# List a customer's files in one collection

```http
GET https://secure.yoprint.com/v1/api/store/{team_slug}/customer/{hash_id}/media/collection/{collection}
```

- API version: v1
- Operation ID: `v1_public_customer_media_get_media_by_collection`
- Section: Customers › [Customer files](https://developer.yoprint.com/reference/customer-files.md)
- Web page: https://developer.yoprint.com/reference/customer-files/v1-customer-media-get-media-by-collection/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Lists the customer's files in one collection:

- `tax_exemption`: tax exemption certificates. The customer sees these in the customer portal.
- `external_file`: files shared with the customer. Also shown in the portal.
- `internal_file`: files for your team only.

The list is paged: `pagination` gives `total`, `count`, `perPage`, `currentPage` and `totalPages`. Ask for the next page with `page`; the page size is the team's setting (50 unless changed), and `per_page` is ignored.

## Permission

Any member of the team.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The customer's id (`id` from List customers or Create a customer). A hash id from an earlier answer; unique keys and document numbers (such as `PO0042`) don't work here. Example `EDhVUaC6jbLbed`.
- `collection` (string, required): Which files: `tax_exemption` (tax exemption certificates), `external_file` (files the customer can see in the portal) or `internal_file` (your team only). One of: `"tax_exemption"`, `"external_file"`, `"internal_file"`. Example `tax_exemption`.

## Query parameters

- `page` (integer, optional): The page to return. Pages hold the team's page size (`pagination_per_page` in team settings: 50 unless changed, 5 to 100). `per_page` is not read here. Default `1`. Minimum 1. Example `1`.

## Request body

This operation takes no request body.

### Example request

```bash
curl 'https://secure.yoprint.com/v1/api/store/your-team/customer/EDhVUaC6jbLbed/media/collection/tax_exemption' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1'
```

## Response

`200` Successful response.

Fields:

- `data` (array of objects, required)
  - Each item:
    - `collection` (string, required): Customer files: `tax_exemption`, `internal_file` or `external_file`. Vendor files: `default`, `mockup` or `production_file`.
    - `created_at` (string (date-time), required)
    - `file_name` (string, required)
    - `id` (string, required)
    - `mime_type` (string | null, required)
    - `name` (string | null, required): The display name.
    - `size` (integer, required): Bytes.
    - `custom_properties` (object | array, optional)
    - `customer_id` (string, optional): Customer files only.
    - `dimensions` (object | null, optional): Pixel size of an image, read from its header; null for other files and for images uploaded before the size was recorded.
      - `height` (integer, optional)
      - `width` (integer, optional)
    - `is_image` (boolean, optional)
    - `position` (integer | null, optional): Where the file sorts.
    - `preview` (object | null, optional): Preview image links `small`, `medium` and `large` (250, 800 and 1200 px), or null when there is no preview.
    - `preview_state` (string, optional): `ready`: the preview links work. `processing`: an image over 10 MB whose stored preview a worker is still making (seconds); read the file again, or in the web app wait for `media.preview_state_changed` on the team channel. `too_large`: an image over 120 megapixels; it never gets a preview. `failed`: the worker gave up. `none`: not an image. One of: `"ready"`, `"processing"`, `"too_large"`, `"failed"`, `"none"`.
    - `show_in_pdf` (boolean | null, optional)
    - `source_media_id` (string | null, optional)
    - `url` (string | null, optional): Where to download the file.
    - `view_url` (string | null, optional): A signed link to view the file. It expires: read it fresh, and don't store it.
- `status` (integer, required)
- `success` (boolean, required)
- `pagination` (object, optional)
  - `count` (integer, required)
  - `currentPage` (integer, required)
  - `links` (object | array of any, required): Links to the neighbouring pages: `previous` and `next`, each present only when that page exists. An empty list, `[]`, when there is only one page.
    - `next` (string (uri), optional): The next page.
    - `previous` (string (uri), optional): The previous page.
  - `perPage` (integer, required)
  - `total` (integer, required)
  - `totalPages` (integer, required)

Example response:

```json
{
  "data": [
    {
      "collection": "tax_exemption",
      "created_at": "2026-11-01T09:00:00+00:00",
      "custom_properties": [],
      "customer_id": "V4keXwwxMQyXw7",
      "file_name": "resale-certificate.pdf",
      "id": "4GR9C3ZTMYtda5",
      "is_image": false,
      "mime_type": "application/pdf",
      "name": "Resale certificate 2026.pdf",
      "position": 0,
      "preview": null,
      "show_in_pdf": null,
      "size": 48211,
      "source_media_id": null,
      "url": "https://example.com/media/4GR9C3ZTMYtda5/download",
      "view_url": "https://example.com/media/4GR9C3ZTMYtda5/view"
    }
  ],
  "pagination": {
    "count": 1,
    "currentPage": 1,
    "links": [],
    "perPage": 50,
    "total": 1,
    "totalPages": 1
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
  - When: No live customer with this id in the team: deleted customers are not found here. `error.code` is null and `error.message` names the record type. Fix: Check the id. Find deleted customers with the `trashed_only` filter and restore them first.
- `422` The request was refused and changed nothing. `validation_failed` lists what to fix in `error.fields`; other codes name a business rule, explained in `error.message`. A few checks answer with only `{"message": "..."}`. An operation that calls another service (a payment provider, a carrier, an accounting app) can answer `connect_timeout` ("Please retry again") when that service does not answer in time: the change may or may not have happened there, so read the record back before you retry.
  - When: The collection is not one of the three (`error.code` `validation_error`, with the reason in `error.message`). Fix: Use `tax_exemption`, `external_file` or `internal_file`.

## Related

- [Attach uploaded files to a customer](https://developer.yoprint.com/reference/customer-files/v1-customer-upload-multiple-files.md): `POST /v1/api/store/{team_slug}/customer/{hash_id}/media/attach`