Every API here is available over the APIs.io API and to AI agents over MCP.
{
"swagger": "2.0",
"info": {
"version": "1",
"title": "MOVEit Transfer REST API",
"x-swagger-net-version": "8.5.28.001",
"x-logo": {
"url": "images/MOVEitLogo.svg"
},
"description": "**Release 2025.1**, **version 17.01** \n\n\n *MOVEit securely collects, stores, manages, and distributes information within organizations, between businesses, and more...*\n\n \n \n > **Important!**\n The REST API is an optionally licensed feature that runs at the MOVEit Transfer Server. It is subject to the terms of \n the [MOVEit Transfer End User License Agreement](https://www.progress.com/legal/license-agreements/progress-ipswitch).\n\n\n \n \n\n \n \n Overview\n\n ========\n\n \n The REST API enables you to develop, integrate, and deploy applications that need secure data and managed file transfer as part of their workflow.\n Feeding or saving files with data governed by data security standards such as HIPAA, PCI, GDPR, and more are some obvious examples where this would be necessary.\n\n \n Using the Transfer REST API (instead of the Transfer .NET or Java API)\n enables you to connect systems and clients to MOVEit Transfer using\n simple HTTP calls. In general, REST APIs are language and platform\n independent and can be your best choice to converge information systems,\n circumvent the unending need for client-server dependency maintenance,\n and span any combination of environments (including IoT, mobile, and\n much more).\n\n \n > **Tip**\n The REST API is mapped to run at\n [https://<your-transfer-server>/api/v1/](https://<your-transfer-server>/api/v1/)).\n --Where <your-transfer-server> is the host where your MOVEit Transfer Server is running. \n\n\n \n \n > **Note**\n In general, this RESTful API expects the following verbs: GET (query\n record), POST (create/delete record), PATCH (batch modify/update record), or\n DELETE (remove record).\n\n\n \n <table>\n <colgroup>\n <col style=\"width: 9%\" />\n <col style=\"width: 36%\" />\n <col style=\"width: 54%\" />\n </colgroup>\n <thead>\n <tr class=\"header\">\n <th></th>\n <th>This REST Endpoint</th>\n <th>Provides These Resources</th>\n </tr>\n </thead>\n <tbody>\n <tr class=\"odd\">\n <td><p>1.</p></td>\n <td><p><a href=\"#operation/Auth_GetToken\"><code>/api/v1/token</code></a></p></td>\n <td><p>Manage Access Tokens and Multi-factor Authentication (one-time passwords).</p></td>\n </tr>\n <tr class=\"even\">\n <td><p>2.</p></td>\n <td><p><a href=\"#operation/GETapi%2Fv1%2Fusers%2F%7BId%7D-1.0\"><code>/api/v1/users</code></a><br />\n <a href=\"#operation/GETapi%2Fv1%2Fgroups%3FPage%3D%7BPage%7D%26PerPage%3D%7BPerPage%7D-1.0\"><code>/api/v1/groups</code></a></p></td>\n <td><p>Create and manage users and groups, roles, home folders, and other properties.</p></td>\n </tr>\n <tr class=\"odd\">\n <td><p>3.</p></td>\n <td><p><a href=\"#operation/GETapi%2Fv1%2Ffolders-1.0\"><code>/api/v1/folders</code></a></p></td>\n <td><p>Folders, folder actions, and folder contents.</p></td>\n </tr>\n <tr class=\"even\">\n <td><p>4.</p></td>\n <td><p><a href=\"#operation/GETapi/v1/mailboxes-1.0\"><code>/api/v1/mailboxes</code></a></p></td>\n <td><p>Manage mailboxes.</p></td>\n </tr>\n <tr class=\"odd\">\n <td><p>5.</p></td>\n <td><p><a href=\"#tag/Files\"><code>/api/v1/files</code></a></p><p><a href=\"#tag/Packages\"><code>/api/v1/packages</code></a></p></td>\n <td><p>Manage files and manage packages.</p></td>\n </tr>\n <tr class=\"even\">\n <td><p>6.</p></td>\n <td><p><a href=\"#tag/TransferStatus\"><code>/api/v1/xferstatus</code></a></p></td>\n <td><p>Get status and summaries for ongoing and recently completed transfers.</p></td>\n </tr>\n <tr class=\"odd\">\n <td><p>7.</p></td>\n <td><p><a href=\"#tag/OrganizationInfo\"><code>/api/v1/info</code></a></p></td>\n <td><p>Get information about a MOVEit organization.</p></td>\n </tr>\n <tr class=\"even\">\n <td><p>8.</p></td>\n <td><p><a href=\"#operation/POSTapi%2Fv1%2Ffolders%2F%7BId%7D%2Facls-1.0\"><code>/api/v1/folders/{ID}/acls/</code></a></p></td>\n <td><p>Manage folder permissions.</p></td>\n </tr>\n <tr class=\"odd\">\n <td><p>9.</p></td>\n <td><p><a href=\"#operation/PATCHapi%2Fv1%2Ffolders%2F%7BId%7D%2Facls%2F%7BaclsId%7D-1.0\"><code>/api/v1/folders/{Id}/acls/{aclsId}</code></a></p></td>\n <td><p>Manage folder permissions for a particular user or group.</p></td>\n </tr>\n <tr class=\"even\">\n <td><p>10.</p></td>\n <td><p><a href=\"#tag/Packages\"><code>/api/v1/packages/{Id}</code></a></p></td>\n <td><p>Full operations set for packages.</p></td>\n </tr>\n <tr class=\"odd\">\n <td><p>11.</p></td>\n <td><p><a href=\"#tag/Contacts\"><code>/api/v1/contacts/{Id}</code></a></p></td>\n <td><p>Full operations set for contacts.</p>\n <tr class=\"even\">\n <td><p></p></td>\n <td><p><a href=\"#section/Before-You-Begin/Interactive-REST-API-Client-Swagger-UI\"><code>/swagger</code></a></p></td>\n <td><p>Live Swagger UI interactive documentation (MOVEit Transfer installation required).</p></td>\n </tr>\n </tbody>\n </table>\n \n \nBefore You Begin\n\n ================\n\n \n Before you begin using the MOVEit Transfer RESTful API, you will need\n the following:\n \n - The hostname for a deployed MOVEit Transfer system.\n \n - The API endpoint needs to be exposed through the web.config file.\n \n - Username and password for a user on the target MOVEit Transfer\n system.\n \n - Your favorite HTTP client (the examples that follow use the cURL\n utility).\n \n <table>\n <colgroup>\n <col style=\"width: 21%\" />\n <col style=\"width: 42%\" />\n <col style=\"width: 35%\" />\n </colgroup>\n <thead>\n <tr class=\"header\">\n <th>Listener</th>\n <th>URL</th>\n <th>Purpose</th>\n </tr>\n </thead>\n <tbody>\n <tr class=\"odd\">\n <td><p>Swagger UI</p></td>\n <td><p><a href=\"https://<your-transfer-server>/swagger\">https://<your-transfer-server>/swagger</a></p></td>\n <td><p>Browsable/interactive UI service available for exercising the REST API.</p></td>\n </tr>\n <tr class=\"even\">\n <td><p>REST API</p></td>\n <td><p><a href=\"https://<your-transfer-server>/api/v1/\">https://<your-transfer-server>/api/v1/</a></p></td>\n <td><p>Primary REST API Endpoint.</p></td>\n </tr>\n </tbody>\n </table>\n \n \nExposing the endpoint from the MOVEit Transfer Host's web.config File\n\n\t\t ------------------------\n\n\t\t \n\t\t By default, the Swagger endpoint is not visible. To make it visible, comment out the following directive in Web.config instruction file. \n\t\t For example:\n\n\t\t \n\t\t \n\t\t ```\n\n {\n\n <hiddenSegments>\n\n <!-- <add segment=\"swagger\" /> -->\n\n </hiddenSegments>\n\n }\n\n ```\n\n \n > **Note**\n\n\t\t The default location of Web.config is `C:\\Program files\\MOVEit Transfer\\wwwroot\\`. \n\n \n \nA quick check of the API\n\n ------------------------\n\n \n If you are unsure whether or not the REST API is already listening for\n requests on a MOVEit Transfer host, here is a quick check. Type into\n your web browser `https://<your-transfer-server>/api/v1/token`. (Where\n `<your-transfer-server>` is the hostname of the MOVEit Transfer system.)\n If this call returns a simple JSON object, your API is running, and you\n can begin the steps that follow using this hostname. \n\n \n > **Tip**\n\n \n You can also use the Swagger spec object\n (`https://<your-transfer-server>/api/v1/swagger`) in tools such as\n Postman, Swagger Inspector, and more.\n\n \n Interactive REST API Client - Swagger UI\n\n ----------------------------------------\n\n \n Swagger UI libraries integrated with MOVEit Transfer at install time\n provide the following:\n \n - A way to browse the MOVEit Transfer REST documentation with live\n examples.\n \n - A simple development client for testing MOVEit Transfer REST calls.\n \n > **Caution**\n \n The examples are live calls (not simulated) that run against your\n database. If you are just testing and exploring the capabilities of\n The REST API for development purposes, it is best practice to run\n against a non-production instance of MOVEit Transfer.\n\n \n To open the interactive MOVEit Transfer REST client:\n \n 1. Open a browser to `https://my-transfer-host/swagger/` --Where\n `my-transfer-host` is the host where you installed MOVEit Transfer\n \n 2. Browse and build queries and view JSON result objects.\n \n \n\n\n \n \nGetting Started\n\n ===============\n\n \n This section walks you through how to fetch user properties for the\n current user.\n \n > **Tip**\n If you are running an API token request against a non-production host\n with a self-signed SSL certificate needed to run HTTPS, remember to\n set the flag to ignore the self-signed certificate warning. (In the\n cURL example shown below this is the `-k` option.)\n\n\n \n To set your session up with the MOVEit Transfer RESTful API, you must\n retrieve an access token. (Syntax, usage, and fields supported by the\n token endpoint are detailed in [Retrieve API Token](#_auth_gettoken) and\n [Revoke API token](#_auth_revoketoken).)\n\n \n ```\n\n curl -k --request POST --url https://your-transfer-server/api/v1/token --data \"grant_type=password&username=emmacurtis&password=1a2B3cA1b2C3\"\n\n ```\n\n \n \nExample Output\n\n ----------------\n\n \n ```\n\n {\n\n \t\"access_token\": \"X03w.....dziTwmA\",\n\n \t\"token_type\": \"bearer\",\n\n \t\"expires_in\": 86399,\n\n \t\"refresh_token\": \"X03w.....dziTwmA\"\n\n }\n\n ```\n\n \n --Where `your-transfer-server` is the hostname where your MOVEit\n Transfer WebUI is running.\n\n --And, where you supply values for the username and password (such as\n the MOVEit user you created for this RESTful client application).\n\n \n Now, pass the access token as a header argument, type \"Bearer\" and get your user information.\n\n \n ```\n\n curl -H \"Authorization: Bearer X03w.....dziTwmA\" \"https://your-transfer-server/api/v1/users/self\"\n\n ```\n\n \n --Where `your-transfer-server` is the hostname where your MOVEit\n Transfer WebUI is running. \n\n --And, where you should replace the placeholder string `X03wÂ…?..dziTwmA`\n with your 278 Byte access token.\n\n \n Example Output\n\n ----------------\n \n ```{\n\n \t\"emailFormat\": \"HTML\",\n\n \t\"notes\": \"\",\n\n \t\"statusNote\": \"\",\n\n \t\"passwordChangeStamp\": \"2017-04-17T09:36:47\",\n\n \t\"receivesNotification\": \"ReceivesNotifications\",\n\n \t\"forceChangePassword\": false,\n\n \t\"folderQuota\": 0,\n\n \t\"authMethod\": \"MOVEitOnly\",\n\n \t\"language\": \"en\",\n\n \t\"homeFolderID\": 377392666,\n\n \t\"defaultFolderID\": 377392666,\n\n \t\"expirationPolicyID\": 0,\n\n \t\"displaySettings\": {\n\n \t\t\"userListPageSize\": 10,\n\n \t\t\"fileListPageSize\": 100,\n\n \t\t\"liveViewPageSize\": 25,\n\n \t\"id\": \"axaxfbz5v85l7dp1\",\n\n \t\"orgID\": 9683,\n\n \t\"username\": \"org1admin\",\n\n \t\"realname\": \"Denise Taylor\",\n\n \t\"permission\": \"Admin\",\n\n \t\"email\": \"dtaylor@example.com\",\n\n \t\"status\": \"Active\",\n\n \t\"lastLoginStamp\": \"2018-04-06T16:13:50\"\n\n }\n\n ```\n\n \n Now, use the homeFolderID value (`311392888`) and get a list of files in\n the folder.\n\n \n ```\n\n curl -H \"Authorization: Bearer your-access-token\" \"https://your-transfer-server/api/v1/folders/311392888/files\"\n\n ```\n\n \n \nExample Output\n\n ----------------\n\n \n ```\n\n {\n\n \"items\": [\n\n \t{\n\n \t \"id\": \"455123456\",\n\n \t \"name\": \"iMacros-for-Chrome-File-Access-Setup-Mac.dmg\",\n\n \t \"path\": \"/Home/org1admin/iMacros-for-Chrome-File-Access-Setup-Mac.dmg\",\n\n \t \"fileSize\": 4454619,\n\n \t \"uploadStamp\": \"2018-02-08T14:48:08\"\n\n },\n\n {\n\n \t \"id\": \"455123455\",\n\n \t \"name\": \"MOVEit-Client-0.1.0-mac.zip\",\n\n \t \"path\": \"/Home/org1admin/MOVEit-Client-0.1.0-mac.zip\",\n\n \t \"fileSize\": 61725986,\n\n \t \"uploadStamp\": \"2018-02-08T08:58:45\"\n\n }\n\n ],\n\n \t \"currentPage\": 1,\n\n \t \"totalItems\": 2,\n\n \t \"itemsPerPage\": 25,\n\n \t \"sorting\": [\n\n \t{\n\n \t \"sortField\": \"name\",\n\n \t \"sortDirection\": \"asc\"\n\n \t}\n\n ]\n\n }\n\n ```\n\n\n \n \nHandling Session Tokens\n\n =======================\n\n \n Before you can be authorized to access MOVEit Transfer resources using\n this RESTful API, you must request an access token. Only authenticated\n clients can fetch or renew an access token.\n\n \n Request/refresh an access token\n\n -------------------------------\n\n \n HTTPS sessions with MOVEit Transfer begin with a token request. It must\n be sent as an HTTP POST.\n\n \n ```\n\n POST /api/v{version}/token\n\n ```\n\n \n ### *Request Example*\n \n > **Tip**\n If you are running an API token request against a non-production host\n with a self-signed SSL certificate needed to run HTTPS, remember to\n set the flag to ignore the self-signed certificate warning. (In the\n cURL example shown below this is the `-k` option.)\n\n \n ```\n\n curl -k --request POST --url https://mydmzserver/api/v1/token --data \"grant_type=password&username=${username}&password=${password}\"\n\n ```\n\n \n\n \n --Where `mydmzserver` is the hostname where your MOVEit Transfer WebUI\n is running.\n\n \n --And, where `${username}` and `${password}` are the username and\n password you created for the current client application.\n\n \n > **Note**\n For logging purposes, it is best practice to create a new API user\n using the MOVEit Transfer WebUI.\n \n ### *Refresh Example*\n \n ```\n\n curl -X POST https://mydmzserver/api/v1/token -H \"accept: application/json\" -H \"Content-Type: application/x-www-form-urlencoded\" -d \"grant_type=refresh_token&refresh_token=${refresh-token}\"\n\n ```\n\n \n \n--Where `mydmzserver` is the hostname where your MOVEit Transfer WebUI is running.\n\n --And, where `${refresh-token}` is the token received from the last authenticated token request (this request must be submitted within the allowed expiration period).\n\n \n > **Tip**\n Token expiration duration is determined by client session properties configured at the MOVEit Transfer Server.\n\n \n \nToken response messages\n\n -----------------------\n\n \n Response Content Type: application/json\n \n <table>\n <colgroup>\n <col style=\"width: 21%\" />\n <col style=\"width: 14%\" />\n <col style=\"width: 64%\" />\n </colgroup>\n <thead>\n <tr class=\"header\">\n <th>HTTP Status Code</th>\n <th>Meaning</th>\n <th>Response Model</th>\n </tr>\n </thead>\n <tbody>\n <tr class=\"odd\">\n <td><p><strong>200</strong></p></td>\n <td><p>SUCCESS</p></td>\n <td><p><code>{\n \"access_token\": \"_acaxffz2p3cl1ek8Â…?\",\n \"token_type\": \"bearer\",\n \"expires_in\": 86399,\n \"refresh_token\": \"_ACAXFFZ2P3CL1EK8UÂ…?\",\n }</code><br />\n </p></td>\n </tr>\n <tr class=\"even\">\n <td><p><strong>400</strong></p></td>\n <td><p>BAD REQUEST</p></td>\n <td><p><code>{\n \"error\": \"invalid_grant\",\n \"error_description\": \"Invalid username/password or not allowed to sign on from this location.\"\n }</code><br />\n </p></td>\n </tr>\n </tbody>\n </table>\n \n \nUse token in request\n\n --------------------\n\n \n After you get your session token you can use the token in subsequent\n requests. You pass the token in the HTTP header as type `Bearer`. For\n example, to get information such as user directory, name, user ID, and\n more for the current user, you would send this cURL GET request that\n passes the token using the `-H` option.\n\n \n ### *Example*\n \n ```\n\n curl -H \"Authorization: Bearer X03w....dziTwmA\" \"https://mydmzserver/api/v1/users/self\"\n\n ```\n\n \n \n--Where `mydmzserver` is the hostname where your MOVEit Transfer WebUI is running.\n \n "
},
"host": "127.0.0.1",
"schemes": [
"https"
],
"paths": {
"/api/v1/settings/adhoctransfer/maintenance/agingexpiration": {
"get": {
"tags": [
"AdHocTransferSettings"
],
"summary": "Get aging and expiration in the organization",
"operationId": "GETapi/v1/settings/adhoctransfer/maintenance/agingexpiration-1.0",
"consumes": [],
"produces": [
"application/json",
"text/json",
"application/problem+json"
],
"parameters": [],
"responses": {
"200": {
"description": "OK",
"schema": {
"$ref": "#/definitions/AdHocTransferAgingExpirationModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
},
"500": {
"description": "Server Error",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
}
},
"security": [
{
"Authorization": []
}
]
}
},
"/api/v1/settings/appearance/brand/logos": {
"post": {
"tags": [
"AppearanceSettings"
],
"summary": "Update the organization branding logos.",
"description": "The content type of the request must be \"multipart/form-data\".",
"operationId": "POSTapi/v1/settings/appearance/brand/logos-1.0",
"consumes": [
"multipart/form-data"
],
"produces": [
"application/json",
"text/json",
"application/problem+json"
],
"parameters": [
{
"name": "leftlogo",
"in": "formData",
"description": "Left logo file",
"required": false,
"type": "file"
},
{
"name": "rightlogo",
"in": "formData",
"description": "Right logo file",
"required": false,
"type": "file"
},
{
"name": "backgroundlogo",
"in": "formData",
"description": "Header background logo file",
"required": false,
"type": "file"
},
{
"name": "usecustomnotifbranding",
"in": "formData",
"description": "Whether to enable or disable custom notification branding (1 or 0)",
"required": false,
"type": "string"
},
{
"name": "resetrightlogo",
"in": "formData",
"description": "When set to 1, resets the right logo to an empty image",
"required": false,
"type": "string"
},
{
"name": "resetbackgroundlogo",
"in": "formData",
"description": "When set to 1, resets the header background logo to an empty image",
"required": false,
"type": "string"
}
],
"responses": {
"200": {
"description": "OK",
"schema": {
"$ref": "#/definitions/LogosModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
},
"422": {
"description": "Invalid Request Parameters",
"schema": {
"$ref": "#/definitions/UnprocessableEntityErrorModel"
}
},
"500": {
"description": "Server Error",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
}
},
"security": [
{
"Authorization": []
}
]
}
},
"/api/v1/auth/identityproviders": {
"get": {
"tags": [
"Authentication"
],
"summary": "Get list of identity providers in the organization",
"operationId": "GETapi/v1/auth/identityproviders?Page={Page}&PerPage={PerPage}&SortField={SortField}&SortDirection={SortDirection}&OrgId={OrgId}-1.0",
"consumes": [],
"produces": [
"application/json",
"text/json",
"application/problem+json"
],
"parameters": [
{
"name": "page",
"in": "query",
"description": "Page number to display",
"required": false,
"type": "integer",
"format": "int32"
},
{
"name": "perPage",
"in": "query",
"description": "Items per page in result collection; Default is 25",
"required": false,
"type": "integer",
"format": "int32"
},
{
"name": "sortField",
"in": "query",
"description": "Name of field to sort the results by. (name); Default is Name.",
"required": false,
"type": "string"
},
{
"name": "sortDirection",
"in": "query",
"description": "Sort direction; Default is ascending.",
"required": false,
"type": "string"
},
{
"name": "orgId",
"in": "query",
"description": "Organization Id.",
"required": false,
"type": "integer",
"format": "int32"
}
],
"responses": {
"200": {
"description": "OK",
"schema": {
"$ref": "#/definitions/PagedModelOfPublicIdPInformationModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
},
"500": {
"description": "Server Error",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
}
},
"security": [
{
"Authorization": []
}
]
}
},
"/api/v1/auth/actasadmin": {
"post": {
"tags": [
"Authentication"
],
"summary": "Become administrator in specific organization",
"operationId": "POSTapi/v1/auth/actasadmin-1.0",
"consumes": [
"application/json",
"text/json",
"application/problem+json"
],
"produces": [
"application/json",
"text/json",
"application/problem+json"
],
"parameters": [
{
"name": "request",
"in": "body",
"required": true,
"schema": {
"$ref": "#/definitions/OrgRequest"
}
}
],
"responses": {
"200": {
"description": "OK",
"schema": {
"$ref": "#/definitions/ActAsAdminDto"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
},
"500": {
"description": "Server Error",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
}
},
"security": [
{
"Authorization": []
}
]
}
},
"/api/v1/contacts": {
"get": {
"tags": [
"Contacts"
],
"summary": "List contacts",
"operationId": "GETapi/v1/contacts?SearchString={SearchString}&OnBehalfOf={OnBehalfOf}&Page={Page}&PerPage={PerPage}&SortField={SortField}&SortDirection={SortDirection}-1.0",
"consumes": [],
"produces": [
"application/json",
"text/json",
"application/problem+json"
],
"parameters": [
{
"name": "searchString",
"in": "query",
"description": "Search String. The Name and Email values will be searched.",
"required": false,
"type": "string"
},
{
"name": "onBehalfOf",
"in": "query",
"description": "User to get contacts on behalf of.",
"required": false,
"type": "string"
},
{
"name": "page",
"in": "query",
"description": "Page number to display",
"required": false,
"type": "integer",
"format": "int32"
},
{
"name": "perPage",
"in": "query",
"description": "Items per page in result collection; Default is 25",
"required": false,
"type": "integer",
"format": "int32"
},
{
"name": "sortField",
"in": "query",
"description": "Name of field to sort the results by. (email, name); Default is Name.",
"required": false,
"type": "string"
},
{
"name": "sortDirection",
"in": "query",
"description": "Sort direction; Default is ascending.",
"required": false,
"type": "string"
}
],
"responses": {
"200": {
"description": "OK",
"schema": {
"$ref": "#/definitions/PagedModelOfContactModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
},
"500": {
"description": "Server Error",
"schema": {
"$ref": "#/definitions/ErrorModel"
}
}
},
"security": [
{
"Authorization": []
}
]
},
"post": {
"tags": [
"Contacts"
],
"summary": "Creat
# --- truncated at 32 KB (352 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/progress-software/refs/heads/main/openapi/progress-software-moveit-transfer-openapi-original.json