Base path
/api/index.php/v1/mokosuiteeditor/media/… — token-authenticated (Joomla API token), and gated by the same editor.media.* access rules as the admin browser.
Endpoints
GET media/items— list folders + files under a path.GET media/download— stream a file.POST media/upload— upload a file (multipart).POST media/rename,media/createfolder,media/move,media/copy— organise.POST media/resize,media/rotate,media/crop— edit images.DELETE mediaandPOST media/bulkdelete— remove one or many.
Why it matters
One implementation backs the admin browser and the API alike, so a script or the MokoSuite MCP manages media with exactly the same safety guarantees (path-traversal guards, per-group ACL) as a human in the editor.