": "Run a DLP scan against arbitrary text. Returns `ApiResult`." }, "response": [] } ] }, { "name": "7. Block transfer", "description": "**Sender-facing** endpoints to inspect and revoke (block) a transfer that has already been sent.\n\n## How it works\n\nWhen a transfer is created, FileCap stores a hashed `blockPassword` together with the transfer and e-mails the **sender** a notification that contains a *block link* of the form:\n\n```\nhttps:///FileCap/blockTransfer.jsp?id=&blockId=&email=\n```\n\n`blockTransfer.jsp` sanitizes the parameters and redirects to the portal page `block`, which renders a confirmation screen. That page uses these two API endpoints under the hood:\n\n1. **`GET /api/block/info`** – load the metadata of the transfer to be blocked (recipients, file names, whether the message body is encrypted) so the sender can confirm what they are about to block.\n2. **`POST /api/block`** – actually mark the transfer as blocked. This stops further downloads, writes an audit-log entry (`blocked transfer`) and sends a *“message withdrawn”* notification to all TO and CC recipients of the original transfer.\n\n## Authentication\n\nThe `blockId` is the secret. The server hashes the value supplied by the caller and compares it to the `blockPassword` that was stored when the transfer was created. The combination of `transferId` + `blockId` + `emailAddress` (sender) acts as a capability — anyone holding all three can block the transfer; no API key or session is required.\n\nFor security reasons every validation failure (wrong `blockId`, wrong sender, unknown transferId) collapses to the same generic error message `PORTAL_BLOCK_TRANSFER_NOT_FOUND`. The caller cannot tell which of the three was wrong.\n\n## When integrating from a 3rd-party system\n\nIf your integration suppresses FileCap's own notification mails (`dontNotify=true` on upload), it is responsible for forwarding the `blockId` from the upload response to the sender. Without that value the transfer cannot be blocked through the API.", "item": [ { "name": "Get block info", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseURL}}/FileCap/api/block/info?transferId=263478632784632748237513&blockId=BLK-1234&emailAddress=kees@example.com", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "block", "info"], "query": [ {"key": "transferId", "value": "263478632784632748237513", "description": "REQUIRED. The transfer's unique ID (the `ids` value from the upload call). Used to look up the transfer record."}, {"key": "blockId", "value": "BLK-1234", "description": "REQUIRED. The block secret embedded in the FileCap notification mail to the sender (URL parameter `blockId` of `blockTransfer.jsp`). The server hashes this value and compares it with the `blockPassword` stored on the transfer."}, {"key": "emailAddress", "value": "kees@example.com", "description": "REQUIRED. The e-mail address of the **sender** of the transfer. Validated against the sender record (`SenderDb.isSender(transfer, email)`). Not the recipient's address."} ] }, "description": "Return the metadata that the FileCap web UI shows on the *block confirmation* page: the TO recipients of the transfer, the file names and a flag that indicates whether the message body was encrypted.\n\n**Response — `ApiResult`**\n\n```\n{\n \"success\": true,\n \"value\": {\n \"recipients\": [\"piet@company.com\", \"jan@partner.com\"],\n \"files\": [\"contract.pdf\", \"appendix.docx\"],\n \"hasEncryptedMessage\": false\n },\n \"errorMessage\": null\n}\n```\n\n- `recipients` – array of e-mail addresses of the TO recipients of the transfer.\n- `files` – set of filenames (no path) inside the transfer.\n- `hasEncryptedMessage` – `true` when the message body of the transfer was encrypted at upload time.\n\n**Validation order** (every failure collapses to the generic error `PORTAL_BLOCK_TRANSFER_NOT_FOUND` unless noted otherwise):\n\n1. all three parameters must be non-blank;\n2. transfer with `transferId` must exist;\n3. SHA-hash of `blockId` must equal the transfer's stored `blockPassword`;\n4. `emailAddress` must be a known sender of that transfer;\n5. transfer must not be `DISABLED` (expired) — returns `PORTAL_DOWNLOAD_TRANSFER_EXPIRED`;\n6. transfer must not already be `BLOCKED` — returns `PORTAL_BLOCK_TRANSFER_ALREADY_BLOCKED`.\n\nThis call is **read-only**: it does not modify the transfer, send any mail or write to the audit log." }, "response": [] }, { "name": "Block transfer", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"transferId\": \"263478632784632748237513\",\n \"blockId\": \"BLK-1234\",\n \"emailAddress\": \"kees@example.com\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/block", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "block"] }, "description": "Mark the transfer as blocked. After a successful call:\n\n- the transfer status is set to `BLOCKED` — subsequent download attempts (web portal or API) are refused;\n- an NTA audit-log entry is written: *user `` blocked transfer with id ``*;\n- a *“message withdrawn”* notification mail is sent to all TO and CC recipients of the original transfer.\n\n**Request body (application/json)**\n\n| Field | Type | Required | Description |\n|---|---|---|---|\n| `transferId` | string | yes | The transfer's unique ID (the `ids` value from the upload call). |\n| `blockId` | string | yes | The block secret from the sender notification mail (`blockId` URL parameter of `blockTransfer.jsp`). The server hashes this and compares it to the stored `blockPassword`. |\n| `emailAddress` | string | yes | The **sender's** e-mail address. Validated against the transfer's sender record (`SenderDb.isSender`). Not the recipient address. |\n\n**Response — `ApiResult`**\n\nOnly `success` and `errorMessage` are populated.\n\n**Possible error messages**\n\n| `errorMessage` | Meaning |\n|---|---|\n| `PORTAL_BLOCK_TRANSFER_NOT_FOUND` | Generic catch-all returned for missing parameters, unknown transfer, wrong `blockId`, wrong sender e-mail or any unexpected exception. The server deliberately does not distinguish these to avoid leaking which field was wrong. |\n| `PORTAL_DOWNLOAD_TRANSFER_EXPIRED` | The transfer has already expired (status `DISABLED`) and cannot be blocked. |\n| `PORTAL_BLOCK_TRANSFER_ALREADY_BLOCKED` | The transfer was blocked previously. |\n| `PORTAL_BLOCK_TRANSFER_ERROR` | The transfer record could not be updated (database error). |\n\n**Idempotency**\n\nA second call with the same parameters returns `PORTAL_BLOCK_TRANSFER_ALREADY_BLOCKED`; the underlying state is not changed and no extra notification mail is sent.\n\n**Side-effect ordering**\n\nThe DB update happens before the notification mail is sent. If the mail server is unreachable the transfer is still blocked; the failure is only logged." }, "response": [] } ] }, { "name": "8. Device registration", "description": "Endpoints for registering an external device (a 3rd party system) with the FileCap server so it can call the API with its own device key.", "item": [ { "name": "Register device", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"emailAddress\": \"kees@example.com\",\n \"apiKey\": \"{{apiKey}}\",\n \"deviceName\": \"My integration server\",\n \"lang\": \"NL\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/user/devices/register", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "user", "devices", "register"] }, "description": "Initiate device registration. The server e-mails a verification code to `emailAddress`. Rate-limited (`RegisterDevice`)." }, "response": [] }, { "name": "Verify device", "request": { "method": "POST", "header": [{"key": "Content-Type", "value": "application/json", "type": "text"}], "body": { "mode": "raw", "raw": "{\n \"email\": \"kees@example.com\",\n \"verificationCode\": \"123456\"\n}" }, "url": { "raw": "{{baseURL}}/FileCap/api/user/devices/verify", "host": ["{{baseURL}}"], "path": ["FileCap", "api", "user", "devices", "verify"] }, "description": "Exchange the e-mailed verification code for a JWT / device token. Returns `ApiResult`." }, "response": [] } ] } ], "event": [ {"listen": "prerequest", "script": {"type": "text/javascript", "exec": [""]}}, {"listen": "test", "script": {"type": "text/javascript", "exec": [""]}} ], "variable": [ {"key": "baseURL", "value": "https://filecap.example.com", "type": "string", "description": "Scheme + host of the FileCap server, no trailing slash. The application context root `/FileCap` is appended in each request URL."}, {"key": "apiKey", "value": "", "type": "string", "description": "The FileCap server API key. Set this in your environment or collection variables before running requests."} ] }