Folders

Restore a deleted folder

POST/folders/{id}/actions/restore
documents:writerestore_folder

Brings a deleted folder back, with the subfolders and documents deleted with it (same deletion timestamp; same-second deletes merge, best effort), and returns it. Starts deleted, ends live. Permissions are rebased on the live parent. A live folder returns 200 unchanged, with no event. 409 folder_name_taken, folder_deleted (parent deleted) or invalid_state (a root). Needs write access to the folder, else 403 forbidden. Emits folder.restored after commit; no email. DELETE /folders/{id} undoes it.

Path parameters

  • idstring (uuid)Required#

    The record's id.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Responses

200

The restored folder.

Folder
{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "name": "string",
    "parent_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "path": "string",
    "deal_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "namespace": "attachment.sig.root",
    "type_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "locked": true,
    "hidden": true,
    "pinned": true,
    "released": true,
    "access": {
      "internal_users": true,
      "deal_managers": true,
      "file_uploaders": true,
      "entrepreneurs": true
    },
    "metadata": {},
    "permissions": {},
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is forbidden when the token's user can't write the folder: any folder in the tree of a deal the token can see is writable, otherwise the folder's write list, write flags or super admin are needed. This is deliberately broader than the platform (no editor-role check) and stricter (the check applies where the platform skips it by role). Other codes are missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The request conflicts with the folder's state. error.code is folder_name_taken (a live sibling has the name), folder_locked (the folder or its parent is locked), folder_cycle (a move into itself or a subfolder), folder_deleted (the parent is deleted) invalid_state (a root folder, which can't be deleted or restored) or conflict (on delete: the folder or a subfolder holds a file a deal or team member uses as an image).

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/folders/{id}/actions/restore\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"