> For the complete documentation index, see [llms.txt](https://docs.buzzy.buzz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.buzzy.buzz/developing-and-extending-buzzy/buzzy-rest-api/rest-api/microapp-data-operations/microappchild.md).

# microappchild

### description

The MicroAppChild API provides endpoints for managing child items (such as files and images) that are associated with MicroApp data entries (see [microappdata](/developing-and-extending-buzzy/buzzy-rest-api/rest-api/microapp-data-operations/microappdata.md)). These endpoints are used to handle file attachments, images, and other child resources that belong to a parent MicroApp data entry.

Child items are always associated with a specific field (identified by `fieldID`) in a parent MicroApp row (identified by `appID`). The parent row must be created first using the MicroApp data endpoints before child items can be attached to it.

## Private Data behavior

Image and file fields can be configured as [Private Data](/the-building-blocks/datatables-fields-and-data/private-data.md). The MicroAppChild API follows the same row, field, and Private Data access rules as the Buzzy runtime.

* If the authenticated caller can view the field, list/read responses can include the normal attachment metadata and signed URLs needed to render the file or image.
* If the caller cannot view the field, Buzzy returns a hidden Private Data placeholder and does not expose file names, metadata, storage keys, or signed URLs.
* Create, update, and delete operations require field edit access, not only row access.
* Viewer and Team Viewer policies apply first through the parent row. Field view and Field edit then decide whether the caller can read or change the attachment field.
* Signed URLs should be treated as sensitive output. Do not forward them to systems or users that should not have file access.
* V1 gates attachment metadata and signed URLs. File bytes are not separately encrypted by this feature.

### parameters

The `X-Auth-Token` and `X-User-Id` are derived from the values `authToken` and `userId` returned from the login endpoint and are used in the HTTP header.

## List Child Items

### Endpoint

```
POST /api/microappchild/list
```

### Headers

* `x-user-id`: User ID for authentication
* `x-auth-token`: Authentication token
* `Content-Type`: application/json

### Query Parameters

* `appID` (required): Parent app item ID
* `fieldID` (required): Parent field ID
* `optUserToken` (optional): User authentication token

### Response

Returns an array of child items matching the query parameters.

### Example Request

```bash
curl -X POST \
  'https://your-buzzy-instance/api/microappchild/list?appID=123&fieldID=456' \
  -H 'x-user-id: your-user-id' \
  -H 'x-auth-token: your-auth-token'
```

## Create Child Item

### Endpoint

```
POST /api/microappchild/create
```

### Headers

* `x-user-id`: User ID for authentication
* `x-auth-token`: Authentication token
* `Content-Type`: application/json

### Request Body

```json
{
  "microAppResourceID": "string", // ID of the MicroApp resource
  "appID": "string",             // ID of the parent app item
  "fieldID": "string",           // ID of the parent field
  "content": {                   // Content data for the child
    "url": "string",            // Optional: URL for file/image content
    "filename": "string",       // Optional: Filename for file content
    "size": "number",          // Optional: File size
    "type": "string",         // Optional: File type
    "expiredAt": "number"    // Optional: Expiration timestamp
  }
}
```

### Response

Returns the ID of the newly created child item.

## Update Child Item

### Endpoint

```
POST /api/microappchild/update
```

### Headers

* `x-user-id`: User ID for authentication
* `x-auth-token`: Authentication token
* `Content-Type`: application/json

### Request Body

```json
{
  "childID": "string",  // ID of the child to update
  "content": {          // New content data
    // Content fields to update
  }
}
```

### Response

Returns success status of the update operation.

## Delete Child Item

### Endpoint

```
POST /api/microappchild/delete
```

### Headers

* `x-user-id`: User ID for authentication
* `x-auth-token`: Authentication token
* `Content-Type`: application/json

### Request Body

```json
{
  "childID": "string"  // ID of the child to delete
}
```

### Response

Returns success status of the deletion operation.