Folders: Forbid performing operations on folders via dashboards HTTP API (#81264)

* Forbid creating folders via dashboard api

* Update delete endpoint

* Update docs

pkg/api/dashboard.go

@@ -303,6 +303,10 @@ func (hs *HTTPServer) deleteDashboard(c *contextmodel.ReqContext) response.Respo
 		return dashboardGuardianResponse(err)
 	}
 
+	if dash.IsFolder {
+		return response.Error(http.StatusBadRequest, "Use folders endpoint for deleting folders.", nil)
+	}
+
 	namespaceID, userIDStr := c.SignedInUser.GetNamespacedID()
 
 	// disconnect all library elements for this dashboard
@@ -356,6 +360,7 @@ func (hs *HTTPServer) deleteDashboard(c *contextmodel.ReqContext) response.Respo
 // Create / Update dashboard
 //
 // Creates a new dashboard or updates an existing dashboard.
+// Note: This endpoint is not intended for creating folders, use `POST /api/folders` for that.
 //
 // Responses:
 // 200: postDashboardResponse
@@ -375,6 +380,10 @@ func (hs *HTTPServer) PostDashboard(c *contextmodel.ReqContext) response.Respons
 }
 
 func (hs *HTTPServer) postDashboard(c *contextmodel.ReqContext, cmd dashboards.SaveDashboardCommand) response.Response {
+	if cmd.IsFolder {
+		return response.Error(http.StatusBadRequest, "Use folders endpoint for saving folders.", nil)
+	}
+
 	ctx := c.Req.Context()
 	var err error