Wedia / Lyvio API

Authentication

Credential types S3 S4 S5

• MFA interplay: when "sign-in without MFA" is disabled, REST sign-ins with login/password are rejected, but applicative sign-in (application tokens) keeps working — relevant for PIM/CMS integrations S103.
• Access tokens are opaque to clients for any use other than calling the API; the signing secret is server-private and may rotate S5.
• Where credentials are created: application tokens and OAuth2 providers in the REST API admin dashboard (/_plugins/WXM_RESTAPI/page/home.jspz), which needs a dedicated second-level account; roles Administrators, Developer, ApiOperators, ApiWatchers, ApiTesters etc. exist for API admin pages S3 S19.

Core resources

Paths below are relative to https://{tenant}.wedia-group.com. Resource type names (asset, folder, …) depend on each project's data model; the patterns are generic S12 S13. Counts from the demo DAM spec: 260 paths / 344 operations, 57 resource types S56.

Data model

• Everything is a typed resource ("data structure"/object) defined per project in the engine; DAM services are auto-generated from structure tags, so endpoints and fields differ between customers and cannot be reused as-is from one DAM to another S12 S13.
• Several asset libraries can coexist (e.g. asset, product_images, pimasset) S22 S56.
• Identifiers: numeric id per resource type, plus a cross-type unique id / uuid (e.g. GET/api/rest/dam/{uniqueId}), which is also the recommended public identifier in delivery URLs because it hides the database structure S104 S22.
• Response envelope: $.response.data + resource-type description + optional headers + HATEOAS links S104.
• Localized fields (e.g. captions per EN/FR/ES); language picked from lang, Accept-Language or the user profile; unsupported language → 406 S3.
• Relations/taxonomies are linked resources (keywords, geography trees, thesauri with synonyms and related terms) S56 S106.
• Files are properties of the resource (binary, source, poster…); renditions are named variations/presets (built-in thumbnailTiny 100 px, thumbnailSmall 200 px, thumbnailBig 600 px, thumbnailScreen 2000 px wide, thumbnailReal, poster, stripped_background, animated*, ia_preview_video_source…) S22.
• Versions: withVersions/queryVersions parameters S56; version management UI since 2024.5.0 S38.

Search & querying

• Full-text: find parameter; suggest for autocompletion; sortByRelevance; findinfilecontent S56. Classic engine uses TF-IDF/vector-space relevance (Lucene-style) S105.
• Structured filters: JSON Query in query (or header X-WEDIA-QUERY), rootquery for trees S56:
  • Operators (short/long): eq, neq, gt, gte, lt, lte, e/empty, ne/notempty, in, nin, sw, nsw, ew, new, ct, nct, dof/descendantof, ndof, ovrl/overlap; combinators and, or, not.
  • Dates as epoch ms or ISO strings; functions now(±n), ts(…); sub-queries on related objects; similarimage/sim (hash-based similar image search); workflow state queries; variables ${…} and surfer (current user) properties.
• Sorting: orderby=prop1 asc, prop2 desc S56.
• Facets/aggregations: withAggregates, aggfields, facets; count-only via withData=false&withAggregates=false S56.
• Grouping: group, grouplevel, groupcount (hierarchical/collapsed) S56.
• Projection: props, techprops, headers/dataHeaders to reduce payloads S56.
• Page size: default 50, max 200; deep paging via continuation tokens (after) on the infinite-list endpoint S56.
• AI Search (2026.4.0): semantic/vector search combined with classic search inside one Elasticsearch query, surfaced through query flags — the portal runs a "shadow cursor" in wedia-vue; there is no separate AI search endpoint S43 S30.
• Conditional requests: ETags on catalogs, headers, API docs and on structures tagged REST_API_ETAG S16.

Uploads & binaries

• Single create: POST/api/rest/dam/data/{resource} with the raw binary (any Content-Type except application/json; filename required, its extension drives type detection), JSON metadata, or multipart/form-data; a ZIP creates several resources; file properties may also be set by URI (prop_binary=<url>) instead of uploading S56.
• Mass import: create a job (POST/api/rest/massimport/job), add items (POST/api/rest/massimport/item, binary in body with content-disposition filename, or multipart field binary), qualify items (metadata, asynchronous), then validate/publish (asynchronous object creation); items can be selected by id or JSON Query; simulation view of the final object available S15.
• Chunked/resumable or presigned uploads: Not public (not found).
• Maximum file size: Not public (not found). Allowed extensions can be restricted per project S1.
• Downloads: …/{id}/$binary and …/$variation on the REST API S12; public/CDN delivery via /api/wedia/dam/variation/{uuid}/{variation}/{basename} S22.
• On-the-fly transforms (/api/wedia/dam/transform/…): chained t= operations resize, crop (box or focal point fx/fy), fill, setbg (incl. colour replace with fuzz), iwatermark (image watermark, since 2024.4.0), extend, smartcrop (focal point, ratiow/ratioh); pixel or proportional values; output format from the extension (jpg, png, webp, heic, avif, pdf) or automatic (WebP for modern browsers) when omitted; SEO basename free S22 S37 S46.
• Caching: key = asset + normalized transform (parameter order ignored); invalidated when the original changes S22. Observed: transforms served with Cache-Control: public, max-age=3600 and CloudFront Via/X-Amz-Cf-Pop headers; named variations with max-age=2592000 (30 days) and Edge-Cache-Tag S60.
• Legacy Imaging engine: JSON command sets and presets (autoorient, clip, crop, density, fit, format, layout, lresize, metadata, pad, resample, rotate, strip, thumbnail, watermark…) at /api/media S21 S58.
• Security: transform/variation access follows objectfile.sendFile security; since 2025.2.0 renditions are not public by default in Media Delivery S22 S35. CORS on /api/wedia/dam/variation/* restricted to controlled origins since 2024.3.0 S36.

Events & webhooks

• Outbound webhooks: none documented — no webhook registration resource in the specs or the REST API docs S56 S1.
• Server-side extensibility instead: Java plug-ins (packaged as NAR or deployed via the admin) executed on triggers (e.g. onBeforeInsert…, onAfterUpdate…), workflow events and business services S50 S45. Integrators needing push notifications therefore build a plug-in or poll.
• Polling aids: JSON Query on dates (e.g. {"modified":{"gte":"now(-1)"}}), ETags S56 S16.
• In-app notifications: /api/rest/usernotif (pull) S18; custom notifications configurable S1.
• Client-side: the video player accepts actions and emits playback events for page scripts S107.

Limits & quirks

• Per-tenant API surface — generated from the customer's data model; always read the customer server's own /api/rest/doc/dam S9 S12.
• max ≤ 200; default 50 S56. No published rate limits, concurrency caps or 429 semantics — Not public.
• Method override for proxies that block PUT/PATCH/DELETE: POST + X-HTTP-Method-Override / X-HTTP-Method / X-METHOD-OVERRIDE S56; …/put and …/patch POST aliases also exist S12.
• state parameter echoed back in responses to correlate async calls S3.
• debug parameter: stack traces only in development mode (since 11.14.2) S3. The demo server runs in dev mode S60.
• Error body: extended code HTTP/specific (e.g. 404/100), message, error_uri, errtag, support contact details S56; common codes listed (e.g. 503/42 maintenance, 406/2 unacceptable language) S3.
• JSON Query multi-value eq means OR; root object means AND S56.
• Delivery URLs with {type}/{id} expose DB structure — vendor recommends uuid S22.
• atk signature query token for <img> binaries is deprecated → use JWT cookies S5.
• Figma picker: no SSO (direct login only) S27; Canva picker (pre-2026.4) could not be disabled by licence as it calls the REST API directly S25.
• Unverified Documentation age: several REST pages date from 2019–2023 (e.g. auth modes 2021, OAuth2 2023) while the engine is at 2026.4 — behaviour may have evolved; the generated OpenAPI is the most current reference S1.

SDKs, tools & code samples

No official Python/PHP/.NET/Java client SDK and no public GitHub organisation found (the wedia GitHub user is unrelated) .

Changelog of the API