Scope: the public IntelligenceBank API as documented on the vendor's Postman Documenter sites — the current Graph API (v3) and the legacy v2 calls that are still used to sign in. Despite its name, the "Graph API" is not GraphQL: it is a JSON-over-HTTPS API whose list queries are shaped by modifiers written into the URL path S1 S5. Marketing compliance (Content Risk Review) endpoints are covered briefly.

At a glance

API styles

REST-like JSON over HTTPS; list modifiers in the path (.limit(), .order(), .fields()); a generic POST/api/json endpoint accepts any call as a JSON body S1 S5. No GraphQL schema, no OpenAPI document S1

Base URL(s)

Login (v2): regional host https://api{us|ca|eu|au}.intelligencebank.com/webapp/1.0/login (US, Canada, UK, Australia; apius is the global fallback) S6 S1. Graph API (v3): {apiV3url}/api/{3.0.0|3.0.1}/{clientid}/…, where apiV3url and clientid come back from the login call (vendor example host https://lbv3us1.intelligencebank.com) S1. Platform (browser login, emulation): https://{tenant}.intelligencebank.com/… S1 S8

Current version(s) & deprecations

Graph API v3, with two live minor versions in URLs: 3.0.0 (94 requests in the collection) and 3.0.1 (33); 3.0.1 returns validation errors as 422 instead of 400, and some newer calls (Collections, Filters create/update) exist only in 3.0.1 S1 S4. v2 "Legacy API Calls": all non-login v2 calls were scheduled for termination on 2022-07-01 or 2022-12-31; v2 login has "no planned termination" S3

Auth methods

(1) Standard login: username + password + platform URL → session id sid; (2) Browser login (3 steps, for SSO/2FA users) → sid; (3) OAuth 2.0 client credentials ("Beta", server-to-server) → Bearer token. All three end in v3 calls S1 S5

Token lifetime / refresh

sid lasts as long as the user session; long-running integrations must sign in again S5. Login responses carry logintimeoutperiod (vendor example: 120; unit not stated) S1 Unverified. OAuth access token: standard TTL 15 minutes, no refresh token (re-request) S5

Scopes / permission model

Calls run as the signed-in user, with exactly that user's folder/module permissions; vendor advises a dedicated integration user S5. OAuth scope ibapi/sys_integration (single scope); OAuth credentials are bound to a nominated user S1 S5. Main Admins can emulate another user S1

Official spec

Public Postman collection (v2.0.0 schema, 146 requests, published 2026-07-29) rendered at apidoc.intelligencebank.com S1 S2 S4; legacy v2 collection at legacyapidoc.intelligencebank.com S3. Archived copies on DAM Wiki: API spec downloads

Rate limits

600 calls/minute per user account (help center and the collection's error table, HTTP 429 error.api.rate_limit_reached) S5 S4; the collection's "Limits" section says 1,800/minute per user, tracked per cluster node S4 Unverified (contradiction, see Limits & quirks). Plus a daily, monthly or yearly call allowance per platform, and 10 OAuth tokens per 10 minutes per platform S4 S5

Pagination

Offset/limit encoded in the path: object.limit(offset, n), default 10 results, max 100 per call; responses include count and offset S1

Webhooks / events

None documented in the API reference S1. Event-style automation goes through the public Zapier app (21 triggers) or vendor-run "Handshakes" processed every 1–15 minutes S9 S10

Official SDKs

No general-purpose SDK. Vendor-published building blocks: React UI component packages for integrations on npm (@intelligencebank/connectingib 5.3.0, UNLICENSED) S13; connector packages on NuGet (Umbraco, Optimizely) S14; an MCP server for querying the API documentation on GitHub S11

Sandbox / trial access

API access is an optional add-on, not enabled on every platform; the call allowance is agreed in the subscription S5. No public sandbox; the docs suggest testing with the Postman collection against your own platform S5 S4

Authentication

Step 0 — find the hosts S1 S6

GEThttps://{tenant}.intelligencebank.com/v1/auth/app/getYapiAddress returns the v2 login host (content), or pick the regional host from the help center list.
GET{apiV3url}/api/clientInfo?clientUrl={tenant host} (also https://{tenant}.intelligencebank.com/api/clientInfo?verbose) returns platform info such as clientid and apiv3url without authentication; server-to-server integrations use it instead of a login response. Probing the shared v3 host without a platform returns 404 error.site.not_found S16.

Standard login (v2 call, used for v3) S1

POST{apiV2url}/webapp/1.0/login, application/x-www-form-urlencoded: p70 = username/e-mail, p80 = password, p90 = platform URL without https://, optional p60 = product key issued by IntelligenceBank.
Response: sid, clientid, apiV3url, apikey, useruuid, logintimeoutperiod, branding and feature flags.
Subsequent v3 calls send header sid: {sid} and put clientid in the path. Not usable when SSO or 2FA is enforced.

Browser login (SSO / 2FA) S1 S5

GEThttps://{tenant}.intelligencebank.com/v1/auth/app/token → a short token in content.
Open https://{tenant}.intelligencebank.com/auth/?login=0&token={token}&redirectUrl=… in a browser window (not an iframe); the user signs in (password, 2FA or IdP) and confirms access for the external app. login=1 forces the sign-in form on sites with public access.
Poll GEThttps://{tenant}.intelligencebank.com/v1/auth/app/info?token={token}: 404 until confirmed, then a session (sid, user uuid, login time) plus the same info block as the standard login.

redirectUrl (from platform release 4.64.1) sends the browser back to the integration after confirmation; the host must be registered with IntelligenceBank support, HTTPS only; invalid values are silently ignored.

OAuth 2.0 server-to-server (Beta) S1 S5

Credentials (client ID, secret, token endpoint) are requested from the Customer Success Manager or helpdesk, for a named user whose permissions the token inherits.
POST{provided_token_endpoint} — an Amazon Cognito /oauth2/token endpoint — with grant_type=client_credentials, scope=ibapi/sys_integration, client authentication client_secret_basic (or id/secret in the body).
Use Authorization: Bearer {access_token} instead of the sid header; get apiV3url/clientid from the unauthenticated clientInfo call. TTL 15 min; token issuance is rate-limited (10 per 10 min per platform), so caching is expected.

Emulation S1: GEThttps://{tenant}.intelligencebank.com/v1/core/user/{userUuid}/emulate?p10={apikey}&p20={useruuid}&fromApi=true (Main Admin only; one active emulation per user); GET…/restore?… ends it.

Core resources

Paths are relative to {apiV3url}/api/{version}/{clientid}; ?productkey= and &verbose (adds human-readable error messages) are accepted on most calls. Inventory parsed from the collection S1.

Resource	Endpoints	Notes
Resources (assets) — list/search	GET`resource.limit(o,n).order(f:-1).fields(…).includeAmaTags(…)?searchParams[…]`; POST`/api/json` (table `resource…`)	DAM assets are "Resources"; see Search & querying
Resources — CRUD	POST`resource` (file, URL, remote, alias types), POST`resource?action=bulkCreate`, PUT`resource/{id}`, DELETE`resource/{id}`, POST`resource?action=bulkEdit` (move), POST`resource?action=bulkDelete`	Create/update accept `requestApproval`, `postAutoTag`, `postFacialRecognition`; publish-approval folders return the workflow requirements as an error payload
Check-out / check-in	PUT`resource/{id}?action=checkout`, `?action=checkin`	Lock while editing
Resource detail & delivery	GET`resource/{id}?action=info` (incl. HLS `.m3u8` preview stream for video), `?action=preview&page=` (watermarked per folder/resource settings), `?action=download&version=&ext=`, `?action=download&preset={id}`, `?action=download&manualTransform&size=&crop=&cropgravity=…` (3.0.1), `?action=share`	Public share link only if the resource is public (`isPublic`)
Versions & revisions	GET`version/{resourceId}`; POST`revision` (revision of a workflow request or record file)	DAM versions vs approval revisions are separate concepts S41
Custom metadata schema	GET`customform/resource`; GET`resource?action=get_custom_upload_fields_info&folder=`	Custom Upload Fields are returned as `formData` sections/fields
Filters (global taxonomies)	GET`filter.limit(100)`, GET`filter/{id}`, POST`filter`, PATCH`filter/{id}`, DELETE`filter/{id}` (create/update/delete on 3.0.1)	Multilingual names/values; max 100 values per filter, 500 filters per platform
Folders	GET`folder.limit(o,n)?searchParams[parent]=…`, POST`/api/json`, POST`folder` (Beta), PUT`folder/{id}` (Beta), DELETE`folder/{id}` ("Coming Soon")	Folder names ≤ 255 chars, unique per parent
Collections	GET`collections.limit(…)`, GET`collections/{id}`, POST`collections`, PATCH`collections/{id}`, DELETE`collections/{id}`, actions `bulkDelete`, `bulkEdit`, `empty`, `bulkEmpty`, `addItems`, `removeItems`, `getItems`, `bulkGetItems`, `getCollectionDetails`	3.0.1 only; 32-char `_id` or short `id`; bulk ops ≤ 300 collections
Presets (renditions)	GET`preset.limit(100)` (single presets per resource, global presets)	Transformation presets used by downloads and public links
Public share links	`GET/POST/PUT/DELETE customshare[/{id}]`	Custom multi-asset share links with optional expiry
Permissions	GET`permission.limit(100)/{folderId}?module=resource&controller=folder`, PATCH`permission/{folderId}…` (group custom permissions); database and record variants	Folder-level group permissions
Users & groups	GET`user.limit(…)`, POST`/api/json`, GET`user?action=settings`; GET`group…`, GET`group/{id}`, POST`group`, PUT`group/{id}`, DELETE`group/{id}`; GET`division…`	No user create/update endpoint in the collection (users are read-only)
Uploads	POST`file` (standard, ≤ 2 GB), GET`file?action=start_upload` + POST`file?action=upload_chunk`, S3 direct (`presignStandardUpload`, `completePresignedStandardUpload`) and S3 multipart (`initS3MultipartUpload`, `s3PresignChunks`, `s3UpdateChunksStatuses`, `completeS3MultipartUpload`, `resetS3PendingChunks`, `s3Re-signChunks`), GET`file?action=metadataExtraction`	See Uploads & binaries
Related items	POST`related?action=bulkRelate` / `bulkDetach`, GET`related.limit(100)?action=details`, `?action=summary`	Links between assets, folders, records, databases
Markup comments	GET`comment…`, `GET/POST/PUT/DELETE comment[/{id}]`, DELETE`sessionDigest/{id}`	Proofing annotations
Workflows (approvals)	`workflowrequest` (list, view, extended view, create for record files, `bulkCreate`, `PATCH` add collaborators), `workflowresponse` (list, view, create, update), `workflowgroupedrequests`	Approve/reject by creating responses
Databases & records (briefs, forms)	GET`database.limit(…)`, `record` list/JSON search/create/update/`appendFiles`/download attachment/view/delete, `recordfile` list/view, `customform/{databaseId}`	Non-DAM modules (briefs, registers)
Compliance reviews	POST`complianceReview?complianceReviewType=text` / `file`, GET`complianceReview/{id}?includeComments=true`, `?action=download` (annotated PDF)	AI Content Risk Review; poll until complete S7
Custom pages (brand portals)	`custompage` list/view/move/delete/undelete; `pageCategory` CRUD	Read/organise pages; no page-creation call
Usage report (audit)	GET`report.limit(…).order(createTime:-1)?searchParams[creator]=…` (also `sourceModule`…)	Main Admin only; activity log (create, view, edit, download…)
Platform	GET`template` (no auth), GET`module`	Branding/template and enabled modules

Data model

Resource = one asset entry in a folder, typed as file, URL, remote file (cold storage) or alias; identified by a 32-character hex _id S1 S54. System fields live in data (name, description, keywords, review date…), global filters in data.filters, and custom upload fields in data.formData.{sectionId}.{fieldId} S1.
Files are uploaded first and attached to a resource or record through the returned file object; each resource keeps numbered versions S1 S41.
AI tags ("advanced media analysis", includeAmaTags): brands, locations, objects, topics, landmarks, keywords, faces, description S1.
Taxonomy: hierarchical folders (permissions are set per folder), platform-wide filters (multilingual, optionally restricted by division/folder), and custom select fields S1 S52 S46.
Collections carry both a 32-char _id and a short id (e.g. five characters) S1.
Index field names used in JSON search reveal a Solr-style schema: suffixes _s, _ss, _l, _dt, _facet (e.g. ib_folder_s, ib_file_size_l, {uuid}_ss_ib) S1.
Divisions partition users and filter values within one platform S1 S36.

Search & querying

GET form: resource.limit(0,100).order(createTime:-1).fields(name,createTime) plus searchParams[keywords], searchParams[ib_folder_s] etc. in the query string S1.
JSON form: POST{apiV3url}/api/json with {method, version, client, table, query_params: {searchParams: {…}}}, recommended for nested conditions S1 S5.
keywords behaves like the UI search bar (AND/OR, quoted exact phrases); content limits the scope (title, description, content, uuid, metadata, tags); ib_folder_s + isSearching scope to a folder with or without subfolders; extension filters formats S1.
collections: up to 10 collection ids per request, at most 3,000 resources matched per collection; more than 10 → 422 S1.
wrapped_conditions: arrays of {field, op, union, value} with ops equals, less, lessEqual, greater, greaterEqual, in, notIn; union (and/or) is mandatory even for a single condition; works on file size, keywords facet, filters, custom select fields and dates S1.
UI search semantics (stemming, 70% match rule for 3+ keywords, wildcards, document content and embedded metadata indexed) are described in the help center; select fields and filters can be matched by free text in the UI but not via the API S42.
Sorting: .order(field) ascending or :-1 descending. Max page size 100; no cursor/scroll mode is documented S1.

Uploads & binaries

Method	Flow	Limits
Standard	POST`file?target=resource&virus_check=` (multipart) → file object	Max 2 GB S1
Chunked (platform storage)	GET`file?action=start_upload&fileHash={md5}&name=&chunkCount=` → resume id; POST`file?action=upload_chunk` in order; last chunk merges	10 MB chunks recommended (same as the web uploader, so uploads can resume across API and UI); incomplete chunks kept 14 days; MD5 hash required S1
S3 direct, single	GET`file?action=presignStandardUpload` → `PUT` to pre-signed S3 URL → POST`file?action=completePresignedStandardUpload`	S1
S3 direct, multipart	`initS3MultipartUpload` (fileSize, chunkSize) → `s3PresignChunks` (batch; each URL valid 3,600 s) → `PUT` parts → `s3UpdateChunksStatuses` → `completeS3MultipartUpload`; optional reset/re-sign	Chunk expiry computed from observed upload speed (initially 1,024 B/s) S1

After upload, create or update the resource (or record/compliance review) with the returned file object; metadata extraction from embedded tags also runs on API create/update according to the platform's mapping settings S1 S53.
Downloads require the session id as a sid query parameter on action=download URLs; options: specific version, format ext, a preset, or manual transformations (size, crop, cropgravity incl. automatic focal point, extent…) applied in parameter order S1.
Public CDN links (Amazon CloudFront) are obtained with action=share; replacing original in the URL with a preset name applies a transformation S55 S1.

Events & webhooks

No webhook registration, event subscription or callback mechanism appears in the v3 collection or the help center's API article S1 S5.
The public Zapier app exposes 21 triggers (new/updated resources, folders, records, users, groups, workflow requests, markup comments, usage report entries…), 30 actions and 11 searches S10. Vendor-managed "Handshakes" built on Zapier run every 1–15 minutes depending on the Zapier plan, which suggests polling rather than push events S9 Unverified (inferred).
The Workato Content Risk Review connector polls every 60 seconds (up to 30 minutes) for review completion S8.
Retries, signatures, payload formats: N/A (no webhooks).

Limits & quirks

Unverified Rate limit contradiction: the help center (2026-09-11) and the collection's 429 error text state 600 calls/minute per user; the "Limits" section of the same collection overview states 1,800 calls/minute per user, tracked per node and possibly higher in practice, "do not plan on it" S5 S4. Design for 600/min.
Organisation-level call allowance (daily, monthly or yearly) is contractual and Not public S4 S5. Content Risk Reviews submitted via the API have their own quota S7. Image auto-tagging is capped by default at 1,000 tagged images per month (UI and API) S47.
Error contract: 401 error.authentication.required (session expired), 403 error.no_permission, 404 error.*.not_found (also for archived items), 400 vs 422 for validation depending on 3.0.0 vs 3.0.1, 429 rate limit S4. Calling a 3.0.1-only endpoint with another version returns 400 error.api_version_not_supported S1.
The API respects the user's UI permissions; an integration running as a non-admin user sees only what that user sees S5.
Several folder calls are still Beta or Coming Soon; OAuth 2.0 is Beta S1.
Publish-approval folders: "Update Resource" cannot submit a publish approval request; only Workflow-module admins can publish there via API S1.
Remote (cold storage) resources: no previews, transformations, auto-tagging or public sharing S54.
Public CDN links stop loading when the platform's CDN data-transfer allowance is exhausted (unless a tolerance is agreed) S56.
The v2 login endpoint answers {"id":102,"message":"Invalid request or server error"} with HTTP 200 to a request without credentials S16.

SDKs, tools & code samples

Item	Language	Status	Source
Postman collection + "API Default" environment (auto-populates `sid`, `clientid`, `apiV3url` via pre-request/test scripts)	Postman	Official, published 2026-07-29	S1 S4
Code snippets generated by Postman Documenter (C#, cURL, Dart, Go, Java, …)	various	Generated, not maintained libraries	S4
`@intelligencebank/connectingib`, `ui-primitives`, `integration-components` (React components: AssetBrowser, FolderTree, LoginForm…)	TypeScript/React	Vendor-published, UNLICENSED, v5.3.0 (2026-01-03)	S13
`IntelligenceBank.Umbraco.Connector*`, `IntelligenceBank.OptimizelyCMS12`	.NET (NuGet)	Vendor connectors (not general SDKs)	S14
`ib-magic-links-js-library`, Adobe CC connector public JS	JavaScript	Vendor (ibproduct GitHub)	S12
`ib-api-doc-mcp-server` (package `ib-api-doc` 0.3.0)	TypeScript (MCP)	Vendor GitHub, UNLICENSED; reads Postman documentation and generates code actions — does not call the IntelligenceBank API itself; last push 2025-12-03	S11
Drupal module `intelligencebank`	PHP	drupal.org project, updated 2026-07-18	S15

No PyPI, Packagist or official server-side client library was found (2026-10-01).

Changelog of the API

Date	Change	Source
2026-09-11	Help center publishes "About the IntelligenceBank API" (three login methods, OAuth TTL 15 min, 600/min)	S5
2026-07-29	Latest publication of the v3 Postman documentation	S4
Unknown (platform release 4.64.1)	`redirectUrl` parameter added to browser login	S1
Unknown	OAuth 2.0 client-credentials (Amazon Cognito) server-to-server auth introduced as Beta	S1
Unknown	API 3.0.1: validation errors move from 400 to 422; Collections endpoints 3.0.1-only	S4 S1
2022-12-31	Planned termination of remaining legacy v2 calls (folders, search, sync, presets list)	S3
2022-07-01	Planned termination of legacy v2 file calls (download, transformations, icons, create/update/delete resource)	S3
2020-10 (planned)	`V3thumbnail` field to revert to `thumbnail` once all file types use the new preview generator	S3 Unverified (outdated)

Stored API specs

4 files · 4.0 MB · verbatim copies of public vendor filesSpecs README & provenance

File	Format	Size	Download
`intelligencebank_postman_documenter_metadata_v2-legacy.json`	Postman collection	13 KB	Download
`intelligencebank_postman_documenter_metadata_v3.json`	Postman collection	16 KB	Download
`intelligencebank_postman_v2-legacy.json`	Postman collection	383 KB	Download
`intelligencebank_postman_v3-graph-api.json`	Postman collection	3.6 MB	Download