API overview¶
The DMS API is a JSON API under /api/v1. It is used by the DMS web UI, mobile
clients, and integrations.
Authentication¶
| Client | Method |
|---|---|
| Browser | Server-side session with CSRF protection |
| Integration | Per-user API key in Authorization: Bearer ldk_... or X-API-Key |
| Mobile | Bearer JWT from /api/v1/mobile/auth |
| BPM webhooks | HMAC signature under /bpm |
API-key requests do not need a CSRF token. They still require TLS and a key with the right scopes.
Conventions¶
- Requests and responses use JSON.
- List endpoints are paginated.
- Errors return a structured JSON response with an HTTP status code.
- Dates and times follow the workspace and user time zone settings where the endpoint supports it.
Endpoint groups¶
- documents and files;
- Explorer and folders;
- search and saved searches;
- users, groups, departments, and roles;
- administration and configuration;
- BPM integration, uploads, and webhooks.
OpenAPI¶
When enabled, the OpenAPI schema is available at /openapi.json, with Swagger at
/docs and ReDoc at /redoc. See OpenAPI.
Expose the API deliberately
Do not expose the API directly to the internet without TLS and the network controls your organization requires. Use scoped API keys and rotate them.