# `PUT /vfs/{*path}`

Protected. Requires a valid session cookie (`credentials: 'include'`).

Create or overwrite a virtual filesystem file

Creates or overwrites a file at the specified virtual filesystem path for the authenticated user's selected company.
Supports multiple request payload formats:
- JSON body: `{"content": "text content", "mime": "optional/mime"}`
- Binary body: raw binary buffer with optional `Content-Type` header
- Plain text: raw UTF-8 string

Modifying read-only database paths (`image/*` or filenames containing 8-character image hashes) is blocked with HTTP 403.


## Path parameters

| Param | Required | Type | Description |
|-------|----------|------|-------------|
| `path` | yes | string | Destination VFS file path (e.g. `notes.txt`, `data/metrics.json`) |

## Body (JSON)

| Field | Required | Type | Description |
|-------|----------|------|-------------|
| `content` | yes | string | File text content |
| `mime` | no | string | Optional MIME type override |

```json
{
  "content": "…",
  "mime": "…"
}
```

## Signals

On success, emits SSE signal: `vfs` (see [`GET /events`](../events.md)).

## Response `200`

File successfully written

```json
{
  "success": true,
  "file": {
    "name": "…",
    "size": 1,
    "mime": "…",
    "updated_at": "2026-08-10T00:00:00.000Z"
  }
}
```

## Errors

| Status | Description |
|--------|-------------|
| 400 | Path is required, invalid characters/traversal, no content provided, or no company selected — `{"error":"…"}` |
| 401 | Unauthorized — `{"error":"…"}` |
| 403 | Not authorized, or cannot modify read-only database files — `{"error":"…"}` |

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._