List workspace files

GET /api/v1/workspaces/{workspaceId}/files — metadata only, paginated, never file content.

GET /api/v1/workspaces/{workspaceId}/files?limit=50&cursor=…

Requires files:read. Returns file metadata for the key's workspace, newest first. It does not return file content and there is no scope that does — this endpoint tells you what exists, not what is in it.

200

{
  "files": [
    {
      "id": "…",
      "name": "supplier-invoice-2210.pdf",
      "contentType": "application/pdf",
      "size": 184320,
      "validationStatus": "…",
      "createdAt": "…"
    }
  ],
  "hasMore": true,
  "nextCursor": "eyJvZmZzZXQiOiI1MCJ9"
}

name: The original filename, normalised. Control characters and bidirectional-override characters are stripped when the file is stored, so a filename cannot be used to disguise its extension in a listing.
size: Bytes.
validationStatus: What the upload checks concluded. Files are verified by signature rather than by extension, so a renamed executable is rejected at upload rather than listed here as a document.
hasMore: Whether another page exists. Read this rather than comparing the array length against your limit.
nextCursor: Opaque. Pass it back verbatim. null when there is nothing more.

Ordering

Newest first, by creation time and then by identifier. The second key matters: without it two files created in the same instant could swap places between pages and one of them would never be returned.