File Hashing

Compute and verify SHA256 hashes of files for integrity checking. The Files API exposes hashing as a query parameter on the standard GET operation, so the same endpoint used to download a file can also return its cryptographic digest in plain text. This makes it straightforward to confirm that a file was uploaded correctly, detect tampering, or compare contents across environments.

The Files API supports a single hashing algorithm: SHA256. There is no support for MD5, SHA-1, SHA-512, or any other algorithm. Two query parameters are accepted and behave identically — hash and sha256 — so clients can use whichever name reads more clearly in their code.

Computing a file hash

Append either ?hash or ?sha256 to a standard file GET request. The response body is a plain-text SHA256 hex string rather than the file’s binary contents. The status code, headers, and authentication requirements are otherwise identical to a regular file download.

Using the hash parameter

cURL

curl -X GET "https://api.hoody.com/api/v1/files/path/to/file.bin?hash" \
  -H "Authorization: Bearer $HOODY_TOKEN"

Response

a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

Using the sha256 parameter

The sha256 parameter is a direct alias for hash and produces the same response.

cURL

curl -X GET "https://api.hoody.com/api/v1/files/path/to/file.bin?sha256" \
  -H "Authorization: Bearer $HOODY_TOKEN"

Response

a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

Response format

The hash is returned as a lowercase hexadecimal string exactly 64 characters long, with no surrounding JSON, whitespace, or content-type framing. Treat the response as text/plain.

Note

The response body is the hash itself, not an object containing the hash. If you pipe the response into a tool that expects JSON, parsing will fail — capture the output as a raw string instead.

Verifying a local file

To confirm a local copy matches the version stored in the Files API, compute its SHA256 locally and compare the two hex strings.

LOCAL_SHA=$(sha256sum ./file.bin | awk '{print $1}')
REMOTE_SHA=$(curl -sX GET "https://api.hoody.com/api/v1/files/path/to/file.bin?hash" \
  -H "Authorization: Bearer $HOODY_TOKEN")

if [ "$LOCAL_SHA" = "$REMOTE_SHA" ]; then
  echo "Integrity verified"
else
  echo "Hash mismatch"
  exit 1
fi

Choosing between hash and sha256

Both query parameters return the same value and incur the same cost. Prefer hash for general-purpose code where brevity matters, and prefer sha256 when the explicit algorithm name improves readability, such as in scripts that verify checksums before deployment.

Tip

Because the response is plain text, you can capture it directly into a shell variable or compare it byte-for-byte against an expected digest without any JSON parsing layer.

Limitations

• SHA256 is the only supported algorithm. Requests for MD5, SHA-1, or SHA-512 digests are not supported and will be rejected.
• The hash is computed over the current stored version of the file. If the file is modified, the hash will change accordingly.
• Hashing is read-only and does not consume write quotas, but it is subject to the same rate limits as a standard file read.