u

docs/api/routes/vfs/delete.md

@@ -0,0 +1,42 @@
+# `DELETE /vfs/{*path}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Delete a virtual filesystem file
+
+Deletes a file from both the on-disk virtual filesystem and database for the authenticated user's selected company.
+Deleting read-only database files (`image/*` or filenames containing 64-character hex hashes) is blocked with HTTP 403.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `path` | yes | string | VFS file path to delete (e.g. `temp.png`, `notes.txt`) |
+
+## Signals
+
+On success, emits SSE signal: `vfs` (see [`GET /events`](../events.md)).
+
+## Response `200`
+
+File successfully deleted
+
+```json
+{
+  "success": true,
+  "deleted": "…"
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid path, path traversal, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized, or cannot delete read-only database files — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._