> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://developer.deel.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.deel.com/_mcp/server. # List Organization Secure Vault Folder Items GET https://api.letsdeel.com/rest/organizations/secure-vault/folders/{folder_id}/items Lists the files and sub-folders contained in a specific Organization Secure Vault folder. Use this endpoint to browse or paginate the contents of a single folder; to list items at the vault root instead, use the root-listing endpoint. **Token scopes**: `organizations:read` Reference: https://developer.deel.com/api/reference/endpoints/documents/list-organization-secure-vault-folder-items-v-2026-08-05 ## Authentication - `Authorization` header (bearer token, required) — ## Authentication The Deel API uses bearer tokens to authenticate requests. All API calls must be made over HTTPS — calls over plain HTTP or without authentication will fail. ```curl curl -X GET 'https://api.letsdeel.com/rest/v2/contracts' \ -H 'Authorization: Bearer YOUR-TOKEN-HERE' ``` [Learn more about authentication](/api/authentication) - `Authorization` header (bearer token, required) — Standard OAuth2 security scheme based on https://swagger.io/docs/specification/authentication/ ## Servers - `https://api.letsdeel.com/rest` (Production, default) - `https://api-staging.letsdeel.com/rest` (Demo) ## Request ### Path parameters - `folder_id` (string, required) — Public UUID of the folder. ### Query parameters - `limit` (integer, optional, default: 20) — Maximum number of results to return per page. - `cursor` (string, optional) — Pagination cursor returned by a previous response. - `search` (string, optional) — Free-text search on folder and file names. ## Response ### 200 Folder items returned successfully. - `data` (list of OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaDataItems, required) — Folders and files for this page. - `has_more` (boolean, required) — Whether another page of results is available. - `next_cursor` (string, required, nullable) — Cursor for the next page. Null when there are no more pages. - `total_count` (integer, required) — Total number of matching records. ## Errors ### 400 Bad Request Error Bad request — invalid or missing parameters. - `errors` (list of OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaErrorsItems, required) — List of errors that occurred while processing the request. ### 401 Unauthorized Error Unauthorized — missing or invalid authentication token. - `errors` (list of OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaErrorsItems, required) — List of errors that occurred while processing the request. ### 403 Forbidden Error Forbidden — the token lacks access to this resource. - `errors` (list of OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaErrorsItems, required) — List of errors that occurred while processing the request. ### 404 Not Found Error Not found. - `errors` (list of OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaErrorsItems, required) — List of errors that occurred while processing the request. ### 500 Internal Server Error Operation failed. - `request` (ApiErrorRequest, optional) - `errors` (list of ApiError, optional) ## Types ### OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaDataItems - `id` (string, required, nullable) — Public UUID of the folder or file. - `name` (string, required, nullable) — Folder name, or the original filename for a file. - `type` (enum, required) — Discriminates folders from files. - Allowed values: `FOLDER`, `FILE` - `folder_id` (string, optional, nullable) — Public UUID of the containing folder. Files only. - `item_type` (enum, optional, nullable) — Specific kind of folder or file. - Allowed values: `CUSTOM_FOLDER`, `REGISTRATION_DOC_FOLDER`, `DOCUMENTS_TO_SIGN_FOLDER`, `REGISTRATION_DOC_FILE`, `SECURE_FILE_VAULT_FILE`, `DOCUMENTS_TO_SIGN_FILE` - `created_at` (string, optional, nullable) — Creation timestamp. - `description` (string, optional, nullable) — Folder description. Null for files. - `uploaded_by` (OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaDataItemsUploadedBy, optional, nullable) — Who uploaded the file. Files only. - `content_type` (string, optional, nullable) — MIME type. Files only. - `is_sub_folder` (boolean, optional) — Whether the folder is nested under another folder. Folders only. - `parent_folder_id` (string, optional, nullable) — Parent folder public UUID. Folders only. ### OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaErrorsItems - `message` (string, required) — Human-readable explanation - `code` (string, optional) — Machine-readable error code - `field` (string, optional, nullable) — Field that caused the error, if applicable. ### ApiErrorRequest - `method` (string, optional) — The HTTP method of the failed request - `url` (string, optional) — The relative URL of the failed request - `status` (double, optional) — The status code of the response - `api_req_id` (string, optional) — The request ID of the failed request - `docs` (string, optional) — A link to the official documentation for the requested endpoint resource - `source` (string, optional) — The source handler which produced the returned error - `code` (double, optional) — The code of the source handler which produced the returned error ### ApiError - `message` (string, optional) — A description of the returned error - `path` (string, optional) — The JSON path where input validation failed ### OrganizationsSecureVaultFoldersFolderIdItemsGetResponsesContentApplicationJsonSchemaDataItemsUploadedBy Who uploaded the file. Files only. - `name` (string, optional) — Display name of the uploader. ## Examples **Response** ```json { "data": [ { "id": "c106a26a-21bb-5538-8bf2-57095d1976c1", "name": "Contracts", "type": "FOLDER", "folder_id": "f2d1b0c4-8a3e-4c11-9f77-2b6c5e1a90d3", "item_type": "CUSTOM_FOLDER", "created_at": "2026-08-05T12:00:00Z", "description": "Signed customer contracts", "uploaded_by": { "name": "John Doe" }, "content_type": "application/pdf", "is_sub_folder": false, "parent_folder_id": "f2d1b0c4-8a3e-4c11-9f77-2b6c5e1a90d3" } ], "has_more": true, "next_cursor": "eyJpZCI6MTIzfQ==", "total_count": 124 } ``` **SDK Code** ```python import requests url = "https://api.letsdeel.com/rest/organizations/secure-vault/folders/c106a26a-21bb-5538-8bf2-57095d1976c1/items" querystring = {"cursor":"eyJpZCI6MTIzfQ==","limit":"20","search":"contracts"} headers = {"Authorization": "Bearer "} response = requests.get(url, headers=headers, params=querystring) print(response.json()) ``` ```javascript const url = 'https://api.letsdeel.com/rest/organizations/secure-vault/folders/c106a26a-21bb-5538-8bf2-57095d1976c1/items?cursor=eyJpZCI6MTIzfQ%3D%3D&limit=20&search=contracts'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api.letsdeel.com/rest/organizations/secure-vault/folders/c106a26a-21bb-5538-8bf2-57095d1976c1/items?cursor=eyJpZCI6MTIzfQ%3D%3D&limit=20&search=contracts" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api.letsdeel.com/rest/organizations/secure-vault/folders/c106a26a-21bb-5538-8bf2-57095d1976c1/items?cursor=eyJpZCI6MTIzfQ%3D%3D&limit=20&search=contracts") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api.letsdeel.com/rest/organizations/secure-vault/folders/c106a26a-21bb-5538-8bf2-57095d1976c1/items?cursor=eyJpZCI6MTIzfQ%3D%3D&limit=20&search=contracts") .header("Authorization", "Bearer ") .asString(); ``` ```php request('GET', 'https://api.letsdeel.com/rest/organizations/secure-vault/folders/c106a26a-21bb-5538-8bf2-57095d1976c1/items?cursor=eyJpZCI6MTIzfQ%3D%3D&limit=20&search=contracts', [ 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api.letsdeel.com/rest/organizations/secure-vault/folders/c106a26a-21bb-5538-8bf2-57095d1976c1/items?cursor=eyJpZCI6MTIzfQ%3D%3D&limit=20&search=contracts"); var request = new RestRequest(Method.GET); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = ["Authorization": "Bearer "] let request = NSMutableURLRequest(url: NSURL(string: "https://api.letsdeel.com/rest/organizations/secure-vault/folders/c106a26a-21bb-5538-8bf2-57095d1976c1/items?cursor=eyJpZCI6MTIzfQ%3D%3D&limit=20&search=contracts")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```