Platform

API, Webhooks & Zapier

Automate DRIVUNO without weakening it. Credentials grant access to metadata and lifecycle events; file contents stay encrypted under keys only your devices hold.

The zero-knowledge rule for automation

A server-side API key cannot decrypt your files, because DRIVUNO never holds the keys that could. Everything the API returns — identifiers, sizes, folder structure, timestamps, versions — is metadata we already store. File and folder names are encrypted on your device and are returned as name_encrypted: true. Any workflow that needs the actual content must run where a key exists: in your browser session, or through an explicitly delegated folder key.

Authentication

Create a key in the app under API & Webhooks. Keys are shown once, stored only as a SHA-256 hash, scoped, optionally expiring, and revocable at any time. Rate limit: 600 requests per minute per key.

curl https://drivuno.com/api/public/v1/me \
  -H "Authorization: Bearer dvk_live_..."

Endpoints

GET /api/public/v1/me

Credential test. Returns account id, scopes, API version.

GET /api/public/v1/files

File metadata. Supports limit, since, cursor, folder_id. Scope files:read.

GET /api/public/v1/folders

Folder tree metadata. Scope folders:read.

/api/public/v1/subscriptions

REST-hook subscribe (POST), list (GET), unsubscribe (DELETE). Scopes events:read / webhooks:write.

Webhooks

Register an HTTPS endpoint and DRIVUNO posts a signed JSON event on file.uploaded, file.trashed, file.shared, folder.created, member.added and room.message. Failed deliveries are retried once, logged, and an endpoint failing persistently is auto-disabled.

POST https://your-endpoint.example.com/drivuno
X-Drivuno-Event: file.uploaded
X-Drivuno-Signature: t=1754140800,v1=9f2c...

{
  "id": "5f2c...",
  "event": "file.uploaded",
  "created_at": "2026-08-02T14:00:00.000Z",
  "data": {
    "file_id": "0f0c...",
    "folder_id": "6b21...",
    "ciphertext_size": 10485760,
    "version": 1,
    "encrypted": true
  }
}

Verifying a signature

The header is t=<unix>,v1=<hex>, where the HMAC-SHA256 is computed over `${t}.${rawBody}` using your endpoint's signing secret. Reject anything older than five minutes.

import crypto from "node:crypto";

function verify(rawBody, header, secret) {
  const [tPart, v1Part] = header.split(",");
  const t = tPart.slice(2);
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const got = v1Part.slice(3);
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(got))
    && Math.abs(Date.now() / 1000 - Number(t)) < 300;
}

Zapier & Make

Both platforms are supported through the REST-hook subscription endpoint: Zapier subscribes on Zap activation and unsubscribes on deactivation, so no polling is needed. Use API key authentication with /api/public/v1/me as the connection test. No listed Zapier app is required — see the step-by-step Zapier guide to go live today.

# Subscribe (Zapier does this automatically)
curl -X POST https://drivuno.com/api/public/v1/subscriptions \
  -H "Authorization: Bearer dvk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"target_url":"https://hooks.zapier.com/hooks/catch/123/abc","event":"file.uploaded"}'

# Unsubscribe
curl -X DELETE "https://drivuno.com/api/public/v1/subscriptions?id=<subscription-id>" \
  -H "Authorization: Bearer dvk_live_..."

Errors

JSON errors with stable codes: unauthorized (401), forbidden (403, missing scope), rate_limited (429, with Retry-After), invalid_target_url / invalid_event (400), internal_error (500).

Questions on integration scoping or an enterprise workflow? info@drivuno.com.