# HTTP API: Files, fonts & secrets

> Page asset endpoints.

Glider documentation · Automation & API · Web page: https://cgglider.com/docs/http-api/files/

Sections of this page: [Pages](https://cgglider.com/docs/http-api.md) · [Runtime](https://cgglider.com/docs/http-api/runtime.md) · [Files, fonts & secrets](https://cgglider.com/docs/http-api/files.md) · [Checks](https://cgglider.com/docs/http-api/checks.md) · [Streaming](https://cgglider.com/docs/http-api/streams.md)

| Endpoint | Does |
| --- | --- |
| GET/POST /api/pages/{id}/files | List and upload. ?runtime=client narrows to browser files. |
| GET/PUT/DELETE /api/pages/{id}/files/{fileName} | Read, write and remove one. |
| POST /api/pages/{id}/files/folders | Create a folder; the [...path] form addresses one. |
| GET/POST /api/pages/{id}/assets | Page assets. |
| GET/POST /api/pages/{id}/fonts | Uploaded fonts. |
| GET/POST/DELETE /api/pages/{id}/secrets | Names, digests and timestamps only — values are never returned. |
| GET /api/pages/{id}/logs | Persisted function logs. |

Uploads are size-limited per extension and checked by magic bytes, not just by name. Files are served back with a restrictive CSP — see Fonts & Assets.