Developers
APIs, keys and open formats
Iglubox is built on its own public API. The same endpoints are there for your scripts, your backup tools and your billing system.
Interfaces
Six ways in
REST API
Everything the apps do goes through one JSON API under /api/v1: files and folders, resumable uploads, sharing, versions, search. Errors carry a stable code besides the message.
Scoped API keys
Create keys in Settings → Security. A key is limited to areas — files, sharing, account — read-only or read and write, can expire, and is revoked in one click.
S3 endpoint
Signature Version 4, multipart uploads, versioning and Object Lock, for backup software, rclone, the AWS CLI and SDKs.
Connect with a code
Software that runs on someone else’s server never asks for a password: it shows a code, the person approves it in the web app, and it receives a key limited to what it asked for.
Backup agent API
Append-only uploads into a backup folder, resumable in parts with a SHA-256 on each, runs with statistics and findings. The server applies retention; an agent cannot delete.
Reseller API
Packages and customers for partners: create, suspend, change package, terminate, one-time sign-in links and usage.
Connect flow
A code instead of a password
Codes are eight characters, valid for 15 minutes. The person sees what is asking, from which address and for which permissions before approving, and can disconnect it later.
POST /api/v1/connect/requests
{ "app": "other", "name": "nas.example.org",
"scopes": ["backups.write", "backups.read"],
"backupSource": { "kind": "server", "name": "nas.example.org" } }
→ { "code": "BCDF-GHJK", "deviceToken": "…", "verificationUrl": "…/connect", "interval": 5 }
POST /api/v1/connect/token { "deviceToken": "…" } (every 5 seconds)
→ { "status": "approved", "apiKey": "igx_…" } (handed out once)Backup repository format, version 1
Backups you can read without our software
Content is cut into chunks of at most 8 MiB, each stored once as its own gzip member inside a pack. A snapshot lists every file with the chunks that make it up, so any snapshot restores alone and unchanged data is never sent twice.
To restore by hand: read the list of an item, and for every file concatenate its chunks — a byte range of a pack, gunzipped — then check the SHA-256. The full description ships with the software (docs/integrations/backup-format.md) and with every plugin’s source.
[ "<pack id>", <offset>, <compressed length>, <raw length>, "<sha256 of the chunk>" ]
packs/<id>.pack concatenated gzip members
snapshots/<run>/index.json the items of a backup
snapshots/<run>/items/<item>.jsonl.gz one JSON line per file