> ## Documentation Index > Fetch the complete documentation index at: https://uselora.dev/llms.txt > Use this file to discover all available pages before exploring further. # Add an item to a folder > Adds an existing item to this folder as an **additional** appearance. The item's primary folder is unchanged — to move it, `PATCH /v1/shortcuts/{handle}` with a new `folderId`. Adding an item to a folder never changes who can see that item: visibility lives on the item, and a folder only filters. Idempotent — adding an item that already appears in the folder succeeds without creating a duplicate. An item may appear in at most 20 additional folders. ## OpenAPI ````yaml /openapi.json post /v1/folders/{id}/items openapi: 3.1.0 info: title: Lora API version: 1.0.0 description: >- Lora REST API for managing workspace shortcuts, folders, tags, and QR codes. ## Versioning All stable endpoints are prefixed with `/v1/`. Breaking changes ship under a new path prefix (for example `/v2/`). Non-breaking additions (new optional fields, new endpoints) may land in the current version. Deprecated endpoints are announced in the [developer docs](https://uselora.dev) before removal. ## Authentication Send `Authorization: Bearer ` on every request except `GET /v1/qr`, which also accepts anonymous callers. API keys are workspace-scoped and carry OAuth-style scopes (for example `shortcuts.write`). ## Errors 4xx and 5xx responses use a typed JSON envelope: `{ error, code?, requestId, traceId?, fieldErrors?, required_scope?, current_plan?, required_capability? }`. See components `ErrorResponse`, `ErrorWithFieldErrors`, `PaymentRequiredError`, `ForbiddenError`, and `InternalError`. ## Rate limits Successful responses include `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset` (IETF RateLimit fields). 429 responses include `Retry-After` (seconds). Authenticated callers are bucketed per API key; anonymous QR endpoints are bucketed per IP. ## Discovery - OpenAPI spec: `GET https://api.uselora.com/openapi.json` (also `GET https://api.uselora.com/`) - RFC 9727 catalog: `GET https://www.uselora.com/.well-known/api-catalog` - MCP manifest: `GET https://www.uselora.com/.well-known/mcp` (server card at `/.well-known/mcp/server-card.json`) - MCP Streamable HTTP endpoint: `POST https://api.uselora.com/mcp` servers: - url: https://api.uselora.com description: Production security: - bearerAuth: [] paths: /v1/folders/{id}/items: post: tags: - Folders summary: Add an item to a folder description: >- Adds an existing item to this folder as an **additional** appearance. The item's primary folder is unchanged — to move it, `PATCH /v1/shortcuts/{handle}` with a new `folderId`. Adding an item to a folder never changes who can see that item: visibility lives on the item, and a folder only filters. Idempotent — adding an item that already appears in the folder succeeds without creating a duplicate. An item may appear in at most 20 additional folders. operationId: addFolderItem parameters: - name: id in: path required: true schema: type: string pattern: ^[0-9abcdefghjkmnpqrstvwxyz]{8}$ example: a1b2c3d4 description: The folder's unique ID. requestBody: required: true content: application/json: schema: type: object properties: itemId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$ description: The ID of the item to add to this folder examples: - 019e8ef6-9a84-7de9-877d-9e9ee171a8c2 itemType: default: shortcut type: string enum: - shortcut description: The kind of item. Only `shortcut` is supported today. examples: - shortcut required: - itemId additionalProperties: false title: AddFolderItemRequest description: Payload to add an existing item to a folder responses: '201': description: Item added to the folder (or already present). content: application/json: schema: type: object required: - added properties: added: type: boolean enum: - true '400': description: >- The request body failed validation (for example `itemId` is missing or not a UUID) or wasn't valid JSON. content: application/json: schema: type: object properties: error: type: string code: type: string fieldErrors: type: object propertyNames: type: string additionalProperties: type: array items: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '401': description: Missing, malformed, unknown, or workspace-unscoped Bearer token. content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '402': description: >- The workspace plan does not include API access, the requested capability, or enough resource capacity. The body uses `plan_requires_upgrade` or `quota_exceeded`. Upgrade the workspace or change the request; retrying the same request will not succeed. headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string content: application/json: schema: type: object properties: error: type: string code: type: string enum: - plan_requires_upgrade - quota_exceeded requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ current_plan: description: The workspace plan when the response includes it. type: string required_capability: description: >- The required plan capability when the response includes it. type: string required: - error - code - requestId additionalProperties: false '403': description: >- The key lacks the required scope (`insufficient_scope`), or the caller may not curate this folder (`no_permission`). content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required_scope: description: >- Set when `code` is `insufficient_scope`. The exact scope name the route required, e.g. `shortcuts.write`. type: string required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '404': description: >- The folder or the item was not found in this workspace. Items you cannot see report `not_found` rather than `no_permission`, so this endpoint cannot be used to probe for another member's private shortcuts. content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '409': description: >- The folder is already the item's primary folder (`already_primary`), or the item has reached the additional-folder cap (`too_many_folders`). content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string '413': description: >- The request body exceeded the size limit. The body is rejected before being parsed, so no partial write occurred; retrying with a smaller payload will succeed. headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string content: application/json: schema: type: object properties: error: type: string code: type: string const: payload_too_large requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - code - requestId additionalProperties: false '429': description: Rate limit exceeded. Wait `Retry-After` seconds before retrying. headers: Retry-After: schema: type: integer minimum: 1 description: Seconds until the rate-limit window resets. X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string content: application/json: schema: type: object properties: error: type: string code: type: string requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - requestId additionalProperties: false '500': description: >- An unexpected failure on the server. The body is `{ error: , code: "internal_error", requestId: }`, plus `traceId` when available. Retry idempotent operations with exponential backoff. A write may already have applied; reconcile its state before retrying. headers: X-Lora-Request-Id: description: >- Request correlation identifier. Matches the `requestId` field in the JSON error body. schema: type: string content: application/json: schema: type: object properties: error: type: string code: type: string const: internal_error requestId: type: string description: >- Correlation identifier for support/debugging. Equals the `X-Lora-Request-Id` response header. traceId: description: >- Trace identifier when available for this request. 32-character lowercase hex string. type: string pattern: ^[0-9a-f]{32}$ required: - error - code - requestId additionalProperties: false components: securitySchemes: bearerAuth: type: http scheme: bearer ````