Invoke the Action API to retrieve information about invoked Actions.
- API v1.5 Documentation
- Payload Reference
API Endpoint Reference (1.5)
Tenovos has introduced version 1.5 to provide non-breaking improvements over previous versions.
Key Changes:
- Authentication Standards now include OAuth2 code flow.
- Client ID is no longer required to be passed when requesting an Authorization token using our Standard Auth from v1.4
- New endpoints have been added and will continue to be added until v2 is generally available to all customers.
- Adaptive Template endpoints
- A new Get Asset endpoint with a simplified Response
- A new Create Asset endpoint with simplified payloads for the Request and Response
- A new Update Asset endpoint with simplified payloads for the Request and Response
- Metadata Admin API endpoints for managing Attributes, Groups, and Templates
- We've made some performance improvements to most endpoints
Tenovos Content Delivery Network (CDN) - Coming Soon!
Tenovos CDN: Pull Zone Overview
Tenovos CDN provides global content acceleration and optimization through a pull zone architecture, ensuring that your assets are delivered to end users with maximum speed, reliability, and efficiency. A Content Delivery Network (CDN) works by caching static content—such as images, videos, and other media—on servers distributed across the globe. When an asset is requested, the CDN serves it from the nearest edge location, reducing load times and offloading traffic from the origin server, which in this case is Tenovos DAM.
A pull zone is the core mechanism that powers this system. It automatically fetches content from the origin the first time it is requested, then caches it at the edge. Subsequent requests are served directly from the CDN cache, improving response times and reducing bandwidth consumption.
Through the Tenovos CDN API, you can create, update, and manage pull zones programmatically. Pull zones support advanced features such as global edge caching, cache purging, bandwidth controls, and real-time performance statistics like cache hit rate and geographic request distribution. Optional optimization settings allow you to enhance performance further by enabling image compression, WebP and AVIF support, and content minification.
With just a few API calls, you can fully integrate high-performance content delivery into your Tenovos workflows—no complex infrastructure required.
Invoke the Collection API to create, retrieve, edit, and delete Collections. Collections are used to group and catalog related Assets for quick access and consumption. Collections can be configured as:
- private: Visible only to the user who created the Collection.
- secured: Visible to users with.
When retrieving the Assets within a Collection, the requesting user will only see the Assets that the user has access to view. For example, a librarian may see all Assets within a Collection, but a general consumer user may only see a portion of those Assets, due to limited security access.
Invoke the Metadata Attributes API to retrieve Metadata Attributes, and to create, read, update, and delete Metadata Attribute definitions. Metadata Attributes come in varying types, including Text, Date, Controlled Vocabulary, Tabular, and Cascading, and can be assigned to Metadata Groups and Templates.
Admin Endpoints (NEW!): Create, read, update, and delete Metadata Attributes. These endpoints require the Metadata Management admin privilege.
Invoke the Metadata Templates API to create, read, update, and delete Metadata Templates, and to apply Metadata definition changes. A Metadata Template defines a set of Metadata Attributes that, when assigned to an Asset, become available for population on that Asset.
Admin Endpoints (NEW!): Create, read, update, and delete Metadata Templates. These endpoints require the Metadata Management admin privilege.
Request
Response provides an array of the security Roles that are configured in Tenovos. The items returned are limited to the Roles available to the user making the API call.
API User credentials must have administrative rights to the User Management privilege.
Average Response Time: 274ms
- https://api.uat.tenovos.io/v1/roles
- https://api.tenovos.io/v1/roles
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
https://api.uat.tenovos.io/v1/roles \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'[ { "id": "e171b93a-9f42-4a78-8845-b60f3e783c3c", "name": "Creative Producer" } ]
Request
Response will include a list of all role privileges available in the system. The user making the request must have the 'Security Template Management' role privilege. All role privileges will be returned by default. User can pass 'enabled' or 'disabled' as a path parameter to return only enabled or disabled role privileges. The user making the request must have Role Management privilege.
Average Response Time: 188ms
- https://api.uat.tenovos.io/v1/roles/privileges
- https://api.tenovos.io/v1/roles/privileges
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
https://api.uat.tenovos.io/v1/roles/privileges \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'{ "privileges": [ { … } ] }
- https://api.uat.tenovos.io/v1/security/permissions
- https://api.tenovos.io/v1/security/permissions
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
https://api.uat.tenovos.io/v1/security/permissions \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'{ "permissions": [ { … } ] }
Request
Retrieve a paginated, searchable list of the security roles configured for the authenticated customer.
Defaults:
sortFielddefaults toroleName.orderdefaults toasc.fromdefaults to0.limitdefaults to100(clamped to100if a higher value is supplied).
Business Rules:
searchTermis a case-insensitive substring match on role name. Special LIKE characters (%,_,\) are treated as literal text, not wildcards.consentFormis not included on list items — it only appears on the get-by-id detail.
The user submitting the request must have the Role Management privilege.
- https://api.uat.tenovos.io/v1/security/roles
- https://api.tenovos.io/v1/security/roles
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://api.uat.tenovos.io/v1/security/roles?searchTerm=string&sortField=roleName&order=asc&from=0&limit=100' \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'{ "roles": [ { … } ], "pageInfo": { "from": 0, "limit": 100, "total": 1, "hasNextPage": false } }
Request
Create a security role for the authenticated customer.
Business Rules:
namemust be 1-32 characters after trimming, and unique per customer, case-insensitively — enforced by a database constraint, so a race between two concurrent creates for the same name always resolves to exactly one winner and a409for the loser.- Any field not in
{name, consentForm, privileges}is rejected with400.
Defaults:
consentFormdefaults to"".nullis treated as absent.privilegesdefaults to[]. Entries are de-duplicated case-insensitively.
Validation:
- Each
privilegesentry must be a syntactically valid UUID (400if not), then must exist and be enabled in the customer's privilege catalog (422if any id is unknown or disabled).
The user submitting the request must have the Role Management privilege.
JSON object defining the role to create. Required: name. Optional: consentForm (defaults to ""), privileges (defaults to []).
Display name of the role. 1-32 characters after trimming. Must be unique per customer, case-insensitively.
Consent text a user must accept to hold this role. Defaults to an empty string. null is treated as absent.
- https://api.uat.tenovos.io/v1/security/roles
- https://api.tenovos.io/v1/security/roles
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
- Create With Privileges
- Create Empty
curl -i -X POST \
https://api.uat.tenovos.io/v1/security/roles \
-H 'Authorization: string' \
-H 'Content-Type: application/json' \
-H 'X-API-Key: YOUR_API_KEY_HERE' \
-d '{
"name": "Compression Engineer",
"consentForm": "By accepting this role you agree to safeguard Pied Piper'\''s proprietary middle-out compression algorithm and follow all platform security policies.",
"privileges": [
"31bdde6b-1a2c-4d5e-8f90-1234567890ab"
]
}'Created. The response body is the new role in the same shape as GET /security/roles/{id} — a brand-new role always has userCount: 0 and usedIn.presets: [].
Consent text a user must accept to hold this role.
Flat array of permitted privilege ids only. Denied/unpermitted entries in the underlying role document are not surfaced.
User-profile id of the role's creator. null if the row has no recorded author.
ISO 8601 creation date, derived from createdEpoch.
User-profile id of the last user to update the role. null if the row has no recorded author.
{ "id": "7d8e9f0a-1b2c-3d4e-5f6a-7b8c9d0e1f2a", "name": "Compression Engineer", "consentForm": "By accepting this role you agree to safeguard Pied Piper's proprietary middle-out compression algorithm and follow all platform security policies.", "privilegeCount": 1, "privileges": [ "31bdde6b-1a2c-4d5e-8f90-1234567890ab" ], "userCount": 0, "usedIn": { "presets": [] }, "createdBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "createdEpoch": 1773070355217, "createdDate": "2026-03-09T15:32:35.217Z", "lastUpdatedBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "lastUpdatedEpoch": 1773070355217, "lastUpdatedDate": "2026-03-09T15:32:35.217Z" }
Request
Retrieve the full detail of a single security role, including its consent form, granted privileges, and everywhere it's currently referenced.
The user submitting the request must have the Role Management privilege.
- https://api.uat.tenovos.io/v1/security/roles/{id}
- https://api.tenovos.io/v1/security/roles/{id}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
https://api.uat.tenovos.io/v1/security/roles/6c15af83-d4a9-4772-875a-1c8a2bb1688f \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'Full detail of the security role.
Consent text a user must accept to hold this role.
Flat array of permitted privilege ids only. Denied/unpermitted entries in the underlying role document are not surfaced.
User-profile id of the role's creator. null if the row has no recorded author.
ISO 8601 creation date, derived from createdEpoch.
User-profile id of the last user to update the role. null if the row has no recorded author.
{ "id": "6c15af83-d4a9-4772-875a-1c8a2bb1688f", "name": "Creative Producer", "consentForm": "By accepting this role you agree to uphold Pied Piper's brand and confidentiality guidelines when producing creative assets.", "privilegeCount": 2, "privileges": [ "31bdde6b-1a2c-4d5e-8f90-1234567890ab", "9e187a4e-cfe4-419e-8c6c-2509e4bf400b" ], "userCount": 12, "usedIn": { "presets": [ … ] }, "createdBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "createdEpoch": 1734000000000, "createdDate": "2024-12-12T12:00:00.000Z", "lastUpdatedBy": "a5ae4577-8940-4ca9-bf2c-b1b65b4306ec", "lastUpdatedEpoch": 1755600000000, "lastUpdatedDate": "2025-08-19T12:00:00.000Z" }
Request
Partially update a security role. Only the fields present in the body are changed.
Business Rules:
- At least one of
name,consentForm, orprivilegesmust be present — a body with onlyexpectedLastUpdatedEpoch, or an empty object, is rejected with400. privileges, if supplied, fully replaces the existing set — it is not merged. An empty array clears all privileges. Omittingprivilegesnever disturbs the stored role document.- Renaming to the role's own current name (even differing only by case) is not a collision.
Optimistic Concurrency:
expectedLastUpdatedEpochis optional. If supplied and it doesn't match the role's currentlastUpdatedEpoch, the write is rejected with409andcode: STALE_UPDATE.
The response body is returned in the same shape as GET /security/roles/{id}.
The user submitting the request must have the Role Management privilege.
JSON object with the fields to change. At least one of name, consentForm, or privileges is required.
New display name for the role. 1-32 characters after trimming. Renaming to the role's own current name (even differing only by case) is not a collision.
New consent text for the role.
Full replacement set of privilege ids. An empty array clears all privileges. Omitting this field leaves the role's stored privileges untouched.
- https://api.uat.tenovos.io/v1/security/roles/{id}
- https://api.tenovos.io/v1/security/roles/{id}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
- Rename Only
- Replace Privileges
curl -i -X PATCH \
https://api.uat.tenovos.io/v1/security/roles/6c15af83-d4a9-4772-875a-1c8a2bb1688f \
-H 'Authorization: string' \
-H 'Content-Type: application/json' \
-H 'X-API-Key: YOUR_API_KEY_HERE' \
-d '{
"name": "Senior Compression Engineer"
}'Updated. The response body is the role in the same shape as GET /security/roles/{id}.
Consent text a user must accept to hold this role.
Flat array of permitted privilege ids only. Denied/unpermitted entries in the underlying role document are not surfaced.
User-profile id of the role's creator. null if the row has no recorded author.
ISO 8601 creation date, derived from createdEpoch.
User-profile id of the last user to update the role. null if the row has no recorded author.
{ "id": "6c15af83-d4a9-4772-875a-1c8a2bb1688f", "name": "Senior Compression Engineer", "consentForm": "By accepting this role you agree to uphold Pied Piper's brand and confidentiality guidelines when producing creative assets.", "privilegeCount": 1, "privileges": [ "9e187a4e-cfe4-419e-8c6c-2509e4bf400b" ], "userCount": 12, "usedIn": { "presets": [ … ] }, "createdBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "createdEpoch": 1734000000000, "createdDate": "2024-12-12T12:00:00.000Z", "lastUpdatedBy": "a5ae4577-8940-4ca9-bf2c-b1b65b4306ec", "lastUpdatedEpoch": 1755600500000, "lastUpdatedDate": "2025-08-19T12:08:20.000Z" }
Request
Permanently delete a security role the authenticated customer owns. There is no force-delete override.
Delete Rules:
- Role must exist for the authenticated customer.
- Deletion is blocked when either at least one user is currently assigned the role, or at least one preset (upload or filter) still references it in its
role_ids. Both conditions are checked and reported together — the response names every blocker at once, not just the first one found. - The role is not silently unassigned from users or stripped out of presets to allow the delete — the caller must resolve the blockers first.
This action is permanent and cannot be undone.
The user submitting the request must have the Role Management privilege.
- https://api.uat.tenovos.io/v1/security/roles/{id}
- https://api.tenovos.io/v1/security/roles/{id}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X DELETE \
https://api.uat.tenovos.io/v1/security/roles/6c15af83-d4a9-4772-875a-1c8a2bb1688f \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'Invoke the Story Boards API to retrieve and manage Story Boards. Story Boards are curated content experiences that combine collections, saved searches, and other content blocks into a single shareable view.
Coming Soon: Additional endpoints for creating, updating, and deleting Story Boards.
Tenovos Webhook Subscriptions
For more information about our Webhooks, see the Webhook section of our Developer Portal