Storyteq API

Authentication

CMP V2 (password grant) S19

1. Ask the account team for a client ID, a username/password and your CMP-Tenant value (your CMP instance URL).
2. POST{base}/token with headers Content-Type: application/json and CMP-Tenant: {tenant} and a JSON body: client_id, username, password, grant_type: "password".
3. Use the returned access_token (JWT) as Authorization: Bearer … with the CMP-Tenant header on every call.
4. Refresh with grant_type: "refresh_token" and the refresh_token.

• Without credentials, the API answers 400 {"error": "Authorization field missing"} S36.
• The spec documents only this flow for CMP V2; no client-credentials or authorization-code flow is described for it.

Storyteq API v4 (bearer token) S18

• Every request carries Authorization: Bearer {token}. Tokens are issued by Storyteq; no self-service creation is documented. An unauthenticated call to /v4/content/templates/ returns 401 {"message":"Unauthenticated."} S36.

Identity Broker (external integrations) S4 S5 S11

1. The user enters their tenant URL in the integration and clicks Connect.
2. The Identity Broker finds the tenant's identity provider and region and builds the redirect. Sign-in opens in a new browser tab or window (SSO or Storyteq credentials).
3. The IdP returns an authorization code; the integration exchanges it (with the PKCE verifier) for access and refresh tokens.
4. The integration polls the broker to detect completion (no WebSocket). The session times out after 5 minutes.

• Broker endpoints are limited to 20 requests per minute. Endpoint paths and client registration: Not public.
• Storyteq CMP uses Keycloak; tenants still on LUMA sign-in are being migrated S4.

Asset Picker credentials (internal integrations) S8 S9

• The host passes domain, domainId, apiKey and lensId (one lens = one curated set of assets). Users do not sign in. External integrations instead set apiIntegration (external-prod, external-uat…) and sign users in through the Identity Broker.

Core resources

CMP V2 operations, derived from the OpenAPI file (36 operations; all except /token require the bearer token and CMP-Tenant) S19.

Storyteq API v4 (creative automation) S18

Canopy API V1 (deprecated; read only, not archived because of its licence) S20: 11 GET operations on /domains, /domains/{id}/lenses, /resources, /resources/{id} (info, derivatives, previews, external URLs, latest atom) and /env; offset paging with limit (max 200) and offset.

Data model

• Domain: hierarchical container for configuration and objects (organisation → business unit → market). Access flows down, never up or sideways S19.
• Type: the backbone for assets and projects (fields, taxonomy, milestones, states, roles, workflow) S19.
• Asset (called resource internally): integer assetID plus a UUID (assetUuid) that persists across versions. Each binary version is an atom (atomId) S7 S20. Event supertypes: Resource, Project, Adaptation, Template S7.
• Metadata: custom fields per type, narratives (named free-text fields), taxonomy keywords grouped in genera, tags S19.
• Lifecycle: phase (Quarantined, Active, Expired) and an independent availability window S19 S26.
• Derivatives: produced by transforms (engines Passthru, Chaos, Entropy) per asset type. The original file cannot be downloaded through the API, only a derivative S19 S22.
• Lens: saved filter (type, file type, phase, keywords with all / any / none) mirroring a portal view S19.
• Site: a front-end portal; several per domain S19.

Search & querying

S19

• Simple search by asset name; simple filters (asset ID list, phase, available).
• Complex filters: a URL-encoded JSON array. The searchFilter type takes clauses, each with flags (Fuzzy, Name, Keyword, Field, Metadata, Tag), an optional field name and a value. Flags inside one clause are OR'ed; clauses and filters are AND'ed.
• Other filter types use LUMA class names, e.g. com.intrepia.luma.KeywordFilter (keyword IDs), TypeFilter (with descendants) and PeriodFilter (created / modified date ranges).
• Responses include real-time counts per filter (faceted search).
• Lens-based search: pass lensID to reproduce a portal view.
• Max page size 100. A maximum result window is not documented. Storyteq states that the API does not support bulk extraction, wide filters with nested iteration, or polling "in any shape or form". Use webhooks for change detection.

Uploads & binaries

• No binary upload in the public APIs. CMP V2 can only attach a project resource fetched from a URL (AddProjectResourcesFetch) S19. Bulk upload or download needs the integrations team S19.
• Download flow: ListAssets → GetAssetDerivativeMenu (choose a transform) → DownloadAssetDerivative with operation=Link, which returns a temporary signed URL. Derivatives need a transform set up in advance; ask the account team to create transforms S19.
• Previews: DownloadAssetPreview builds previews on request and asynchronously. A 404 can mean "not ready yet", so retry with increasing delays S19.
• Public URLs: GetAssetURLs returns external URLs. Asset Picker links using public URLs do not expire; service-account links have their own validity period S19 S8.
• On-the-fly images: CDN URLs with path segments {id}:{parameters} (e.g. resize:fit-in:800x600/quality:85/format:webp). Signing or auth for these URLs: Not public S13.
• Rendered media (v4): the download_urls object on a finished media item S18.

Events & webhooks

Asset event webhook service S6 S7

Unverified The two pages disagree on undeliverable events: the explanation page says they are "dropped" after 24 hours, the reference says they go to a dead-letter store. The reference lists event types in upper case, while its YAML examples use title case ("Edited") S6 S7.

v4 render notifications S18: add notifications: [{type: "webhook", route: "https://…"}] to a media request. Defined callbacks: MediaQueued, MediaRendering, MediaUploading, MediaFinished, MediaFailed. Signature and retry policy: Not public.

Limits & quirks

• CMP V2 is for UI-scale use: small subsets of data for pickers, metadata reads and edits, project creation. No bulk, no polling, no original-file download S19.
• Rate limits are "general guidelines" (5,000/min, 500,000/month per account) S19. A fair-use policy in the spec forbids reselling data and circumventing limits S19.
• IDs may change when the DAM configuration changes. Cache them but plan to rediscover S19.
• Assets visible in the front end must be Active, available and usually carry keywords matching the lens S19.
• Preview 404s on first request are normal (asynchronous generation) S19.
• Two v4 docs: the API root still points to an Apiary reference (storyteq.docs.apiary.io) while the Developer Portal serves the OpenAPI 3.1 file S36 S38 S17.
• Asset Picker apiIntegration: the parameters page also mentions an external-site value that is not in the accepted-values list S9 Unverified.
• Generative Expand is unavailable for images of 4,000 px or more in either dimension S14 S28.
• Agent Console is not an API product: there are no public endpoints for agents S15 S16.

SDKs, tools & code samples

No npm, PyPI or NuGet package was found. No llms.txt on storyteq.com or docs.storyteq.com S36.

Changelog of the API

The product changelog has no API entries S21. Storyteq does not publish a dated API changelog.