File integrity verification in Hoody is handled through a dedicated query parameter on the file retrieval endpoint. Instead of exposing separate hashing operations, the API computes and returns the SHA256 hash of a file when requested, allowing clients to confirm that a downloaded file matches its expected contents without transferring the file body twice.

Algorithm

Only SHA256 is supported. The endpoint does not accept other algorithms, and there is no algorithm selector — every hash request returns a SHA256 digest.

How it works

Append ?hash (or its alias ?sha256) to a standard GET /api/v1/files/{path} request. When the parameter is present, the server skips the file body and returns the SHA256 hash of the file as a plain text response. Without the parameter, the endpoint behaves normally and returns the file contents.

The two query parameters are functionally identical:

• hash — primary parameter
• sha256 — alias for hash, provided for convenience

Both return the same value for the same file. Supplying both in a single request is redundant but produces the same response.

Query parameters

Name	In	Type	Required	Description
hash	query	boolean	No	Get SHA256 hash of file (returns plain text hash)
sha256	query	boolean	No	Get SHA256 hash of file (alias for hash)

Example

Request the hash of a file:

cURL

curl "https://files.containers.hoody.icu/api/v1/files/path/to/file.bin?hash"

Response

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

The response body is the lowercase hexadecimal SHA256 digest, exactly 64 characters long, with no surrounding JSON, no whitespace, and no trailing newline.

Note

The hash is computed over the file’s stored contents, identical to what would be produced if the file body were streamed and digested client-side. You can verify integrity by computing SHA256 locally with standard tooling such as sha256sum or shasum -a 256 and comparing the result character-for-character.

Tip

Prefer the ?sha256 alias when your tooling already speaks SHA256. The alias keeps URLs self-documenting and makes the intent explicit in scripts and logs.