WebDAV

OxiCloud exposes a fully RFC 4918 compliant WebDAV interface at /webdav/. It works with all major file managers and sync clients.

Base URL

https://your-server:8086/webdav/

Drives in the URL

A user can own multiple drives (one personal + any number of shared drives they've been added to). The WebDAV URL scheme lets you address them all, and the operator can choose between two layouts via OXICLOUD_WEBDAV_DRIVE_LISTING_PREFIX (default "@drive"):

Default — "@drive" sigil. Bare /webdav/… addresses your default personal drive, keeping single-drive clients working with zero config. Explicit drive listing lives under the sigil.

URL	Target
/webdav/	Your default personal drive (back-compat)
/webdav/Documents/report.pdf	A file inside your default drive
/webdav/@drive/	Directory listing of every drive you can read
/webdav/@drive/<uuid-or-name>/…	A specific drive by UUID or display name

Empty prefix ("") — flat layout. /webdav/ IS the drive listing. Every drive appears as a top-level entry. No hidden default.

URL	Target
/webdav/	Directory listing of every drive you can read
/webdav/<uuid-or-name>/…	A specific drive by UUID or display name

Set OXICLOUD_WEBDAV_DRIVE_LISTING_PREFIX="" for the flat layout. Any non-empty value replaces the sigil (e.g. "drives" gives you /webdav/drives/<selector>/…).

Trade-off with the empty prefix: recursive DAV clients (Cyberduck, Finder, rclone default, NC desktop) will mirror ALL drives you can read, which can be a lot of storage. The @drive sigil keeps the default drive as the client's sync root and puts the picker behind an opt-in URL. Pick the empty prefix only when you want explicit multi-drive visibility.

Folder name collision note. A user could name a folder @drive inside their default drive; that folder would then mask the drive picker for that user under the default sigil. Rare enough to be accepted; the sigil is renameable via the env var above if it becomes an issue.

Authentication

HTTP Basic Authentication:

Authorization: Basic base64(username:app_password)

Use an app password, NOT your account password

DAV clients authenticate with an app password — a distinct, revocable, scoped credential. Your regular OxiCloud account password (used in the web login) will always be refused on /webdav/, /caldav/, and /carddav/.

Why: app passwords are the only credential that works uniformly across all account types (password, magic-link-only, OIDC-linked), and they can be revoked individually without touching your account password.

Generate an app password: open OxiCloud in your browser, go to Profile → App Passwords, click Create, name it (e.g. "Thunderbird laptop"), and copy the token shown once. Use your username + that token in every DAV client.

HTTPS

Always use HTTPS in production — Basic auth sends credentials in every request.

Supported Methods

Method	Description
PROPFIND	List directory contents / get file properties
GET	Download a file
PUT	Upload a file
MKCOL	Create a folder
MOVE	Move or rename a file/folder
COPY	Copy a file/folder
DELETE	Delete a file/folder
LOCK / UNLOCK	File locking

Common Operations

List a directory

Use PROPFIND with a Depth header:

PROPFIND /webdav/projects/ HTTP/1.1
Depth: 1
Content-Type: application/xml

<?xml version="1.0" encoding="utf-8" ?>
<D:propfind xmlns:D="DAV:">
  <D:allprop/>
</D:propfind>

Successful directory listings return 207 Multi-Status.

Download a file

GET /webdav/projects/document.pdf HTTP/1.1
Authorization: Basic base64(username:app_password)

Upload or replace a file

PUT /webdav/projects/document.pdf HTTP/1.1
Content-Type: application/pdf

<file bytes>

Create a folder

MKCOL /webdav/projects/new-folder HTTP/1.1

Move or copy

MOVE /webdav/old-location.pdf HTTP/1.1
Destination: https://your-server/webdav/new-location.pdf

COPY /webdav/original.pdf HTTP/1.1
Destination: https://your-server/webdav/copy.pdf

Delete a resource

DELETE /webdav/projects/document.pdf HTTP/1.1

Client Setup

Windows Explorer

1. Open This PC → Map network drive
2. Enter: https://your-server:8086/webdav/
3. Check Connect using different credentials
4. Enter your OxiCloud username and an app password

macOS Finder

1. Go → Connect to Server (⌘K)
2. Enter: https://your-server:8086/webdav/
3. Enter your OxiCloud username and an app password

Linux (Nautilus / Files)

1. Open Files → Other Locations
2. In the address bar, type: davs://your-server:8086/webdav/
3. Enter your OxiCloud username and an app password

Linux (Dolphin / KDE)

1. In the address bar, type: webdavs://your-server:8086/webdav/
2. Enter your OxiCloud username and an app password

Command Line (curl)

user:apppw below means your OxiCloud username + the app-password token you generated in Profile → App Passwords (not your account password).

# List root directory
curl -u user:apppw -X PROPFIND https://your-server:8086/webdav/ \
  -H "Depth: 1"

# Download a file
curl -u user:apppw https://your-server:8086/webdav/document.pdf -o document.pdf

# Upload a file
curl -u user:apppw -T localfile.txt https://your-server:8086/webdav/remotefile.txt

# Create a folder
curl -u user:apppw -X MKCOL https://your-server:8086/webdav/new-folder/

Streaming PROPFIND

OxiCloud streams PROPFIND responses, so listing directories with thousands of files doesn't consume excessive memory.

Integration Notes

• the WebDAV handler is only an HTTP adapter; file and folder operations still go through the same application services used by the REST API
• HTTP Basic Authentication is supported for DAV clients, while authorization rules remain the same as the rest of OxiCloud
• delete operations integrate with trash when the trash feature is enabled

Troubleshooting

• 401 Unauthorized on every request? You're almost certainly using your account password instead of an app password. Open OxiCloud in your browser → Profile → App Passwords → Create, then use the token shown once (with your username) in your client. See Authentication above.
• Always use the /webdav/ base path
• Prefer HTTPS because WebDAV uses Basic Authentication
• On Windows, make sure the WebClient service is enabled
• OxiCloud rejects path traversal segments such as . and .. at the HTTP boundary