#1. Introduction VaultFrame exposes a complete, versioned REST API (`/api/v1/*`) allowing content creators and developers to automate media ingestion, query collections, manage folders, and audit storage.

#2. Generating API Keys To get started, go to your **Developer APIs** sidebar link or **Organization Settings -> Developer APIs** tab. Generate a cryptographically secure key with your required scope: * `read_only`: Fetch files, folders, and stats. * `upload`: Obtain upload-urls and push new assets. * `download`: Generate temporary pre-signed read URLs. * `full_access`: Perform all standard file/folder operations. * `admin`: Full developer administrative access.

Always include the key as a Bearer token in your Request headers: ``bash Authorization: Bearer vf_live_...

#3. API Rate Limiting API calls are rate-limited based on your subscription tier (e.g., Starter accounts get 1,000 requests per hour). Every API response includes limit monitoring headers: * `X-RateLimit-Limit`: Your total allowed window capacity. * `X-RateLimit-Remaining`: Remaining requests left in the active window. * `X-RateLimit-Reset`: Time remaining in seconds until the limit bucket refills.

#4. Direct Storage Webhooks You can register listener URLs to receive real-time, event-driven JSON notifications when assets change in your workspace. * **Events Supported**: `file.uploaded`, `file.deleted`, `file.restored`, `folder.created`, `folder.deleted`. * **Cryptographic Verification**: Every webhook post contains a header signature (`X-VaultFrame-Signature`). Securely verify it locally using HMAC-SHA256: ```javascript const signature = crypto.createHmac('sha256', secret).update(payloadString).digest('hex'); ```