Base path
/api/index.php/v1/mokonyxeditor/media/… - token-authenticated (Joomla API token), and gated by the same editor.media.* access rules as the admin browser.
Endpoints
GET media/items- list folders + files under a path.GET media/download- stream a file.POST media/upload- upload a file (multipart).POST media/rename,media/createfolder,media/move,media/copy- organise.POST media/resize,media/rotate,media/crop- edit images.DELETE mediaandPOST media/bulkdelete- remove one or many.
Why it matters
One implementation backs the admin browser and the API alike, so a script or the Mokonyx MCP manages media with exactly the same safety guarantees (path-traversal guards, per-group ACL) as a human in the editor.