diff --git a/api/create.php b/api/create.php
new file mode 100644
index 0000000..cccae4a
--- /dev/null
+++ b/api/create.php
@@ -0,0 +1,56 @@
+ false, 'error' => 'Invalid type: must be "folder" or "file"']);
+ exit;
+}
+
+if (strpos($dirV, '/.apps') === 0 || $dirV === '/.thos_state.json') {
+ echo json_encode(['success' => false, 'error' => 'Cannot create in system directories']);
+ exit;
+}
+
+$realDir = resolve_path($dirV);
+if (!is_dir($realDir)) {
+ die(json_encode(['success' => false, 'error' => 'Parent directory not found or invalid']));
+}
+
+$newPathReal = $realDir . '/' . $name;
+
+$invalidCharsRegex = '/[<>:"\/\\\\|?*\x00-\x1F]/';
+if (preg_match($invalidCharsRegex, $name)) {
+ die(json_encode(['success' => false, 'error' => 'Invalid filename: special characters not allowed']));
+}
+
+if ($type === 'folder') {
+ if (is_dir($newPathReal)) {
+ die(json_encode(['success' => false, 'error' => 'Folder with that name already exists']));
+ }
+} else {
+ if (file_exists($newPathReal)) {
+ die(json_encode(['success' => false, 'error' => 'File with that name already exists']));
+ }
+}
+
+if ($type === 'folder') {
+ if (!mkdir($newPathReal, 0777, true)) {
+ die(json_encode(['success' => false, 'error' => 'Failed to create folder']));
+ }
+} else {
+ if (!touch($newPathReal)) {
+ die(json_encode(['success' => false, 'error' => 'Failed to create file']));
+ }
+}
+
+echo json_encode([
+ 'success' => true,
+ 'path' => virtualize_path($newPathReal),
+]);
diff --git a/explorer.html b/explorer.html
index 186d892..5c81984 100644
--- a/explorer.html
+++ b/explorer.html
@@ -4,8 +4,8 @@
THOS Explorer
-
-
+
+