FiveMesh CDN API

Use the FiveMesh CDN API when a server-side integration needs to list, upload or delete CDN objects without opening the dashboard. The API manages objects, cached delivery responses and scoped upload URLs. Public file delivery happens through the publicUrl returned by object responses.

Do not call these endpoints with an API key from client-side Lua, browser code or NUI bundles. Keep API keys on the server side.

Base URL

https://api.fivemesh.io/v1

All authenticated CDN routes require an API key with the matching cdn permission.

Authorization: Bearer YOUR_FIVEMESH_API_KEY

Every response includes success and requestId. The same request ID is returned as the X-Request-Id header.

Permissions

Permission	Allows
`cdn:read`	List objects under allowed paths.
`cdn:write`	Upload objects and create scoped upload URLs.
`cdn:delete`	Delete one object or a batch of objects.
`cdn:purge`	Expire cached delivery responses for specific objects.

Server API Keys only include cdn:write. Use a Developer API Key for cdn:read, cdn:delete or cdn:purge. Developer API Keys can be limited to CDN path prefixes such as /phone, /tablet or /uploads.

Path checks run against the final normalized object path. Encoded traversal, backslashes, absolute paths and dot-prefixed path segments are rejected or hidden from customer-facing listings.

Endpoints

Endpoint	Use it for
`GET /objects`	Read objects under an allowed CDN path.
`POST /objects`	Upload a single file from a server-side integration.
`POST /objects/base64`	Upload a Base64-encoded file in a JSON request.
`POST /objects/bulk`	Upload multiple files and receive per-file results.
`DELETE /objects`	Remove a single object by path.
`POST /objects/bulk-delete`	Remove multiple objects and receive per-path results.
`POST /objects/purge`	Expire cached CDN responses without deleting stored files.
`GET /presigned-url`	Create a short-lived upload URL without exposing the API key.
`POST /presigned-url/{token}`	Send files to a scoped upload URL.

Object shape

{
  "key": "screenshots/a.png",
  "size": 12345,
  "contentType": "image/png",
  "etag": "3f2a...",
  "lastModified": "2026-06-16T11:00:00.000Z",
  "metadata": {},
  "publicUrl": "https://cdn.fivemesh.io/acme/screenshots/a.png"
}

Idempotency

Upload and delete routes accept Idempotency-Key. Use this header when retrying a request after a network timeout. Reusing the same idempotency key with a different request returns CONFLICT.

Idempotency-Key: upload-screenshot-001

Error format

{
  "success": false,
  "error": {
    "code": "PATH_NOT_ALLOWED",
    "message": "This API key cannot access the requested path."
  },
  "requestId": "req_..."
}

Common CDN error codes:

Code	Meaning
`UNAUTHORIZED`	The API key is missing, invalid, disabled or expired.
`FORBIDDEN`	The API key does not include the required permission.
`INVALID_PATH`	The path or filename is not accepted.
`PATH_NOT_ALLOWED`	The path is outside the key or upload URL scope.
`FILE_TOO_LARGE`	The uploaded file is over the allowed size.
`TOO_MANY_FILES`	The request exceeds the file or path count limit.
`CONTENT_TYPE_NOT_ALLOWED`	The file MIME type is not allowed.
`TOKEN_INVALID`	The upload URL token is invalid.
`TOKEN_EXPIRED`	The upload URL token expired or reached its file limit.
`RATE_LIMITED`	Retry after the `Retry-After` header.
`CONFLICT`	An idempotency key was reused with different request content.

FiveMesh CDN

FiveMesh Logs

FiveMesh Cache

FiveMesh Voice

Base URL

Permissions

Endpoints

Object shape

Idempotency

Error format

Base URL

Permissions

Endpoints

Object shape

Idempotency

Error format

Related pages