Get the CRM1 Files table · Fieldmotion API

When to use this endpoint

Use Files_getDT only for the legacy DataTables contract. CRM2 uses Files_getDataTable.

Authentication and permissions

Normal requests require signed API-key authentication or a logged-in CRM session and are scoped to that tenant. In CRM2, ordinary file types additionally require view permission on pageFiles; CRM1 does not apply that page permission.

File type 10 is always denied by the shared read guard. Types 6, 8, and 16 bypass that guard’s session/page-files checks, while types 6, 7, and 9 bypass only its CRM2 page check after login. Routes that explicitly call the login guard still require login, and download routes still need a resolvable tenant context. A separately established shareable-link context may also bypass the shared read guard.

Parameters

Parameter	Type	Required	Description
`start`	Integer-compatible	Yes	Zero-based offset. This is validated before login.
`length`	Integer-compatible	Effectively yes	SQL page size. Missing becomes zero and can cause an empty/erroring page depending on SQL handling.
`draw`	Integer-compatible	No	Echoed as an integer.
`order[0][column] / order[0][dir]`	Integer / string	Effectively yes	Column `1` sorts creation date, `2` filename, others creation date. Exact `desc` selects descending.
`search[value]`	String	No	Case-insensitive substring across notes, description, raw metadata, and filename.
`type_enum / type_id`	Integer-compatible	No	Exact relationship filters. For Customer type `0` with a nonzero ID, direct parent Customer files flagged for site sharing are also included.

Example request

$table = FM_api('Files_getDT', [
	'draw' => '1',
	'start' => '0',
	'length' => '25',
	'order' => [['column' => '1', 'dir' => 'desc']],
	'search' => ['value' => 'service'],
	'type_enum' => '3',
	'type_id' => '7712',
]);

Example response

{
  "draw": 1,
  "iTotalRecords": "4",
  "iTotalDisplayRecords": "2",
  "data": [
    [4821, "2026-09-20 10:15:00", "service-photo.jpg", "created by ...", [0,1,1,0,0], "Notes", "", "service", 0]
  ]
}

Each row is [id,cdate,filename,description,options,notes,blank,tags,originTenant]. Options are customer-readable, include-in-email, show-in-portal, edit-notes-in-portal, and share-with-sites; outsourced rows omit the fifth option.

For Job files, linked outsourcing metadata can append rows read from another tenant. Their final value is that origin tenant ID, used in the download oid.

Errors and unusual responses

Response	Condition
`{"error":"not logged in"}`	No authenticated tenant context is available. Invalid signed credentials can be rejected by the dispatcher before the handler runs.
`{"error":"missing or invalid parameter: start"}`	Start is absent.
`{"error":"permission denied"}`	The requested file type fails the read guard.

Legacy application errors may be returned with HTTP 200. Check the decoded response for error, not only the HTTP status.

Behaviour and edge cases

Inherited and outsourced rows remain outside consistent counting. The total count excludes deleted files but counts only the direct type/resource pair, not inherited parent-site files. Outsourced Job rows are appended after local SQL pagination and are absent from both counts. A page can therefore contain more than length rows.

Local rows always exclude soft-deleted files. Customer listing calls Customer_rebuildFilesCsv as a read side effect before resolving parent sharing.
Descriptions can contain server-generated HTML and CRM1 link rewriting. Missing descriptions may trigger a per-row User-name lookup.
There is no tenant setting controlling the query; portal/share flags come from file columns/metadata.

See it in Fieldmotion

CRM1

Open Files on a Customer, Job, Asset, User, recurring Job, Task, or Asset Type. Searching, sorting, and paging use this endpoint.

CRM2

No primary CRM2 caller was found; CRM2 uses the named-field table.

Related endpoints

Files_getDataTable is the CRM2 contract.