ZIP & tar.gz Archive Tool API

List, extract and create ZIP, tar, tar.gz (.tgz) and .gz archives over HTTP, with zip-bomb and path-traversal protection.

POSThttps://apibox.io.vn/v1/archive

Files▶ Try it online

action=list (default for an uploaded file) returns every entry with name, size, compressed size, date, CRC-32, compression method and flags for directories, encrypted entries and unsafe names (absolute paths or ..). ZIP names without the UTF-8 flag are decoded as UTF-8 when valid, else CP437 (set name_encoding, e.g. windows-1258, for archives made by older Windows tools). ZIP64, tar (ustar, pax and GNU long names), tar.gz and single-file .gz are supported.

action=extract with entry returns one file as base64 (plus text for small UTF-8 files) or as the raw file with output=raw. action=extract_all returns all files as base64 JSON (up to 20 MB) or re-packed as a ZIP with output=zip; unsafe and encrypted entries are skipped and listed.

action=create builds a format zip (default), tar, tar.gz or gz from multipart files (file1, file2…) or files: [{"name": "a.txt", "content_base64": "…"}] (or content text), with compression level 0-9. Zip-bomb guards: total uncompressed size (200 MB on Pro), 1000:1 ratio, 10,000 entries; output sizes are checked while inflating. Password-protected (encrypted) ZIPs, 7z, RAR, bzip2 and xz are not supported.

Parameters

Name	In	Type	Required	Default
`action`	body\|query	string	no	`list`	`list`, `extract`, `extract_all` or `create`.
`file`	body	file	no		Archive to read (ZIP, tar, tar.gz / tgz, gz) as multipart, raw body or `file_base64`.
`entry`	body\|query	string	no		Entry name for `extract`.
`output`	body\|query	string	no	`json`	`extract`: `json` or `raw`; `extract_all`: `json` or `zip`; `create`: file (default) or `base64`.
`files`	body	array	no		For `create`: `[{"name": "dir/a.txt", "content_base64": "…"}]` or `content` text; multipart files also work.
`format`	body\|query	string	no	`zip`	For `create`: `zip`, `tar`, `tar.gz` or `gz`.
`level`	body\|query	number	no	`6`	Compression level 0-9 for `create`.
`name_encoding`	body\|query	string	no	`auto`	ZIP name encoding: `auto`, `utf-8`, `cp437`, `windows-1258`…
`filename`	body\|query	string	no	`archive`	Download name for `create`.

Example

curl -X POST "https://apibox.io.vn/v1/archive" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "file=@./my-file"

const form = new FormData();
form.append('file', fileInput.files[0]);

const res = await fetch('https://apibox.io.vn/v1/archive', {
  method: 'POST',
  headers: { Authorization: 'Bearer YOUR_API_KEY' },
  body: form,
});
console.log(await res.json());

import requests

res = requests.post(
    "https://apibox.io.vn/v1/archive",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    files={"file": open("my-file", "rb")},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/archive');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
    CURLOPT_POSTFIELDS => ['file' => new CURLFile('my-file')],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "format": "zip",
  "entries": 4,
  "files": 3,
  "directories": 1,
  "total_bytes": 300021,
  "compressed_bytes": 300071,
  "ratio": 1,
  "encrypted": false,
  "zip_bomb_suspected": false,
  "warnings": [],
  "truncated": false,
  "list": [
    {
      "name": "hoa-don.xml",
      "dir": false,
      "size": 15,
      "compressed": 15,
      "method": "stored",
      "date": "2026-11-11T13:46:06",
      "crc32": "b3e05eec",
      "encrypted": false,
      "unsafe": false
    },
    {
      "name": "sub/",
      "dir": true,
      "size": 0,
      "compressed": 0,
      "method": "stored",
      "date": "2026-11-11T13:46:06",
      "crc32": "00000000",
      "encrypted": false,
      "unsafe": false
    },
    {
      "name": "sub/rand.bin",
      "dir": false,
      "size": 300000,
      "compressed": 300050,
      "method": "deflate",
      "date": "2026-11-11T13:46:06",
      "crc32": "85582e2a",
      "encrypted": false,
      "unsafe": false
    },
    "…"
  ]
}

Use cases

Unpack ZIP files of e-invoice XML sent by suppliers inside an automation flow
Let Apps Script or no-code tools read files inside a ZIP or tar.gz
Bundle generated reports into one ZIP download
Check uploaded archives for zip bombs and ../ paths before processing

FAQ

Can it open password-protected ZIP files?

No. Encrypted entries are listed with encrypted: true but cannot be extracted; ZIP encryption (ZipCrypto or AES) is not supported.

How are zip bombs handled?

Archives that claim more than the total limit or a compression ratio above 1000:1 are refused, and every entry is decompressed with a hard output cap, so lying size fields do not help.

File names show wrong Vietnamese characters, what can I do?

Archives from old Windows tools store names in a local code page without the UTF-8 flag. Try name_encoding=windows-1258 or cp437 to decode them.

Related APIs

EXIF

ZIP & tar.gz Archive Tool API

Parameters

Example

Response

Use cases

FAQ

Related APIs

Image Metadata & EXIF

PDF Metadata

Quote & Receipt PDF