Tenovos API

Authentication

Standard Tenovos auth (v1 and v1.5) S7 S17 S20

1. Get the API key (per environment: UAT and production) and the base URL from Tenovos Support. A v1 doc note says the key would later be shown in Admin → Configuration → API key. Whether that exists today is Unknown S20.
2. Create a local user in the Tenovos account for the integration. Give it a role and groups with just enough privileges and security-template permissions S17.
3. POST{base}/auth/token with header X-API-Key and a JSON body {username, password}. Since v1.5, clientId is no longer required S4 S7.
4. The response holds a session object with the access token (JWT) and refresh token, plus account details (endpointUrl, clientId, userPoolId) S7.
5. Business calls send X-API-Key plus the token in Authorization S7. Unverified The token operation's description calls the header AccessToken, while every other operation documents Authorization. DELETE/auth/token uses AccessToken S7.
6. Refresh: post the previous auth response back to /auth/token (about 233 ms on average, against about 3.7 s for a new token, per the spec) S7.

OAuth 2.0 (v1.5 and 2.x) S6 S15

• The authorization code flow is supported. The OAuth page also describes service accounts and web applications (JavaScript origins, redirect URIs).
• How to register an OAuth client in Tenovos Admin, the scope categories and client-secret rotation are all marked "Coming Soon". The setup procedure is therefore Not public.
• The webhooks spec declares https://api.tenovos.io/v2/oauth/authorize and /v2/oauth/token S15. Unauthenticated requests to both return 403 from the load balancer S22.

Other auth facts

• POST/auth/impersonate is marked deprecated in v1.5 S7.
• Users can be local (password) or federated (an SSO service). Federated users are created through POST/user S7.
• Content Intelligence API: POST/api/v1/api-key/create-api-key returns the full key once (stored hashed; only the last four characters are shown afterwards). The key is tied to a role. Keys can be listed and revoked S9. Interactive login, SSO and MFA for that platform are handled by Clerk (an external identity service) S9.

Core resources

From the v1.5 OpenAPI bundle (base https://api.tenovos.io/v1) S7 unless noted.

Content Intelligence Platform API (https://api.tenovos.net, all POST) S9

Data model

• Asset (v1.5): identified by an objectId (UUID, also called Asset ID). Each file version has a fileId; originalFileId links versions to the first file S7. A new asset is metadata-only until content is uploaded S7.
• Metadata: an asset has one metadata template (metadataTemplateId). Values are {metadataDefinitionId, metadataDefinitionValue} pairs. Controlled-vocabulary values are referenced by valueId S19 S7. Attribute types include textbox (max 250 characters), textarea (max 10,000; cannot be facetable), dropdown/vocabulary, cascades and tables. Flags include isRequired, isSearchable, isFacetable, isTypeahead, isSensitive, isMultiSelect, plus mapping from technical metadata S7. Search addresses custom fields as metadataDocument.{search_field} S7.
• Security: each asset carries one or more security templates (securityTemplateIds). Users get access through groups granted permissions on those templates, plus role privileges S7 S18.
• Relationships: typed links between a primary and a secondary asset (e.g. parent/derivative). Viewing them requires View access on both assets S7.
• Federated assets: some asset operations accept S3 contentPaths for files that stay in an external location S7.
• Content Intelligence: documents are schemaless JSON name/value records typed by a kind (ASSET, REFERENCE, COLLECTION, LAYOUT). They are linked by typed edges and indexed in OpenSearch. Binary content items are referenced separately S9.

Search & querying

S7 S18 unless noted.

• POST/search/keyword: searchTerm[] (keywords, or facet expressions (Attribute Name:"Value"), a - prefix to exclude), filters[] (same syntax), operation AND (default) / OR / ANY, keywordSearchField (filename, asset ID, metadata or extracted document text), sortBy[{metadataDefinitionSearchField, order}], includeDeleted, includeVersions, excludes[] (drop heavy fields such as technicalMetadataDocument). Default 50 results; page with from = 0, 50, 100…
• POST/search: the same plus relevancy: true (sort by relevance, desc), includes[] to return more fields, and limit (schema maximum 100). Unverified The operation text says limit goes "up to 50", while the schema allows 100.
• Result window: at most 10,000 results per search S18. Beyond that, use POST/asset/scan (cursor; optional assetType) S7.
• Response times are given per operation (e.g. about 4.2 s on average for keyword search) S7.
• Content Intelligence: document/query (full-text and field-level) and query-within (scoped to a hierarchy such as a brand or campaign) S9.

Uploads & binaries

S7 S19

1. Look up the IDs you need (metadata template, attribute and vocabulary values, security templates).
2. POST/asset with the metadata, securityTemplateIds and filename. The response returns the IDs plus presigned S3 URLs (urls[] with partNumber) and an uploadId. A metadata-only asset gets a single url instead.
3. PUT the binary to each presigned URL. The vendor examples point at S3 Transfer Acceleration endpoints.
4. For multipart uploads (parts of 100 MB, not configurable; files of at least 5 MB), call POST/asset/complete to complete or abort. Files of 100 MB or less do not need this step.

• Size limits Unverified: the v1.5 POST/asset text says content must be ≤ 5 GB, while the large-upload training page says its multipart example is for files larger than 5 GB S7 S19. The real maximum is Unknown.
• Download: GET/asset/{id}/content returns a presigned URL to the source file (needs download rights). POST/asset/expose creates temporary presigned links with an expiry in seconds (needs the Download privilege) S7.
• Preview replacement: POST/asset/content/preview (needs the Replace Mezzanine privilege) S7.
• Content Intelligence: content/retrieve-upload-url gives presigned upload URLs; content/stage pushes content to a CDN origin adapter S9.

Events & webhooks

• Model: events (create, update, delete, share, download, restore, purge…) on topics (asset, asset metadata, asset renditions, asset security, collection, metadata attribute/group/template/vocabulary, relationship, request, RM project/agreement/entity, security group/role/template, story board, user, version) S10 S14. 59 event types are available. rm.agreement.expired is listed as not available S14.
• Configuration: through the REST API (POST/webhooks/endpoint and related) or the Webhooks section of the Admin UI. One endpoint can subscribe to several event types S11 S7. Tenovos sets a delivery rate limit (messages per second) per customer or per endpoint, based on load-test figures the customer provides S10.
• Payload: small JSON message with context and summary only. Call the REST API back for full data. Ordering is not guaranteed S10.
• Endpoint authentication: none, Basic, or header auth S10. Optional OAuth client-credentials: PUT/webhooks/endpoint/oauth/{endpointId} with clientId, clientSecret, tokenUrl, extraParams, scope S11.
• Signature: headers webhook-id, webhook-timestamp and webhook-signature (space-separated, versioned v1,<base64> values). Sign id.timestamp.body with HMAC-SHA256, keyed with the base64 part of a whsec_… secret. Check the timestamp tolerance S12.
• Retries: an endpoint must return 200 within 30 seconds S10. Otherwise retries run immediately, then after 5 s, 5 min, 30 min, 2 h, 5 h, 10 h and 10 h. After that the message is marked Failed and a message.attempt.exhausted event is sent. Endpoints failing for 5 days are disabled automatically S13. A Webhooks Admin Dashboard shows subscriptions and delivery analytics. It allows manual retry or "Recover" from a date S13.
• Status: one copy of the webhooks spec still carries a "currently in Beta" banner; the developer-portal copy does not S15. General availability date: Unknown.
• Tenovos Connect can generate receiving endpoints for customers who cannot host one S10 S15.

Limits & quirks

• Rate limits are not documented. The only signal is the x-ratelimit-* header pair seen on an unauthenticated 401 S22 Unverified.
• Latency is documented per operation, and some values are high: new token about 3.7 s; create user about 5.1 s; get asset by object ID about 3.0 s (about 0.45 s by file ID) S7. The FAQ claims v2 is "600%+" faster than v1 on average S16 (vendor claim; v2 itself is not documented publicly).
• Error codes: a missing X-API-Key gives 403 Forbidden; a missing or expired token gives 401 S7 S22. An invalid asset ID on GET/asset/{id}/content returns 502 S7.
• Documentation drift: v1.5 is called both "current" and "beta" on different pages S2 S4. The OAuth setup sections are placeholders S6. Training pages are reachable only through FAQ links to Markdown files S16 S23.
• Restricted operations: POST/asset/transform needs an extra verification key from Support S7. The CDN pull-zone endpoints are tagged "Coming Soon!" S7.
• Batch: the portal states that all versions support batch requests S2. Concrete batch operations include bulk asset edit (PATCH/asset), bulk group creation (max 50) and POST/request/list S7.

SDKs, tools & code samples

Changelog of the API

The portal's v1.5 changelog page (/developer-portal/hermes/changelog) is empty S21.