List vault folders
Every folder the creator has, alphabetically. **Unpaginated** — you always get the full list.
/api/external/vault/foldersEvery folder the creator has, alphabetically. Unpaginated — you always get the full list.
itemCount here counts every non-hidden item regardless of moderation status, so it can be higher than the count the vault list reports for the same folder (which respects the moderation filter).
Authentication
Send the creator's API key as a bearer token: Authorization: Bearer dpfn_…. See Authentication & API keys.
An agency's own key can call this for a creator it manages by adding X-Dropfans-Account: <account id> (needs canManageVault). See Agencies.
Responses
| Name | Type | Description | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
folders | Folder[] | Every folder, A→Z.Show child attributes
|
{
"folders": [
{
"id": "clxf0ld3r0001abcd",
"name": "Beach set",
"itemCount": 14
}
]
}Errors
| Status | Body | When |
|---|---|---|
| 401 | {"error":"Unauthorized","code":"unauthorized"} | Missing or invalid API key. |
| 500 | {"error":"Failed to fetch vault folders"} | Query failed — retry later. |
| 400 | {"error":"X-Dropfans-Account must be an account id (from GET /api/external/agency/creators), not a username.","code":"invalid_account_header"} | `X-Dropfans-Account` is not an account id. |
| 403 | {"error":"This key cannot act for that account.","code":"account_not_managed"} | `X-Dropfans-Account` names an account this key cannot act for: not an agency’s own key, no ACCEPTED management, or the agency or account is suspended, banned or deleted (an unknown id gets the same answer). |
| 403 | {"error":"The agency does not have permission for this on that account.","code":"permission_denied","permission":"canManageVault"} | With `X-Dropfans-Account`: the agency lacks `canManageVault` on that account. |
Rate limiting
Every response carries the X-RateLimit-Tier header and, on limited tiers, the per-minute and per-day trios — read X-RateLimit-Remaining and X-RateLimit-Reset instead of hardcoding limits. Details in Rate limits.
Code samples
curl "https://www.dropfans.io/api/external/vault/folders" \
-H "Authorization: Bearer $DROPFANS_API_KEY"const res = await fetch(`https://www.dropfans.io/api/external/vault/folders`, {
headers: {
Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
},
});
console.log(await res.json());import os
import requests
res = requests.get(
"https://www.dropfans.io/api/external/vault/folders",
headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
)
print(res.json())Questions? [email protected]