> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fetchski-attract.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List files

> Retrieve a paginated list of files from the media library

```php Laravel wrap theme={"dark"}
use Fetchski\AttractCmsLaravel\Facades\Attract;

$fileObjectList = Attract::media()->listFiles();
```

```json 200 wrap theme={"dark"}
{
  "results": [
    {
      "_id": "clx1234567890abcdef",
      "title": "Company Brochure",
      "slug": "company-brochure",
      "type": "@apostrophecms/file",
      "archived": false,
      "visibility": "public",
      "attachment": {
        "_id": "ckj0akbxa003vp39kfbxgb8zg",
        "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
        "_urls": {
          "key": "Example value"
        },
        "name": "blue-box",
        "title": "blue box",
        "extension": "png",
        "type": "attachment",
        "group": "images",
        "length": 10497,
        "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
        "width": 600,
        "height": 106,
        "landscape": true,
        "portrait": true,
        "docIds": [
          "clx8m2k4p0000a1b2c3d4e5f6"
        ],
        "archivedDocIds": [
          "clx8m2k4p0000a1b2c3d4e5f6"
        ],
        "createdAt": "2026-10-24T09:30:00.000Z",
        "updatedAt": "2026-10-24T09:30:00.000Z",
        "_isCroppable": true,
        "crop": {},
        "used": true,
        "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
        "folderPath": "Example folder path"
      },
      "description": "Example description",
      "createdAt": "2026-10-24T09:30:00.000Z",
      "updatedAt": "2026-10-24T09:30:00.000Z",
      "copyOfId": "ckhdscx5900054z9k88uqs16w:en:published",
      "_folder": [
        {}
      ],
      "_tags": [
        {}
      ],
      "_url": "https://acme.example/example",
      "aposShareKey": "k3v9x2m7q1z8w4p6"
    }
  ],
  "pages": 1,
  "currentPage": 1
}
```

## In your app

A controller answers a route on your app: it calls `listFiles()` and returns the answer.

**1. Add the controller**

```php app/Http/Controllers/ListFilesController.php theme={"dark"}
<?php

declare(strict_types=1);

namespace App\Http\Controllers;

use Fetchski\AttractCmsLaravel\Data\FileObjectList;
use Fetchski\AttractCmsLaravel\Facades\Attract;

final class ListFilesController
{
    public function __invoke(): FileObjectList
    {
        return Attract::media()->listFiles();
    }
}
```

**2. Add the route**

```php routes/web.php theme={"dark"}
use App\Http\Controllers\ListFilesController;
use Illuminate\Support\Facades\Route;

Route::get('/file', ListFilesController::class);
```

**3. Call it**

```bash Terminal theme={"dark"}
curl http://localhost:8000/file
```

With `php artisan serve` running, it prints its answer as JSON.

> [!TIP]
>
> To keep the call in an Action instead, this writes `app/Actions/Attract/ListFiles.php` (an invokable Action that calls `listFiles()`) and its test under `tests/Feature/Actions/Attract/` (Pest when your app has it):
>
> ```bash Terminal theme={"dark"}
> php artisan make:attract-action media.listFiles
> ```

## Call it from the terminal

```bash Terminal theme={"dark"}
php artisan attract:call media.listFiles
```

It calls `listFiles()` on your default site and prints its answer as JSON. See [Call any method from the terminal](https://docs.fetchski-attract.com/call-command.md) for every argument type.

```bash Terminal theme={"dark"}
php artisan attract:call media.listFilesPick fields=title,slug
```

Only the fields you name, for every document across every page: [Find an id](https://docs.fetchski-attract.com/find-an-id.md).

> [accordion] Optional parameters
>
> Named arguments, e.g. `listFiles(page: …)`; leave out the optional ones.
>
> **page** `?int`
>
> **Optional.** Leave it out and the site uses `1`. Page number for pagination (1-based)
>
> **perPage** `?int`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. Documents per page. Each content type has its own default (core’s is 50; a type may set another). There is no upper limit: a large value answers the whole list at once, which is slow on a big one. At least 1.
>
> **search** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. Matches documents by their text. Ignored for the public and API keys on a type whose public fields leave some out (a search would match the hidden ones).
>
> **aposMode** `Enums\\AposMode|string|null`
>
> **Optional.** Leave it out and the site uses `"published"`. `published` (the default) or `draft`. Drafts need a credential that may see them: an API key with the type’s write scope (`content:<type>:write`), or a signed-in editor. The public and a key with only the read scope get 403. One of `draft`, `published`.
>
> **aposLocale** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The locale to read or write, e.g. `en` (default: the site’s default locale).
>
> **renderAreas** `?bool`
>
> **Optional.** Leave it out and the site uses `false`. true: each area’s widgets come back rendered as HTML (`_rendered`), beside their data.
>
> **slug** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. Only the document with exactly this slug: a list of one, or an empty list when none has it. Use it to find a document by the name in its URL.

> [accordion] Returns
>
> A `FileObjectList` (`Fetchski\AttractCmsLaravel\Data\FileObjectList`). A page of FileObject documents. Read its properties (`$fileObjectList->results`): each says whether the site always sends it. The example answer is the site’s wire JSON: some keys differ from the property names (`_id` → `id`, `_folder` → `folder`, `_tags` → `tags` …).
>
> **results** `Collection\<int, FileObject\>`
>
> **Always sent.** A list of `FileObject`. This page’s documents; empty past the last page.
>
> **FileObject (Fetchski\AttractCmsLaravel\Data\FileObject)**
>
> Built-in file piece type for general file uploads (PDFs, documents, etc.)
>
> **id** `string`
>
> **Always sent.** Unique identifier.
>
> **slug** `string`
>
> **Always sent.** Its URL name: lowercase words joined by hyphens.
>
> **type** `string`
>
> **Always sent.**
>
> **visibility** `Enums\\Visibility|string`
>
> **Always sent.** Who may see it on the site: `public` (everyone) or `loginRequired` (signed-in people only). One of `public`, `loginRequired`; a newer site may send others, so keep a fallback.
>
> **createdAt** `CarbonImmutable`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **updatedAt** `CarbonImmutable`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **title** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. File title/description.
>
> **archived** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. In the archive: kept, but out of every list and off the site until it is restored. `false` (or null) for a live document.
>
> **attachment** `?Attachment`
>
> **Sometimes sent:** `null` when the site leaves it out. An `Attachment`. File attachment information from upload endpoint.
>
> **Attachment (Fetchski\AttractCmsLaravel\Data\Attachment)**
>
> **id** `string`
>
> **Always sent.** Unique attachment identifier.
>
> **name** `string`
>
> **Always sent.** Slugified filename.
>
> **title** `string`
>
> **Always sent.** Sortified filename.
>
> **extension** `string`
>
> **Always sent.** File extension.
>
> **type** `string`
>
> **Always sent.** Always `attachment`.
>
> **group** `string`
>
> **Always sent.** File group type.
>
> **length** `int`
>
> **Always sent.** File size in bytes.
>
> **md5** `string`
>
> **Always sent.** MD5 checksum.
>
> **docIds** `Collection\<int, string\>`
>
> **Always sent.** IDs of documents using this attachment.
>
> **archivedDocIds** `Collection\<int, string\>`
>
> **Always sent.** IDs of archived documents using this attachment.
>
> **createdAt** `CarbonImmutable`
>
> **Always sent.** When it was uploaded (ISO 8601). Format: an ISO 8601 date and time.
>
> **url** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The file’s URL: set for a file that is not an image. An image’s URLs are in `_urls`, by size (`original` is the file as uploaded).
>
> **urls** `array\<string, string\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. An image’s URLs by size (`original`, `max`, `full`, `two-thirds`, `one-half`, `one-third`, `one-sixth`); unset for other files.
>
> **width** `?int`
>
> **Sometimes sent:** `null` when the site leaves it out. Image width in pixels (images only)
>
> **height** `?int`
>
> **Sometimes sent:** `null` when the site leaves it out. Image height in pixels (images only)
>
> **landscape** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. Whether image is landscape orientation (images only)
>
> **portrait** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. Whether image is portrait orientation (images only)
>
> **updatedAt** `?CarbonImmutable`
>
> **Sometimes sent:** `null` when the site leaves it out. When it last changed (ISO 8601). Format: an ISO 8601 date and time.
>
> **isCroppable** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. Whether the image can be cropped.
>
> **crop** `array\<string, mixed\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. The crop applied, if any (`top`, `left`, `width`, `height`).
>
> **used** `?bool`
>
> **Sometimes sent:** `null` when the site leaves it out. Whether any document uses the file.
>
> **folderId** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The media folder holding the file, by its `aposDocId`.
>
> **folderPath** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. That folder’s path, e.g. `events/summer`.
>
> **description** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. File description.
>
> **copyOfId** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The `_id` of the piece/page that was copied to create this document (only present if created via `_copyingId`)
>
> **folder** `Collection\<int, array\<string, mixed\>\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. The media folder holding it (one at most; empty at the library’s root).
>
> **tags** `Collection\<int, array\<string, mixed\>\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. Its tags, as documents.
>
> **url** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The file’s URL (the attachment’s `_url`). Format: an absolute URL.
>
> **aposShareKey** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The draft’s preview share key, while its share link is on: the link is the draft’s `_url` with `aposShareKey` and `aposShareId` (the draft’s `_id`) in its query. Absent otherwise, and on published documents.
>
> **pages** `int`
>
> **Always sent.** Pages in the whole list (0 when it is empty).
>
> **currentPage** `int`
>
> **Always sent.** This page, from 1.

> [accordion] Errors
>
> Nothing to catch: the SDK retries what is safe, and Laravel logs and renders the rest (see [Errors and testing](https://docs.fetchski-attract.com/laravel/errors.md)).
>
> **ValidationFailed** `400`
>
> The site refused what was sent: `errors()` lists each field’s problem, `siteMessage()` the first.
>
> **Retried first:** No. **Read:** `errors()` (field → messages), `siteMessage()`.
>
> **AuthenticationFailed** `401`
>
> The API key is missing or refused (malformed, revoked, expired), or a signature its signing mode needs is missing or stale.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **Forbidden** `403`
>
> The key may not do this: a scope it lacks, or an address outside its allowlist. `siteMessage()` names it.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **NotFound** `404`
>
> Nothing matches, or the caller may not see it.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **SiteError** `500`
>
> The site failed. Its logs say why.
>
> **Retried first:** No (only a 502, 503 or 504 is retried). **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **SiteUnreachable** `no answer`
>
> No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).
>
> **Retried first:** Yes, after 0.5 s then 1 s. **Read:** `reason()`, `neverConnected()`.
>
> **RequestNotSent** `not sent`
>
> The client refused to send it (e.g. a path segment of `..`); the site never saw it.
>
> **Retried first:** No. **Read:** `reason()` (what to change).
>
> **SiteRequestFailed** `any other`
>
> Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).
>
> **Retried first:** No. **Read:** `reason()`, `status()`.
>
> **UnknownSite** `setup`
>
> `Attract::site('acme')` named a slug that isn’t under `sites` in `config/fetchski-attract.php`.
>
> **Retried first:** No: nothing was sent. **Read:** `getMessage()`, `$e->slug`.
>
> **SiteConfigurationError** `setup`
>
> The site’s config entry is wrong: no `url`, a malformed `api_key`, a key filed under another slug, or no default site.
>
> **Retried first:** No: nothing was sent. **Read:** `getMessage()` (what to fix).

## Behavior

* **Access:** an API key with `content:files:read` (or a master above it: `content:files:all`, `content:all`, `admin:all`) reads the published documents; drafts (`aposMode=draft`) need `content:files:write` (or a master above it). A signed-in person may call it as far as their own permissions allow; anyone else gets 404.
* **Rate limit:** the key’s own reads-per-minute limit, set when the key is created (default 600); over it, 429 with `Retry-After`. The client waits and retries for you; you see `RateLimited` only if that runs out.
* **Retries:** a read is safe to repeat: the client retries it on no answer, a 502/503/504 and a 429.
* **Timeout:** 15 s per attempt by default; raise `timeout` in `config/fetchski-attract.php` for longer.
* **Paging:** one page per call. To walk them all, use `listFilesAll()` (see More examples): it asks for the next page as you iterate, and stops after page `pages`.

## More examples

`listFilesAll()` takes `listFiles()`’s arguments except `page`. `listFilesPick()` takes the same arguments except `page`, after the fields to answer: each row is the document’s `id` and those fields.

```php Every page wrap theme={"dark"}
use Fetchski\AttractCmsLaravel\Facades\Attract;

$fileObjects = Attract::media()->listFilesAll(); // LazyCollection<int, FileObject>: the next page is fetched as you iterate
```

```php Only some fields wrap theme={"dark"}
use Fetchski\AttractCmsLaravel\Facades\Attract;

$rows = Attract::media()->listFilesPick(fields: ['title', 'slug']); // LazyCollection of ['id' => …, 'title' => …, 'slug' => …]: every file, across every page
```

## Test it

It calls the route above with the SDK faked: the fake answers every call with a valid example, so nothing leaves your machine and no config or key is needed. Save it as `tests/Feature/ListFilesTest.php`, then run your tests:

```php tests/Feature/ListFilesTest.php theme={"dark"}
<?php

declare(strict_types=1);

namespace Tests\Feature;

use Fetchski\AttractCmsLaravel\Facades\Attract;
use Tests\TestCase;

final class ListFilesTest extends TestCase
{
    public function test_list_files(): void
    {
        Attract::fake();

        $this->getJson('/file')->assertOk();

        Attract::assertCalled('media.listFiles');
    }
}
```

```bash Terminal theme={"dark"}
php artisan test
```

**Answer with your own values:** fake `media.listFiles` with a `sequence()` of pages, each `FileObjectList::factory()->make([...])`, and walk `listFilesAll()`.

```php tests/Feature/ListFilesAnswerTest.php theme={"dark"}
<?php

declare(strict_types=1);

namespace Tests\Feature;

use Fetchski\AttractCmsLaravel\Data\FileObjectList;
use Fetchski\AttractCmsLaravel\Facades\Attract;
use Tests\TestCase;

final class ListFilesAnswerTest extends TestCase
{
    public function test_list_files_answers_your_values(): void
    {
        Attract::fake([
            'media.listFiles' => Attract::sequence(
                FileObjectList::factory()->make(['currentPage' => 1, 'pages' => 2]),
                FileObjectList::factory()->make(['currentPage' => 2, 'pages' => 2]),
            ),
        ]);

        $fileObjects = Attract::media()->listFilesAll();

        $this->assertCount(2, $fileObjects->all());
    }
}
```

To fake `listFilesAll()`, answer `media.listFiles` (the walk calls it page by page): a `sequence()` of answers for several pages.

## Related

> [card] [List images](https://docs.fetchski-attract.com/laravel/reference/media/list-images.md)
>
> `Attract::media()->listImages()`

> [card] [Create an image](https://docs.fetchski-attract.com/laravel/reference/media/create-image.md)
>
> `Attract::media()->createImage()`

> [card] [Archive images](https://docs.fetchski-attract.com/laravel/reference/media/archive-images.md)
>
> `Attract::media()->archiveImages()`

> [card] [Crop images to a widget’s aspect ratio](https://docs.fetchski-attract.com/laravel/reference/media/autocrop-images.md)
>
> `Attract::media()->autocropImages()`

> [card] [Copy images to another locale](https://docs.fetchski-attract.com/laravel/reference/media/localize-images.md)
>
> `Attract::media()->localizeImages()`

> [card] [Publish images](https://docs.fetchski-attract.com/laravel/reference/media/publish-images.md)
>
> `Attract::media()->publishImages()`

> [card] [GET /@apostrophecms/file](https://docs.fetchski-attract.com/api-reference/media/list-files.md)
>
> The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.