A file-notification API is an operating system interface that reports when files or directories change. Instead of reading file contents, programs subscribe to events such as create, delete, rename, write, or directory updates. Common examples include inotify on Linux, FSEvents on macOS, Windows directory-change notifications, and similar event-driven watchers on other platforms.
These APIs matter because they are useful for sync clients, editors, backup tools, and security monitoring, but they can also leak metadata. An attacker who can observe notification patterns may infer user activity from timing, frequency, or scope of changes, even when the underlying files are protected. That makes directory placement, watcher permissions, and event granularity important defenses. Security teams review who can watch sensitive trees, reduce unnecessary directory exposure, and enable platform mitigations where available. In short, file-notification APIs are convenient, but their event streams can become a side channel if they reveal too much about what a system is doing.