Credentials

The secret key uploads, deletes and signs client uploads. Use it only from server code (e.g. the Ramrogaadi API) — never in a web page visitors load. Delivery URLs are public and need no key.

URL transformations

Add ?tr= to any image URL, or put tr:… as the first path segment. Results are cached.

Param	Meaning	Example
w	Width in px (below 1 = fraction of original)	w-400, w-0.5
h	Height in px	h-300
ar	Aspect ratio, with only w or h	w-800,ar-16-9
c	Crop strategy: maintain_ratio (fill & crop, default), at_max (fit inside), at_least (cover), force (stretch)	c-at_max
cm	pad_resize: fit inside, pad to exact size with bg	cm-pad_resize,bg-FFFFFF
fo	Crop focus: center, top, bottom, left, right, top_left…	fo-top
q	Quality 1–100 (default 80)	q-70
f	Format: auto (WebP when the browser supports it), webp, jpg, png, orig	f-auto
bl	Blur 1–100	bl-10
rt	Rotate 90 / 180 / 270	rt-90
e	Effect: grayscale	e-grayscale

Upload API

POST /api/v1/files/upload — multipart form. Fields: file (required), folder, fileName, useUniqueFileName (default true), overwriteFile.

Response:

{ "name": "logo_k3j9a2xq.png", "filePath": "/Image/Dealers/logo_k3j9a2xq.png",
  "url": "…/Image/Dealers/logo_k3j9a2xq.png", "size": 48213, "fileType": "image",
  "mimeType": "image/png", "width": 512, "height": 512, "modified": "…" }

From C# (e.g. the Ramrogaadi API)

Client-side upload (from a browser)

Same as ImageKit: your back end signs each upload with the secret key; the page sends the file with the public key and that signature, so the secret never reaches the browser. A token can be used once; expire is a Unix time at most 1 hour ahead.

Signature: HMAC-SHA1(secretKey, token + expire) as lower-case hex. Or let this server make one: GET /api/v1/upload-auth with your secret key returns { token, expire, signature, publicKey }.

Management endpoints

Method	Path	Purpose
GET	/api/v1/files?path=&search=&skip=&limit=&sort=	List a folder (or search below it)
GET	/api/v1/files/details?filePath=	One file, with width/height
POST	/api/v1/files/upload	Upload
POST	/api/v1/files/move	Rename / move { filePath, destinationPath, newFileName }
DELETE	/api/v1/files?filePath=	Delete a file
POST	/api/v1/files/purge	Drop a file's cached transforms { filePath }
POST	/api/v1/folder	Create { folderName, parentFolderPath }
DELETE	/api/v1/folder?folderPath=	Delete a folder and everything in it
GET	/api/v1/stats	Usage totals
GET	/api/v1/upload-auth	A one-time signature for a client-side upload
GET / POST	/api/v1/keys	List your key pairs / generate a new one { label }
DELETE	/api/v1/keys/{id}	Revoke a key pair

Authenticate with X-Api-Key: <secret>, Authorization: Bearer <secret>, or ImageKit-style Authorization: Basic base64(secret + ":").

Server

These come from appsettings.json → ImageServer. Set PublicBaseUrl to the public address (e.g. https://img.ramrogaadi.com) so returned URLs use it.

Transform cache

Each transformed variant is rendered once and kept. Clearing it is safe; variants are re-rendered on next request.

Clear entire cache