# `DELETE /vfs/{*path}`

Protected. Requires a valid session cookie (`credentials: 'include'`).

Delete a virtual filesystem file

Deletes a file from both the on-disk virtual filesystem and database for the authenticated user's selected company.
Deleting read-only database files (`image/*` or filenames containing 64-character hex hashes) is blocked with HTTP 403.


## Path parameters

| Param | Required | Type | Description |
|-------|----------|------|-------------|
| `path` | yes | string | VFS file path to delete (e.g. `temp.png`, `notes.txt`) |

## Signals

On success, emits SSE signal: `vfs` (see [`GET /events`](../events.md)).

## Response `200`

File successfully deleted

```json
{
  "success": true,
  "deleted": "…"
}
```

## Errors

| Status | Description |
|--------|-------------|
| 400 | Invalid path, path traversal, or no company selected — `{"error":"…"}` |
| 401 | Unauthorized — `{"error":"…"}` |
| 403 | Not authorized, or cannot delete read-only database files — `{"error":"…"}` |

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._