diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5709b7f..9d90011 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -95,6 +95,24 @@ fix. Tests talk to an `httptest` server rather than to Yandex; look at
 Keep tests deterministic. If one needs to wait, give it a timeout measured in
 milliseconds, not seconds, so the suite stays fast.
 
+### Against the real API
+
+`integration_test.go` checks the library against Yandex itself. It is behind
+a build tag, so `go test ./...` skips it. Run it with a token of an account
+you can spare:
+
+```sh
+YANDEX_DISK_ACCESS_TOKEN=... go test -tags integration -run Integration -v ./
+```
+
+It takes about two minutes and needs a few megabytes. Everything it creates
+lives in a new `disk:/disk-it-<date>-<time>` folder, which it deletes for
+good at the end. A guard in the HTTP transport refuses any change outside
+that folder, any trash item the test did not put there, and emptying the
+whole trash. Calls that read the whole Disk log only counts, never names.
+
+Run it before a release, and whenever you change how a request is built.
+
 ## Commit messages
 
 We use [Conventional Commits](https://www.conventionalcommits.org/):
diff --git a/api_coverage_test.go b/api_coverage_test.go
index b40d07e..3ae7175 100644
--- a/api_coverage_test.go
+++ b/api_coverage_test.go
@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/url"
 	"testing"
+	"time"
 )
 
 // request is what a test server saw.
@@ -189,3 +190,40 @@ func TestCoordinateToleratesOddShapes(t *testing.T) {
 		}
 	}
 }
+
+func TestBatchCopyAndMoveHonourOverwrite(t *testing.T) {
+	opts := &BatchCopyMoveOptions{Overwrite: true}
+	ops := map[string]string{"disk:/a": "disk:/b"}
+
+	client, got := recordingClient(http.StatusCreated, linkJSON)
+	if _, err := client.BatchCopyFiles(context.Background(), ops, opts); err != nil {
+		t.Fatal(err)
+	}
+	expectQuery(t, got, http.MethodPost, "/v1/disk/resources/copy", map[string]string{"overwrite": "true"})
+
+	client, got = recordingClient(http.StatusCreated, linkJSON)
+	if _, err := client.BatchMoveFiles(context.Background(), ops, opts); err != nil {
+		t.Fatal(err)
+	}
+	expectQuery(t, got, http.MethodPost, "/v1/disk/resources/move", map[string]string{"overwrite": "true"})
+}
+
+// A copy that finished at once returns a link to the copied file, not to an
+// operation; waiting must not try to poll it.
+func TestWaitForBatchOperationSkipsFinishedResults(t *testing.T) {
+	client, got := recordingClient(http.StatusCreated,
+		`{"href": "https://cloud-api.yandex.net/v1/disk/resources?path=disk%3A%2Fb", "method": "GET"}`)
+	status, err := client.BatchCopyFiles(context.Background(), map[string]string{"disk:/a": "disk:/b"}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got.path = ""
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if err := client.WaitForBatchOperation(ctx, status, 10*time.Millisecond); err != nil {
+		t.Fatalf("wait: %v", err)
+	}
+	if got.path != "" {
+		t.Errorf("waiting polled %s", got.path)
+	}
+}
diff --git a/batch.go b/batch.go
index 56e41ad..93f7a69 100644
--- a/batch.go
+++ b/batch.go
@@ -233,7 +233,7 @@ func (c *Client) BatchCopyFiles(ctx context.Context, operations map[string]strin
 			}
 
 			// Perform the copy operation
-			link, errResp := c.CopyResource(opCtx, from, to)
+			link, errResp := c.CopyResourceWithOptions(opCtx, from, to, &CopyMoveOptions{Overwrite: options.Overwrite})
 			result.Duration = time.Since(startTime)
 
 			if errResp != nil {
@@ -346,7 +346,7 @@ func (c *Client) BatchMoveFiles(ctx context.Context, operations map[string]strin
 			}
 
 			// Perform the move operation
-			link, errResp := c.MoveResource(opCtx, from, to)
+			link, errResp := c.MoveResourceWithOptions(opCtx, from, to, &CopyMoveOptions{Overwrite: options.Overwrite})
 			result.Duration = time.Since(startTime)
 
 			if errResp != nil {
@@ -693,7 +693,7 @@ func (c *Client) WaitForBatchOperation(ctx context.Context, status *BatchOperati
 	// Check if there are any async operations (operations that returned Links)
 	asyncOps := 0
 	for _, result := range status.Results {
-		if result != nil && result.Link != nil {
+		if result != nil && isOperationLink(result.Link) {
 			asyncOps++
 		}
 	}
@@ -715,7 +715,7 @@ func (c *Client) WaitForBatchOperation(ctx context.Context, status *BatchOperati
 		case <-ticker.C:
 			completed := 0
 			for _, result := range status.Results {
-				if result == nil || result.Link == nil {
+				if result == nil || !isOperationLink(result.Link) {
 					continue
 				}
 
@@ -815,3 +815,10 @@ func (c *Client) RetryFailedOperations(ctx context.Context, status *BatchOperati
 
 	return retryStatus, nil
 }
+
+// isOperationLink reports whether link points to a background operation.
+// An operation that finished at once returns a link to its result instead,
+// such as the copied file, and there is nothing to wait for.
+func isOperationLink(link *Link) bool {
+	return link != nil && strings.Contains(link.Href, "/operations/")
+}
diff --git a/client.go b/client.go
index af06f86..c9cf6a7 100644
--- a/client.go
+++ b/client.go
@@ -1,6 +1,7 @@
 package disk
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
 	"encoding/json"
@@ -182,8 +183,15 @@ func (c *Client) doRequest(ctx context.Context, method HttpMethod, resource stri
 	if method == GET || method == DELETE {
 		body = nil
 	} else if data != nil {
-		// Limit request body size to prevent memory exhaustion
-		body = io.LimitReader(data, 100*1024*1024) // 100MB limit
+		switch data.(type) {
+		case *bytes.Reader, *bytes.Buffer, *strings.Reader:
+			// The length is known, so the request carries Content-Length.
+			// Wrapping these would send the body chunked, which the API
+			// ignores: PATCH and PUT bodies arrived empty.
+		default:
+			// Limit request body size to prevent memory exhaustion
+			body = io.LimitReader(data, 100*1024*1024) // 100MB limit
+		}
 	}
 
 	requestURL := c.baseURL() + resource
diff --git a/client_test.go b/client_test.go
index aa41341..e543e41 100644
--- a/client_test.go
+++ b/client_test.go
@@ -26,6 +26,8 @@ func (t *testTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	if err != nil {
 		return nil, err
 	}
+	// Keep the length, so tests see the body as the real server would.
+	testReq.ContentLength = req.ContentLength
 
 	// Copy headers
 	testReq.Header = req.Header.Clone()
diff --git a/integration_test.go b/integration_test.go
new file mode 100644
index 0000000..e3ca8e6
--- /dev/null
+++ b/integration_test.go
@@ -0,0 +1,569 @@
+//go:build integration
+
+// Integration tests against the real Yandex.Disk API. They do not run with a
+// plain `go test`; run them with a token of an account you can spare:
+//
+//	YANDEX_DISK_ACCESS_TOKEN=... go test -tags integration -run Integration -v ./
+//
+// Everything they create lives in one new folder, disk:/disk-it-<time>, which
+// is deleted at the end, permanently. A guard in the HTTP transport refuses
+// any request that would change something outside that folder, or any trash
+// item the tests did not put there, and never lets the whole trash be
+// emptied. Calls that read the whole Disk (disk info, file lists) only log
+// counts, never names.
+package disk
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// guard is an http.RoundTripper that lets a request through only if every
+// path it changes is inside root, or is a trash item the tests created.
+type guard struct {
+	base  http.RoundTripper
+	root  string // "disk:/disk-it-..."
+	mu    sync.Mutex
+	trash map[string]bool // trash paths whose origin is inside root
+}
+
+func (g *guard) allowTrash(path string) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.trash[path] = true
+}
+
+func (g *guard) inside(p string) bool {
+	if !strings.HasPrefix(p, "disk:") {
+		p = "disk:" + p
+	}
+	return p == g.root || strings.HasPrefix(p, g.root+"/")
+}
+
+func (g *guard) RoundTrip(r *http.Request) (*http.Response, error) {
+	// Reads cannot change anything, and uploads go to the storage host with
+	// a link the API issued for a path the guard already checked.
+	if r.Method == http.MethodGet || r.URL.Host != "cloud-api.yandex.net" {
+		return g.base.RoundTrip(r)
+	}
+	q := r.URL.Query()
+	isTrash := strings.Contains(r.URL.Path, "/trash/")
+	if isTrash && q.Get("path") == "" {
+		return nil, fmt.Errorf("guard: refusing %s %s without a path: it would touch the whole trash", r.Method, r.URL.Path)
+	}
+	for _, key := range []string{"path", "from", "save_path"} {
+		v := q.Get(key)
+		if v == "" {
+			continue
+		}
+		if strings.HasPrefix(v, "trash:") {
+			g.mu.Lock()
+			ok := g.trash[v]
+			g.mu.Unlock()
+			if !ok {
+				return nil, fmt.Errorf("guard: refusing %s on trash item %s the tests did not create", r.Method, v)
+			}
+			continue
+		}
+		if !g.inside(v) {
+			return nil, fmt.Errorf("guard: refusing %s with %s=%s outside %s", r.Method, key, v, g.root)
+		}
+	}
+	return g.base.RoundTrip(r)
+}
+
+type sandbox struct {
+	t     *testing.T
+	c     *Client
+	g     *guard
+	root  string
+	ctx   context.Context
+	local string // local temp dir
+}
+
+func (s *sandbox) p(name string) string { return s.root + "/" + name }
+
+// waitOperation follows a background operation behind link until it ends.
+func (s *sandbox) waitOperation(link *Link) {
+	s.t.Helper()
+	if link == nil || !strings.Contains(link.Href, "/operations/") {
+		return // finished at once
+	}
+	deadline := time.Now().Add(2 * time.Minute)
+	for time.Now().Before(deadline) {
+		op, err := s.c.GetOperationStatus(s.ctx, link.Href)
+		if err != nil {
+			s.t.Fatalf("operation status: %v", err)
+		}
+		switch op.Status {
+		case "success":
+			return
+		case "failed":
+			s.t.Fatalf("operation %s failed", link.Href)
+		}
+		time.Sleep(time.Second)
+	}
+	s.t.Fatalf("operation %s did not finish in time", link.Href)
+}
+
+// waitFor polls cond until it holds, for things the API applies eventually.
+func (s *sandbox) waitFor(what string, cond func() bool) {
+	s.t.Helper()
+	for i := 0; i < 30; i++ {
+		if cond() {
+			return
+		}
+		time.Sleep(time.Second)
+	}
+	s.t.Fatalf("timed out waiting for %s", what)
+}
+
+func (s *sandbox) file(name, content string) string {
+	s.t.Helper()
+	p := filepath.Join(s.local, strings.ReplaceAll(name, "/", "_"))
+	if err := os.WriteFile(p, []byte(content), 0o600); err != nil {
+		s.t.Fatal(err)
+	}
+	return p
+}
+
+func (s *sandbox) upload(name, content string) {
+	s.t.Helper()
+	if _, err := s.c.UploadFileFromPath(s.ctx, s.file(name, content), s.p(name), &UploadOptions{Overwrite: true}); err != nil {
+		s.t.Fatalf("upload %s: %v", name, err)
+	}
+}
+
+func (s *sandbox) exists(name string) bool {
+	_, errResp := s.c.GetMetadata(s.ctx, s.p(name))
+	return errResp == nil
+}
+
+// trashItem finds the trash entry deleted from s.p(name) and lets the guard
+// touch it.
+func (s *sandbox) trashItem(name string) string {
+	s.t.Helper()
+	origin := s.p(name)
+	var found string
+	s.waitFor("trash entry of "+name, func() bool {
+		list, err := s.c.ListTrashResourcesWithOptions(s.ctx, "", &TrashListOptions{Limit: 100, Sort: "-deleted"})
+		if err != nil {
+			s.t.Fatalf("list trash: %v", err)
+		}
+		for _, item := range list.Items {
+			if item.OriginPath == origin {
+				found = item.Path
+				return true
+			}
+		}
+		return false
+	})
+	s.g.allowTrash(found)
+	return found
+}
+
+func TestIntegration(t *testing.T) {
+	token := os.Getenv("YANDEX_DISK_ACCESS_TOKEN")
+	if token == "" {
+		t.Skip("set YANDEX_DISK_ACCESS_TOKEN to run against the real API")
+	}
+	client, err := New(token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client.Logger.SetLevel(SILENT)
+
+	root := "disk:/disk-it-" + time.Now().Format("20060102-150405")
+	g := &guard{base: client.HTTPClient.Transport, root: root, trash: map[string]bool{}}
+	if g.base == nil {
+		g.base = http.DefaultTransport
+	}
+	client.HTTPClient.Transport = g
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+	s := &sandbox{t: t, c: client, g: g, root: root, ctx: ctx, local: t.TempDir()}
+	t.Logf("sandbox: %s", root)
+
+	if _, errResp := client.CreateDir(ctx, root); errResp != nil {
+		t.Fatalf("create sandbox: %+v", errResp)
+	}
+	t.Cleanup(func() {
+		cctx, ccancel := context.WithTimeout(context.Background(), 2*time.Minute)
+		defer ccancel()
+		if err := client.DeleteResourceWithOptions(cctx, root, &DeleteOptions{Permanently: true}); err != nil {
+			t.Errorf("CLEANUP FAILED, delete %s by hand: %v", root, err)
+			return
+		}
+		t.Logf("sandbox deleted permanently: %s", root)
+	})
+
+	t.Run("read-only overview", func(t *testing.T) {
+		s.t = t
+		info, err := client.DiskInfo(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if info.TotalSpace <= 0 || info.User == nil {
+			t.Errorf("disk info looks empty: total=%d", info.TotalSpace)
+		}
+		t.Logf("disk: %s of %s used, paid=%v, max file %s",
+			FormatFileSize(info.UsedSpace), FormatFileSize(info.TotalSpace), info.IsPaid, FormatFileSize(info.MaxFileSize))
+		if files, errResp := client.GetSortedFilesWithPagination(ctx, &PaginationOptions{Limit: 3}); errResp != nil {
+			t.Errorf("flat file list: %+v", errResp)
+		} else {
+			t.Logf("flat file list: %d items on the first page", len(files.Items))
+		}
+		if last, errResp := client.GetLastUploadedResourcesWithOptions(ctx, &PaginationOptions{Limit: 3}, &FilesOptions{MediaType: []string{"image"}}); errResp != nil {
+			t.Errorf("last uploaded: %+v", errResp)
+		} else {
+			t.Logf("last uploaded images: %d", len(last.Items))
+		}
+		if pub, errResp := client.GetPublicResourcesWithOptions(ctx, &PaginationOptions{Limit: 3}, nil); errResp != nil {
+			t.Errorf("public resources: %+v", errResp)
+		} else {
+			t.Logf("public resources: %d on the first page", len(pub.Items))
+		}
+		if trash, err := client.ListTrashResourcesWithOptions(ctx, "", &TrashListOptions{Limit: 3}); err != nil {
+			t.Errorf("trash: %v", err)
+		} else {
+			t.Logf("trash: %d items in total", trash.Total)
+		}
+	})
+
+	t.Run("folders", func(t *testing.T) {
+		s.t = t
+		if errResp := client.CreateDirAll(ctx, s.p("a/b/c")); errResp != nil {
+			t.Fatalf("%+v", errResp)
+		}
+		res, errResp := client.GetMetadata(ctx, s.p("a/b/c"))
+		if errResp != nil || res.Type != "dir" {
+			t.Fatalf("metadata: %+v %+v", res, errResp)
+		}
+		if errResp := client.CreateDirAll(ctx, s.p("a/b/c")); errResp != nil {
+			t.Errorf("CreateDirAll on an existing path must succeed: %+v", errResp)
+		}
+	})
+
+	t.Run("upload, overwrite and download", func(t *testing.T) {
+		s.t = t
+		s.upload("hello.txt", "hello, disk")
+		res, errResp := client.GetMetadata(ctx, s.p("hello.txt"))
+		if errResp != nil || res.Size != int64(len("hello, disk")) {
+			t.Fatalf("metadata: %+v %+v", res, errResp)
+		}
+
+		// Uploading over it without overwrite must be refused...
+		_, err := client.UploadFileFromPath(ctx, s.file("v2.txt", "second version"), s.p("hello.txt"), &UploadOptions{})
+		if err == nil {
+			t.Error("upload over an existing file without overwrite should fail")
+		}
+		// ...and with overwrite must replace it (the 409 bug of v1.3).
+		if _, err := client.UploadFileFromPath(ctx, s.file("v2.txt", "second version"), s.p("hello.txt"), &UploadOptions{Overwrite: true}); err != nil {
+			t.Fatalf("overwrite upload: %v", err)
+		}
+
+		dst := filepath.Join(s.local, "downloaded.txt")
+		if err := client.DownloadFileToPath(ctx, s.p("hello.txt"), dst, &DownloadOptions{Overwrite: true}); err != nil {
+			t.Fatal(err)
+		}
+		got, _ := os.ReadFile(dst)
+		if string(got) != "second version" {
+			t.Errorf("downloaded %q, want the overwritten content", got)
+		}
+		if link, errResp := client.GetDownloadURL(ctx, s.p("hello.txt")); errResp != nil || link.Href == "" {
+			t.Errorf("download URL: %+v %+v", link, errResp)
+		}
+	})
+
+	t.Run("large upload in chunks", func(t *testing.T) {
+		s.t = t
+		data := bytes.Repeat([]byte("0123456789abcdef"), 6*1024*1024/16) // 6 MB
+		local := filepath.Join(s.local, "big.bin")
+		if err := os.WriteFile(local, data, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		res, err := client.UploadLargeFileFromPath(ctx, local, s.p("big.bin"), 2, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if res.Size != int64(len(data)) {
+			t.Errorf("size = %d, want %d", res.Size, len(data))
+		}
+	})
+
+	t.Run("custom properties", func(t *testing.T) {
+		s.t = t
+		props := map[string]map[string]string{"custom_properties": {"suite": "disk-it"}}
+		if _, errResp := client.UpdateMetadata(ctx, s.p("hello.txt"), props); errResp != nil {
+			t.Fatalf("%+v", errResp)
+		}
+		res, errResp := client.GetMetadataWithOptions(ctx, s.p("hello.txt"), &ResourceOptions{Fields: []string{"custom_properties"}})
+		if errResp != nil {
+			t.Fatal(errResp)
+		}
+		if m, _ := res.CustomProperties.(map[string]any); m["suite"] != "disk-it" {
+			t.Errorf("custom properties = %v", res.CustomProperties)
+		}
+	})
+
+	t.Run("listing pages", func(t *testing.T) {
+		s.t = t
+		if errResp := client.CreateDirAll(ctx, s.p("list")); errResp != nil {
+			t.Fatal(errResp)
+		}
+		for i := 0; i < 7; i++ {
+			s.upload(fmt.Sprintf("list/f%02d.txt", i), "x")
+		}
+		var names []string
+		for offset := 0; ; offset += 3 {
+			page, errResp := client.GetMetadataWithOptions(ctx, s.p("list"), &ResourceOptions{Limit: 3, Offset: offset, Sort: "name"})
+			if errResp != nil {
+				t.Fatal(errResp)
+			}
+			for _, item := range page.Embedded.Items {
+				names = append(names, item.Name)
+			}
+			if offset+3 >= page.Embedded.Total {
+				break
+			}
+		}
+		if len(names) != 7 || names[0] != "f00.txt" || names[6] != "f06.txt" {
+			t.Errorf("pages gave %v", names)
+		}
+	})
+
+	t.Run("copy, move and background operations", func(t *testing.T) {
+		s.t = t
+		link, errResp := client.CopyResource(ctx, s.p("hello.txt"), s.p("copy.txt"))
+		if errResp != nil {
+			t.Fatal(errResp)
+		}
+		s.waitOperation(link)
+		if _, errResp := client.CopyResource(ctx, s.p("hello.txt"), s.p("copy.txt")); errResp == nil {
+			t.Error("copy onto an existing file without overwrite should fail")
+		}
+		link, errResp = client.CopyResourceWithOptions(ctx, s.p("hello.txt"), s.p("copy.txt"), &CopyMoveOptions{Overwrite: true})
+		if errResp != nil {
+			t.Fatalf("copy with overwrite: %+v", errResp)
+		}
+		s.waitOperation(link)
+
+		link, errResp = client.MoveResource(ctx, s.p("copy.txt"), s.p("renamed.txt"))
+		if errResp != nil {
+			t.Fatal(errResp)
+		}
+		s.waitOperation(link)
+		if s.exists("copy.txt") || !s.exists("renamed.txt") {
+			t.Error("move did not rename")
+		}
+
+		// A forced background copy of a folder exercises GetOperationStatus.
+		link, errResp = client.CopyResourceWithOptions(ctx, s.p("list"), s.p("list-copy"), &CopyMoveOptions{ForceAsync: true})
+		if errResp != nil {
+			t.Fatalf("async copy: %+v", errResp)
+		}
+		if !strings.Contains(link.Href, "/operations/") {
+			t.Errorf("force_async did not return an operation: %s", link.Href)
+		}
+		s.waitOperation(link)
+		if !s.exists("list-copy/f06.txt") {
+			t.Error("async copy is missing files")
+		}
+	})
+
+	t.Run("batch operations", func(t *testing.T) {
+		s.t = t
+		ops := map[string]string{s.p("list/f00.txt"): s.p("batch-0.txt"), s.p("list/f01.txt"): s.p("batch-1.txt")}
+		status, err := client.BatchCopyFiles(ctx, ops, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := client.WaitForBatchOperation(ctx, status, time.Second); err != nil {
+			t.Fatal(err)
+		}
+		if status.Failed != 0 || !s.exists("batch-0.txt") || !s.exists("batch-1.txt") {
+			t.Errorf("batch copy: %+v", status.GetSummary())
+		}
+		del, err := client.BatchDeleteFilesSimple(ctx, []string{s.p("batch-0.txt"), s.p("batch-1.txt")}, true)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := client.WaitForBatchOperation(ctx, del, time.Second); err != nil {
+			t.Fatal(err)
+		}
+		if del.Failed != 0 {
+			t.Errorf("batch delete: %+v", del.GetSummary())
+		}
+	})
+
+	t.Run("publish and the public API", func(t *testing.T) {
+		s.t = t
+		if _, errResp := client.PublishResource(ctx, s.p("hello.txt")); errResp != nil {
+			t.Fatal(errResp)
+		}
+		res, errResp := client.GetMetadata(ctx, s.p("hello.txt"))
+		if errResp != nil || res.PublicURL == "" || res.PublicKey == "" {
+			t.Fatalf("no public link: %+v", errResp)
+		}
+		pub, errResp := client.GetMetadataForPublicResource(ctx, res.PublicKey)
+		if errResp != nil || pub.Name != "hello.txt" {
+			t.Errorf("public metadata: %+v %+v", pub, errResp)
+		}
+		if link, errResp := client.GetDownloadURLForPublicResource(ctx, res.PublicKey); errResp != nil || link.Href == "" {
+			t.Errorf("public download URL: %+v", errResp)
+		}
+		if errResp := client.CreateDirAll(ctx, s.p("saved")); errResp != nil {
+			t.Fatal(errResp)
+		}
+		link, errResp := client.SavePublicResourceWithOptions(ctx, res.PublicKey,
+			&SavePublicResourceOptions{SavePath: s.p("saved"), Name: "from-public.txt"})
+		if errResp != nil {
+			t.Errorf("save public resource into the sandbox: %+v", errResp)
+		} else {
+			s.waitOperation(link)
+			if !s.exists("saved/from-public.txt") {
+				t.Error("saved public resource is not where save_path said")
+			}
+		}
+		if _, errResp := client.UnpublishResource(ctx, s.p("hello.txt")); errResp != nil {
+			t.Fatal(errResp)
+		}
+		res, _ = client.GetMetadata(ctx, s.p("hello.txt"))
+		if res != nil && res.PublicURL != "" {
+			t.Error("still published after unpublish")
+		}
+	})
+
+	// Checked as a stranger would see the link: no token. The public API
+	// answers 403 for a link behind a password and 404 for an expired one.
+	t.Run("public link settings", func(t *testing.T) {
+		s.t = t
+		s.upload("settings.txt", "link settings")
+		path := s.p("settings.txt")
+		stranger := func() int {
+			res, errResp := client.GetMetadata(ctx, path)
+			if errResp != nil || res.PublicKey == "" {
+				t.Fatalf("not published: %+v", errResp)
+			}
+			u := "https://cloud-api.yandex.net/v1/disk/public/resources?public_key=" + url.QueryEscape(res.PublicKey)
+			req, _ := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
+			resp, err := http.DefaultClient.Do(req)
+			if err != nil {
+				t.Fatalf("stranger request: %v", err)
+			}
+			_ = resp.Body.Close()
+			return resp.StatusCode
+		}
+
+		if _, errResp := client.PublishResourceWithSettings(ctx, path, &PublicSettings{Password: "Disk-it-1234"}); errResp != nil {
+			t.Fatalf("publish with a password: %+v", errResp)
+		}
+		if code := stranger(); code != http.StatusForbidden {
+			t.Errorf("a stranger opened a password-protected link: %d", code)
+		}
+		_, _ = client.UnpublishResource(ctx, path)
+
+		expires := time.Now().Add(20 * time.Second)
+		if _, errResp := client.PublishResourceWithSettings(ctx, path, &PublicSettings{ExpiresAt: expires}); errResp != nil {
+			t.Fatalf("publish with an expiry: %+v", errResp)
+		}
+		info, errResp := client.GetPublicSettings(ctx, path)
+		if errResp != nil || info.ExpiresAt.Unix() != expires.Unix() {
+			t.Errorf("stored expiry = %+v %+v, want %v", info, errResp, expires.Unix())
+		}
+		if code := stranger(); code != http.StatusOK {
+			t.Errorf("the link is closed before it expires: %d", code)
+		}
+		time.Sleep(time.Until(expires) + 15*time.Second)
+		if code := stranger(); code != http.StatusNotFound {
+			t.Errorf("a stranger opened an expired link: %d", code)
+		}
+
+		_, _ = client.UnpublishResource(ctx, path)
+		if _, errResp := client.PublishResource(ctx, path); errResp != nil {
+			t.Fatal(errResp)
+		}
+		if errResp := client.UpdatePublicSettings(ctx, path, &PublicSettings{Password: "Disk-it-5678"}); errResp != nil {
+			t.Fatalf("add a password to an open link: %+v", errResp)
+		}
+		if code := stranger(); code != http.StatusForbidden {
+			t.Errorf("a stranger opened a link after a password was added: %d", code)
+		}
+		_, _ = client.UnpublishResource(ctx, path)
+	})
+
+	t.Run("upload from a URL", func(t *testing.T) {
+		s.t = t
+		link, errResp := client.UploadFile(ctx, s.p("license.txt"), "https://raw.githubusercontent.com/ilyabrin/disk/main/LICENSE")
+		if errResp != nil {
+			t.Fatal(errResp)
+		}
+		s.waitOperation(link)
+		s.waitFor("license.txt to arrive", func() bool { return s.exists("license.txt") })
+	})
+
+	t.Run("trash: delete, restore, delete for good", func(t *testing.T) {
+		s.t = t
+		s.upload("trash-me.txt", "bye")
+		if err := client.DeleteResource(ctx, s.p("trash-me.txt"), false); err != nil {
+			t.Fatalf("delete to trash: %v", err) // the 204 bug of v1.3
+		}
+		item := s.trashItem("trash-me.txt")
+		meta, err := client.GetTrashResourceMetadata(ctx, item, nil)
+		if err != nil || meta.OriginPath != s.p("trash-me.txt") {
+			t.Errorf("trash metadata: %+v %v", meta, err)
+		}
+		link, err := client.RestoreFromTrashWithOptions(ctx, item, &RestoreOptions{Overwrite: true})
+		if err != nil {
+			t.Fatal(err)
+		}
+		s.waitOperation(link)
+		if !s.exists("trash-me.txt") {
+			t.Fatal("not restored")
+		}
+
+		if err := client.DeleteResource(ctx, s.p("trash-me.txt"), false); err != nil {
+			t.Fatal(err)
+		}
+		item = s.trashItem("trash-me.txt")
+		if err := client.EmptyTrash(ctx, item, false); err != nil {
+			t.Fatalf("delete one trash item: %v", err)
+		}
+
+		// A permanent delete must skip the trash (the "permanent" bug of v1.3).
+		s.upload("gone.txt", "gone")
+		if err := client.DeleteResourceWithOptions(ctx, s.p("gone.txt"), &DeleteOptions{Permanently: true}); err != nil {
+			t.Fatal(err)
+		}
+		list, err := client.ListTrashResourcesWithOptions(ctx, "", &TrashListOptions{Limit: 50, Sort: "-deleted"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, it := range list.Items {
+			if it.OriginPath == s.p("gone.txt") {
+				t.Error("a permanent delete ended up in the trash")
+			}
+		}
+	})
+
+	t.Run("the guard holds", func(t *testing.T) {
+		s.t = t
+		_, errResp := client.CreateDir(ctx, "disk:/should-never-exist-"+time.Now().Format("150405"))
+		if errResp == nil || !strings.Contains(errResp.Error, "guard") {
+			t.Errorf("guard let a change outside the sandbox through: %+v", errResp)
+		}
+		if err := client.EmptyTrash(ctx, "", false); err == nil || !strings.Contains(err.Error(), "guard") {
+			t.Errorf("guard let the whole trash be emptied: %v", err)
+		}
+	})
+}
diff --git a/public_settings.go b/public_settings.go
new file mode 100644
index 0000000..136e585
--- /dev/null
+++ b/public_settings.go
@@ -0,0 +1,168 @@
+package disk
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// Rights a public link can grant, for [PublicAccess.Rights].
+const (
+	RightRead                            = "read"
+	RightReadWithoutDownload             = "read_without_download"
+	RightReadWithPassword                = "read_with_password"
+	RightReadWithPasswordWithoutDownload = "read_with_password_without_download"
+	RightWrite                           = "write"
+)
+
+// Audiences of a public link, for [PublicAccess.Macros].
+const (
+	MacroAll       = "all"       // anyone with the link
+	MacroEmployees = "employees" // only people in the organization OrgID
+)
+
+// PublicSettings protect a public link. Pass them to
+// [Client.PublishResourceWithSettings] or [Client.UpdatePublicSettings].
+//
+// Password and ExpiresAt work on personal accounts too; this was checked
+// against the live API, where the official reference differs in places.
+// Forbidding downloads is not possible through the public API: the web
+// interface uses an internal call for it.
+type PublicSettings struct {
+	// Password, when set, must be entered to open the link.
+	Password string
+	// ExpiresAt, when set, is the moment the link stops working.
+	ExpiresAt time.Time
+	// Accesses grant address access in Yandex 360 for business. Leave them
+	// empty on a personal account: there they close the link to everyone.
+	Accesses []PublicAccess
+}
+
+// PublicAccess grants rights over a public link to an audience in Yandex 360
+// for business.
+type PublicAccess struct {
+	// Macros name the audience: [MacroAll] or [MacroEmployees].
+	Macros []string `json:"macros,omitempty"`
+	// OrgID is the organization meant by [MacroEmployees].
+	OrgID int64 `json:"org_id,omitempty"`
+	// Type is "macro" for an audience given by Macros, which is filled in
+	// when left empty, or "user", "group", "department" or "outer_user"
+	// together with ID.
+	Type string `json:"type"`
+	ID   int64  `json:"id,omitempty"`
+	// Rights are what the audience may do, such as [RightRead].
+	Rights []string `json:"rights"`
+}
+
+func (s *PublicSettings) empty() bool {
+	return s == nil || (s.Password == "" && s.ExpiresAt.IsZero() && len(s.Accesses) == 0)
+}
+
+// body is the PATCH payload. The API takes the expiry as a Unix time in
+// seconds, not as a duration as the reference says, and wants "type" on
+// every access although the reference examples leave it out.
+func (s *PublicSettings) body() ([]byte, error) {
+	payload := map[string]any{}
+	if s.Password != "" {
+		payload["password"] = s.Password
+	}
+	if !s.ExpiresAt.IsZero() {
+		payload["available_until"] = s.ExpiresAt.Unix()
+	}
+	if len(s.Accesses) > 0 {
+		accesses := make([]PublicAccess, len(s.Accesses))
+		copy(accesses, s.Accesses)
+		for i := range accesses {
+			if accesses[i].Type == "" && len(accesses[i].Macros) > 0 {
+				accesses[i].Type = "macro"
+			}
+		}
+		payload["accesses"] = accesses
+	}
+	return json.Marshal(payload)
+}
+
+// PublishResourceWithSettings publishes the file or folder at path and
+// protects its link with settings. The API ignores settings sent along with
+// publishing, so this publishes first and then applies them. If applying
+// them fails, the resource is unpublished again rather than left open, and
+// the error is returned. With empty settings it is the same as
+// [Client.PublishResource].
+func (c *Client) PublishResourceWithSettings(ctx context.Context, path string, settings *PublicSettings) (*Link, *ErrorResponse) {
+	link, errResp := c.PublishResource(ctx, path)
+	if errResp != nil || settings.empty() {
+		return link, errResp
+	}
+	if errResp := c.UpdatePublicSettings(ctx, path, settings); errResp != nil {
+		_, _ = c.UnpublishResource(ctx, path)
+		return nil, errResp
+	}
+	return link, nil
+}
+
+// UpdatePublicSettings changes the protection of the already published file
+// or folder at path. Settings left empty are not changed.
+func (c *Client) UpdatePublicSettings(ctx context.Context, path string, settings *PublicSettings) *ErrorResponse {
+	if len(path) < 1 {
+		return &ErrorResponse{Error: "path cannot be empty"}
+	}
+	if settings.empty() {
+		return &ErrorResponse{Error: "settings cannot be empty"}
+	}
+
+	body, err := settings.body()
+	if err != nil {
+		return &ErrorResponse{Error: fmt.Sprintf("failed to encode settings: %v", err)}
+	}
+
+	query := url.Values{}
+	query.Set("path", path)
+
+	resp, err := c.doRequest(ctx, PATCH, "public/resources/public-settings?"+query.Encode(), bytes.NewReader(body))
+	if err != nil {
+		return &ErrorResponse{Error: fmt.Sprintf("request failed: %v", err)}
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	errResp, err := c.handleResponse(resp, []int{http.StatusOK, http.StatusNoContent})
+	if errResp != nil {
+		return errResp
+	}
+	if err != nil {
+		return &ErrorResponse{Error: err.Error(), StatusCode: resp.StatusCode}
+	}
+	return nil
+}
+
+// PublicSettingsInfo is what the API reports about a link's protection.
+type PublicSettingsInfo struct {
+	// ExpiresAt is when the link stops working, or zero for never.
+	ExpiresAt time.Time
+}
+
+// GetPublicSettings reads the protection of the published file or folder at
+// path. The API reports only the expiry; whether a password is set cannot
+// be read back.
+func (c *Client) GetPublicSettings(ctx context.Context, path string) (*PublicSettingsInfo, *ErrorResponse) {
+	if len(path) < 1 {
+		return nil, &ErrorResponse{Error: "path cannot be empty"}
+	}
+	query := url.Values{}
+	query.Set("path", path)
+
+	raw, errResp := requestJSON[struct {
+		AvailableUntil *int64 `json:"available_until"`
+	}](ctx, c, GET, "public/resources/public-settings?"+query.Encode(), nil)
+	if errResp != nil {
+		return nil, errResp
+	}
+	info := &PublicSettingsInfo{}
+	if raw.AvailableUntil != nil && *raw.AvailableUntil > 0 {
+		info.ExpiresAt = time.Unix(*raw.AvailableUntil, 0)
+	}
+	return info, nil
+}
diff --git a/public_settings_test.go b/public_settings_test.go
new file mode 100644
index 0000000..e65ef24
--- /dev/null
+++ b/public_settings_test.go
@@ -0,0 +1,125 @@
+package disk
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"sync"
+	"testing"
+	"time"
+)
+
+// settingsServer records the requests of a publish-with-settings flow and
+// answers the PATCH with patchStatus.
+type settingsServer struct {
+	mu       sync.Mutex
+	requests []string
+	patch    map[string]any
+}
+
+func (s *settingsServer) client(patchStatus int) *Client {
+	return mockedHttpClient(func(w http.ResponseWriter, r *http.Request) {
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		s.requests = append(s.requests, r.Method+" "+r.URL.Path)
+		switch r.Method {
+		case http.MethodPatch:
+			raw, _ := io.ReadAll(r.Body)
+			_ = json.Unmarshal(raw, &s.patch)
+			w.WriteHeader(patchStatus)
+			if patchStatus != http.StatusOK {
+				_, _ = w.Write([]byte(`{"error": "FieldValidationError", "description": "Bad."}`))
+			}
+		default:
+			_, _ = w.Write([]byte(`{"href": "https://cloud-api.yandex.net/v1/disk/resources?path=disk%3A%2Fa", "method": "GET"}`))
+		}
+	})
+}
+
+func TestPublishWithSettingsPublishesThenPatches(t *testing.T) {
+	var srv settingsServer
+	expires := time.Date(2026, 10, 9, 12, 0, 0, 0, time.UTC)
+	_, errResp := srv.client(http.StatusOK).PublishResourceWithSettings(context.Background(), "disk:/a",
+		&PublicSettings{Password: "secret", ExpiresAt: expires})
+	if errResp != nil {
+		t.Fatal(errResp)
+	}
+	want := []string{"PUT /v1/disk/resources/publish", "PATCH /v1/disk/public/resources/public-settings"}
+	if len(srv.requests) != 2 || srv.requests[0] != want[0] || srv.requests[1] != want[1] {
+		t.Errorf("requests = %v, want %v", srv.requests, want)
+	}
+	// The API takes the expiry as a Unix time, not as a duration.
+	if srv.patch["password"] != "secret" || srv.patch["available_until"] != float64(expires.Unix()) {
+		t.Errorf("patch body = %v", srv.patch)
+	}
+	if _, ok := srv.patch["accesses"]; ok {
+		t.Error("accesses must not be sent unless asked for: they close the link on personal accounts")
+	}
+}
+
+func TestPublishWithSettingsUnpublishesWhenTheyFail(t *testing.T) {
+	var srv settingsServer
+	_, errResp := srv.client(http.StatusBadRequest).PublishResourceWithSettings(context.Background(), "disk:/a",
+		&PublicSettings{Password: "secret"})
+	if errResp == nil {
+		t.Fatal("a failed PATCH must be reported")
+	}
+	last := srv.requests[len(srv.requests)-1]
+	if last != "PUT /v1/disk/resources/unpublish" {
+		t.Errorf("requests = %v; the link must not stay open without its protection", srv.requests)
+	}
+}
+
+func TestPublishWithEmptySettingsIsAPlainPublish(t *testing.T) {
+	var srv settingsServer
+	if _, errResp := srv.client(http.StatusOK).PublishResourceWithSettings(context.Background(), "disk:/a", &PublicSettings{}); errResp != nil {
+		t.Fatal(errResp)
+	}
+	if len(srv.requests) != 1 {
+		t.Errorf("requests = %v, want only the publish", srv.requests)
+	}
+}
+
+func TestAccessesGetTheirType(t *testing.T) {
+	body, err := (&PublicSettings{Accesses: []PublicAccess{{Macros: []string{MacroEmployees}, OrgID: 7, Rights: []string{RightRead}}}}).body()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got struct {
+		Accesses []map[string]any `json:"accesses"`
+	}
+	_ = json.Unmarshal(body, &got)
+	if len(got.Accesses) != 1 || got.Accesses[0]["type"] != "macro" {
+		t.Errorf("body = %s; the API rejects an access without a type", body)
+	}
+}
+
+func TestUpdatePublicSettingsRejectsEmptySettings(t *testing.T) {
+	var srv settingsServer
+	if errResp := srv.client(http.StatusOK).UpdatePublicSettings(context.Background(), "disk:/a", &PublicSettings{}); errResp == nil {
+		t.Error("empty settings must be refused before a request is made")
+	}
+	if len(srv.requests) != 0 {
+		t.Errorf("requests = %v", srv.requests)
+	}
+}
+
+func TestGetPublicSettingsReadsTheExpiry(t *testing.T) {
+	for body, want := range map[string]int64{`{"available_until": 1791419390}`: 1791419390, `{"available_until": null}`: 0} {
+		client := mockedHttpClient(func(w http.ResponseWriter, r *http.Request) {
+			_, _ = w.Write([]byte(body))
+		})
+		info, errResp := client.GetPublicSettings(context.Background(), "disk:/a")
+		if errResp != nil {
+			t.Fatal(errResp)
+		}
+		got := int64(0)
+		if !info.ExpiresAt.IsZero() {
+			got = info.ExpiresAt.Unix()
+		}
+		if got != want {
+			t.Errorf("%s: expires %d, want %d", body, got, want)
+		}
+	}
+}
diff --git a/request_body_test.go b/request_body_test.go
new file mode 100644
index 0000000..3f6d87c
--- /dev/null
+++ b/request_body_test.go
@@ -0,0 +1,27 @@
+package disk
+
+import (
+	"context"
+	"net/http"
+	"testing"
+)
+
+// Bodies of known length must go with Content-Length: sent chunked, the API
+// read PATCH and PUT bodies as empty.
+func TestJSONBodiesCarryContentLength(t *testing.T) {
+	var length int64
+	var chunked bool
+	client := mockedHttpClient(func(w http.ResponseWriter, r *http.Request) {
+		length = r.ContentLength
+		chunked = len(r.TransferEncoding) > 0
+		_, _ = w.Write([]byte(`{"name": "a", "path": "disk:/a", "type": "file"}`))
+	})
+
+	props := map[string]map[string]string{"custom_properties": {"k": "v"}}
+	if _, errResp := client.UpdateMetadata(context.Background(), "disk:/a", props); errResp != nil {
+		t.Fatal(errResp)
+	}
+	if length <= 0 || chunked {
+		t.Errorf("Content-Length = %d, chunked = %v; want a known length", length, chunked)
+	}
+}