Portfolio DAM (ex-Extensis Portfolio) API

Authentication

Session login S1 S5

1. GET/v1/auth/public-key → {modulusBase16, exponent} (RSA public key).
2. Encrypt the password with that key, Base64-encode it.
3. POST/v1/auth/login with JSON {"userName": "…", "encryptedPassword": "…"} → {"session": "<id>"}. Errors: 401 InvalidCredentials; 500 LicenseCountExceeded | UnexpectedError | OperationTimedOut.
4. Pass ?session=<id> on every call (66 of 73 operations declare it; the unauthenticated ones are /_api_version, /v1/auth/login, /v1/auth/public-key, /v1/server/status, /v1/videoExtensions, /v1/audioExtensions, /v1/branding-settings).
5. POST/v1/auth/logout ends the session.

The SOAP API uses the same pattern (getRSAPublicEncryptionKey → login → session ID) S4 S5.

API Token S12

• Created in Portfolio Administration: Users → Add → Add New API Token, choosing a role to apply in all catalogs; per-catalog roles can be changed afterwards.
• The token value is used instead of a session ID, so no login call is needed and the connection never times out.
• Directory-service (AD) accounts cannot log in to Portfolio Administration; administration needs native accounts S13.

Transport: HTTPS on 9443 requires a custom (non-self-signed) certificate configured by the administrator S13.

Core resources

Paths are relative to {server}:8090/api. Inventory parsed from the spec S1.

Not exposed in the documented REST API S1: user/role/group administration, catalog creation, field creation, directory-service and licence settings, NetPublish site management, Smart Keyword execution. The SOAP WSDL additionally covers presets, view settings, user preferences, ingest config, server features and addAssetsByPath S4.

Data model

S1 unless noted.

• Catalog — catalogId (GUID-style string), name, details[]. Access and roles are granted per catalog S15.
• Asset — assetId (string; numeric IDs appear in examples), locked, and attributes[]: a list of {name, values[]} pairs keyed by field name (e.g. Filename, File Size, Keywords), i.e. every field is multi-valued in transport. The fields returned are those listed in the query's fields array, otherwise a default set. The internal asset ID is also exported as RID S45.
• Field definition — id, systemName, internalName, localizedNames[], numeric type, multivalued, hierarchical, hasPredefinedValues, predefinedValues[], nestedPredefinedValues[], usePredefinedOnly, maxLength, precision, defaultValues[], searchable, sortable, embeddable, extractable, systemField.
• Gallery — galleryId, name, owner, type (saved/smart), accessType, and savedFind (an AssetQueryTerm, so smart galleries are stored queries).
• Watch folder — watchFolderId, path, sync settings; folder paths use a Portfolio path syntax (::FileServer:Volume:folder) in SOAP examples S7.
• Job — jobId, catalogId, description, status ∈ retrieving, queued, inProgress, complete, canceled, timestamps, details.
• Errors — {faultCode, message}; fault codes include InvalidCredentials, InvalidParameters, ItemNotFound, LicenseCountExceeded, UnexpectedError, OperationTimedOut.

Search & querying

Uploads & binaries

• Upload: multipart/form-data POST to /v1/catalog/{catalog_id}/upload (fields path, file, ingestFields) or to a specific watch folder (…/watchfolder/{id}/upload, plus filename) S1. Single request per file; chunked/resumable upload is not documented. The SOAP-era servlet POST/FileTransfer/upload (fields sessionId, catalogId, destinationFolder, filename, action=upload|customPreview, Filedata) returns the new asset ID and also sets custom previews S7.
• Download: original (_content, _original), preview, thumbnail (optionally a given version), video stream with HTTP Range (source=preview|original) S1.
• On-the-fly conversion: _derivative with imageOptions JSON (outputFileFormat, colorMode RGB/CMYK/Grayscale, resizeWidth/resizeHeight, compressionQuality 1–100, source preview/original, videoFrameTime, resolution, compressionType, endian); single asset → streamed file, several → ZIP, async=true → job ID S1. Extra output formats need a Media Engine licence S25.
• Batch jobs: POST/v1/job/run with an asset query and task list (e.g. convert with settings), then poll /_status and fetch results; client-side jobs are retained 24 h S39 S1.
• No signed/expiring public URLs or CDN; all binary access goes through the authenticated server S1.

Events & webhooks

• No webhook subscription API and no outbound HTTP events in the REST or SOAP specs S1 S4.
• Server-side scripting (alternative): JavaScript files in Portfolio Server/data/custom-scripts declare triggerPoints (onCataloged, onMetadataUpdated, onGalleryChanged, onJobInitialize, onJobEachAsset, onJobFinalize), an optional cron scheduleInfo, required permissions and a client menu label; a global portfolio object exposes server functions S8. Since 4.0.1, Java reflection from scripts is blocked (CVE-2022-24252 fix) and can only be re-enabled by disabling that protection S41. The new owner lists scripting as "no longer actively supported" S10.
• Built-in non-API notifications: daily "query to email" digest, email on gallery changes/backups S10 S40.

Limits & quirks

• Self-hosted endpoints: base URL, ports and TLS depend on each installation; default ports 8090 (HTTP) / 9443 (HTTPS) are shared by Portfolio Web and the API S14. Exposing the server to the Internet is possible but "not necessarily recommended"; VPN is the advised pattern S37 S80.
• Session in the query string: session= (or the API Token) travels as a URL parameter on every call, so it can end up in proxy/server logs S1 Unverified (observation from the spec, not a vendor statement).
• GET with a JSON body: GET/v1/catalog/{id}/asset and DELETE/v1/catalog/{id}/asset take their query in the request body; prefer POST…/asset for search S1.
• Spec inconsistency: prose examples write the query term key as field, while the schema names it fieldName S1 Unverified (test against your server).
• Stale references: several operations link to the SOAP docs for details (externalDocs → soap_assets_AssetSEIService.html), and many responses are typed only as JSONObject / default response S1.
• Licensed connections: logins count against licensed user connections (LicenseCountExceeded); API Tokens don't S12 S1.
• Versioning/locking endpoints only work on Vault catalogs S1 S26.
• Rate limits / payload limits: Not public.
• Doc ownership: the API reference is still hosted by Extensis (doc.extensis.com) and API support links still point to an Extensis form after the sale S11 Unverified (possible future move).

SDKs, tools & code samples

No npm/PyPI/NuGet/Maven package from the vendor was found; the Extensis GitHub organisation holds no Portfolio SDK S75.

Changelog of the API