diff --git a/chfs-ng/internal/api/server.go b/chfs-ng/internal/api/server.go
index 2d6ae98..d842e37 100644
--- a/chfs-ng/internal/api/server.go
+++ b/chfs-ng/internal/api/server.go
@@ -177,7 +177,9 @@ func (s *Server) files(w http.ResponseWriter, r *http.Request) {
 	}
 	list, e := s.Store.List(p)
 	if e != nil {
-		http.Error(w, e.Error(), 404)
+		// CHFS treats a non-directory / nonexistent filepath as a malformed
+		// files request rather than exposing the filesystem error.
+		writeJSONError(w, http.StatusBadRequest, "invalid parameter")
 		return
 	}
 	out := make([]fileInfo, 0, len(list))