> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.lakera.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lakera.ai/_mcp/server.

# Management API — Folders

Manage the organization's [folders](/docs/red/folders). All endpoints are scoped to the
Management API Key's organization and require a Management API Key — see the
[Overview](/docs/red/management-api-overview) for authentication and error conventions.

Personal folders are never visible to the Management API. The organization folder (the
built-in **Default** folder) is listed and readable, but cannot be renamed or deleted.

## List folders

`GET /management/folders`

Returns the organization's folders, newest first.

| Query parameter | Type   | Notes                                                                                    |
| --------------- | ------ | ---------------------------------------------------------------------------------------- |
| `limit`         | number | Maximum folders to return. Default 100, capped at 500.                                   |
| `before`        | number | Return folders older than this `at` timestamp — the `nextCursor` from the previous page. |

```bash
curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
  "https://$LAKERA_RED_HOST/management/folders?limit=100"
```

```json
{
  "folders": [
    {
      "id": "...",
      "at": 1786546819835,
      "orgId": "org_abc123",
      "name": "Team",
      "isDefault": false
    }
  ],
  "nextCursor": 1786546819835
}
```

`nextCursor` is the `before` value to pass to fetch the next page, or `null` when the
last page has been reached. Keep requesting with it until it comes back `null`:

```bash
curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
  "https://$LAKERA_RED_HOST/management/folders?limit=100&before={nextCursor}"
```

## Get a folder

`GET /management/folders/{folderId}`

```json
{
  "folder": { "id": "...", "orgId": "org_abc123", "name": "Team", "isDefault": false }
}
```

Returns `404` if the folder does not exist in the key's organization.

## Create a folder

`POST /management/folders`

| Field         | Type   | Required | Notes                            |
| ------------- | ------ | -------- | -------------------------------- |
| `name`        | string | yes      | 1–200 characters after trimming. |
| `description` | string | no       | Up to 256 characters.            |

```bash
curl -X POST -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Team"}' \
  https://$LAKERA_RED_HOST/management/folders
```

Responds `201` with the created folder. The key's owner is added as the folder's admin.

## Rename or update a folder

`PATCH /management/folders/{folderId}`

Supply `name`, `description`, or both; at least one is required. Renaming the
organization folder is rejected with `400`.

```bash
curl -X PATCH -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Renamed team"}' \
  https://$LAKERA_RED_HOST/management/folders/{folderId}
```

## Delete a folder

`DELETE /management/folders/{folderId}`

Because targets and evaluations live in a folder, deletion must say what happens to the
folder's contents, via a `contentMode` field:

| `contentMode` | Behavior                                                                                                   |
| ------------- | ---------------------------------------------------------------------------------------------------------- |
| `"delete"`    | Delete the folder's targets, evaluations, and their scans; running scans are cancelled.                    |
| `"move"`      | Move the contents to another folder. Requires `destinationFolderId`, which must be an organization folder. |

Either way, the folder's Red Team API Keys are revoked. Deleting the organization folder
is rejected with `400`.

```bash
curl -X DELETE -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"contentMode": "move", "destinationFolderId": "{otherFolderId}"}' \
  https://$LAKERA_RED_HOST/management/folders/{folderId}
```

Responds `204` with no body.