Invoke the Action API to retrieve information about invoked Actions.
- API v1.5 Documentation
- Payload Reference
- (NEW!) List Security Templates Available to Current User
API Endpoint Reference (1.5)
Tenovos has introduced version 1.5 to provide non-breaking improvements over previous versions.
Key Changes:
- Authentication Standards now include OAuth2 code flow.
- Client ID is no longer required to be passed when requesting an Authorization token using our Standard Auth from v1.4
- New endpoints have been added and will continue to be added until v2 is generally available to all customers.
- Adaptive Template endpoints
- A new Get Asset endpoint with a simplified Response
- A new Create Asset endpoint with simplified payloads for the Request and Response
- A new Update Asset endpoint with simplified payloads for the Request and Response
- Metadata Admin API endpoints for managing Attributes, Groups, and Templates
- We've made some performance improvements to most endpoints
Tenovos Content Delivery Network (CDN) - Coming Soon!
Tenovos CDN: Pull Zone Overview
Tenovos CDN provides global content acceleration and optimization through a pull zone architecture, ensuring that your assets are delivered to end users with maximum speed, reliability, and efficiency. A Content Delivery Network (CDN) works by caching static content—such as images, videos, and other media—on servers distributed across the globe. When an asset is requested, the CDN serves it from the nearest edge location, reducing load times and offloading traffic from the origin server, which in this case is Tenovos DAM.
A pull zone is the core mechanism that powers this system. It automatically fetches content from the origin the first time it is requested, then caches it at the edge. Subsequent requests are served directly from the CDN cache, improving response times and reducing bandwidth consumption.
Through the Tenovos CDN API, you can create, update, and manage pull zones programmatically. Pull zones support advanced features such as global edge caching, cache purging, bandwidth controls, and real-time performance statistics like cache hit rate and geographic request distribution. Optional optimization settings allow you to enhance performance further by enabling image compression, WebP and AVIF support, and content minification.
With just a few API calls, you can fully integrate high-performance content delivery into your Tenovos workflows—no complex infrastructure required.
Invoke the Collection API to create, retrieve, edit, and delete Collections. Collections are used to group and catalog related Assets for quick access and consumption. Collections can be configured as:
- private: Visible only to the user who created the Collection.
- secured: Visible to users with.
When retrieving the Assets within a Collection, the requesting user will only see the Assets that the user has access to view. For example, a librarian may see all Assets within a Collection, but a general consumer user may only see a portion of those Assets, due to limited security access.
Invoke the Metadata Attributes API to retrieve Metadata Attributes, and to create, read, update, and delete Metadata Attribute definitions. Metadata Attributes come in varying types, including Text, Date, Controlled Vocabulary, Tabular, and Cascading, and can be assigned to Metadata Groups and Templates.
Admin Endpoints (NEW!): Create, read, update, and delete Metadata Attributes. These endpoints require the Metadata Management admin privilege.
Invoke the Metadata Templates API to create, read, update, and delete Metadata Templates, and to apply Metadata definition changes. A Metadata Template defines a set of Metadata Attributes that, when assigned to an Asset, become available for population on that Asset.
Admin Endpoints (NEW!): Create, read, update, and delete Metadata Templates. These endpoints require the Metadata Management admin privilege.
Request
User will get the list of Security Templates available to them.
The user submitting the request must have administrator rights to view Security Templates.
In response user will get a list, containing template names and their corresponding template id.
Average Response Time: 243ms
- https://api.uat.tenovos.io/v1/security/template
- https://api.tenovos.io/v1/security/template
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
https://api.uat.tenovos.io/v1/security/template \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'[ { "templateId": "7d7345d0-f423-11e9-8071-89c0c4052141", "templateName": "No Access", "securityDenormalized": [ … ], "templateDocument": [ … ] } ]
Request
Retrieve an offset-paginated list of security, rights, or access templates for the authenticated customer. Each row is a lightweight summary — group and permission counts, not group contents — suited to an admin browse/list screen.
Defaults:
typedefaults tosecurity-template.fromdefaults to0.limitdefaults to100.sortFielddefaults totemplateName.orderdefaults toasc.
Business Rules:
searchTermis trimmed and, when non-empty, matched as a case-insensitive substring against template name. It is trimmed before use, so a blank or whitespace-only value is treated as if omitted. Literal%and_are treated as text, not SQL wildcards.- Results are ordered by the requested
sortField/order. Templateidis used as a deterministic secondary sort field, using the sameorderas the primary sort field. groupCountandpermissionCountare returned as first-class fields without returning the underlying group or permission objects.
The user submitting the request must have the Security Template Management admin privilege.
Case-insensitive substring match against template name. Trimmed before use — a blank or whitespace-only value is treated as if omitted. Literal % and _ are treated as text, not SQL wildcards. Omitted returns all templates of the requested type.
Template classification to list. Defaults to security-template.
Field to sort results by. Defaults to templateName.
- https://api.uat.tenovos.io/v1/security/templates
- https://api.tenovos.io/v1/security/templates
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://api.uat.tenovos.io/v1/security/templates?searchTerm=confidential&type=security-template&from=0&limit=100&sortField=templateName&order=asc' \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'{ "templates": [ { … } ], "pageInfo": { "from": 0, "limit": 100, "totalCount": 120, "hasNextPage": true } }
Request
Create a security, rights, or access template for the authenticated customer.
Business Rules:
namemust be trimmed, non-empty, and unique per customer.typeis set only at creation and is immutable thereafter.- Every
groups[].idandpermissionIds[]entry must be a well-formed UUID and must exist for the customer (groups) or in the permission catalog (permissions). Unknown ids are rejected with422, not silently dropped. - Duplicate group ids in the same request are rejected.
Defaults:
typedefaults tosecurity-template.groupsdefaults to[].
The response body is returned in the same shape as GET /security/templates/{id}, so the UI can render the created template with no follow-up read.
The user submitting the request must have the Security Template Management admin privilege.
JSON object describing the template to create. Required: name. Optional: type (defaults to security-template), groups (defaults to []).
Display name of the template. Trimmed, non-empty, maximum 75 characters. Must be unique per customer.
Template classification. Defaults to security-template. Set only at creation; immutable thereafter.
- https://api.uat.tenovos.io/v1/security/templates
- https://api.tenovos.io/v1/security/templates
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
- Create With Groups
- Create Empty
curl -i -X POST \
https://api.uat.tenovos.io/v1/security/templates \
-H 'Authorization: string' \
-H 'Content-Type: application/json' \
-H 'X-API-Key: YOUR_API_KEY_HERE' \
-d '{
"name": "Confidential",
"type": "security-template",
"groups": [
{
"id": "f22dccbc-6032-4279-9f19-d5dc91d9757e",
"permissionIds": [
"31bdde6b-1a2c-4d5e-8f90-1234567890ab",
"9e187a4e-cfe4-419e-8c6c-2509e4bf400b"
]
},
{
"id": "dbf4f3d4-fd66-49ec-ad20-dbe3b142a8c9",
"permissionIds": []
}
]
}'Created. The response body is the new template in the same shape as GET /security/templates/{id}, including the first page of groups.
Template classification. Set at creation and immutable thereafter.
Total number of permissions granted across all groups, including the watermark permission.
User ID of the template's creator.
User ID of the user who last updated the template.
Unix timestamp (ms) of the last update. Pass this value back as expectedLastUpdatedEpoch on PATCH to guard against concurrent edits.
{ "id": "a9380047-07d7-48aa-b4b7-474d00f0f428", "name": "Confidential", "type": "security-template", "groupCount": 2, "permissionCount": 3, "createdBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "createdEpoch": 1773070355217, "createdDate": "2026-03-09T15:32:35.217Z", "lastUpdatedBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "lastUpdatedEpoch": 1773070355217, "lastUpdatedDate": "2026-03-09T15:32:35.217Z", "groups": { "totalCount": 2, "items": [ … ], "pageInfo": { … } } }
Request
Retrieve the security, rights, or access templates the authenticated user may act on — either templates the user can view, or templates that grant the user a specific permission. Returns only id and name, suited to populating a template picker for ingest, edit, or delete flows.
Business Rules:
- When
permissionIdis omitted, returns templates the user has view access to (resolved from the user's group membership). - When
permissionIdis provided, returns only templates where at least one of the user's groups is granted that permission. - Templates with no visible groups, and groups with no remaining permissions after filtering, are excluded.
Defaults:
typedefaults tosecurity-template.fromdefaults to0.limitdefaults to100.
The requesting user must be authenticated.
Permission ID to check. When provided, only templates granting this permission to one of the user's groups are returned. When omitted, templates the user can view are returned.
Template classification to list. Defaults to security-template.
Result offset from which to start. Must be an integer of 0 or greater; a negative or non-integer value is rejected with a 400. Defaults to 0.
- https://api.uat.tenovos.io/v1/security/templates/user
- https://api.tenovos.io/v1/security/templates/user
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://api.uat.tenovos.io/v1/security/templates/user?permissionId=31bdde6b-1a2c-4d5e-8f90-1234567890ab&type=security-template&from=0&limit=100&cursor=string' \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'{ "templates": [ { … } ], "pageInfo": { "hasNextPage": false, "nextCursor": null } }
Request
Retrieve full detail for a single security, rights, or access template — header fields plus a paginated page of its groups, each with its permissions.
Defaults:
includePermissionsdefaults totrue.groupLimitdefaults to100.
Pagination:
- Loop on
groups.pageInfo.nextCursor, passing it back asgroupCursor, untilgroups.pageInfo.hasNextPageisfalse.
The user submitting the request must have the Security Template Management admin privilege.
- https://api.uat.tenovos.io/v1/security/templates/{templateId}
- https://api.tenovos.io/v1/security/templates/{templateId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://api.uat.tenovos.io/v1/security/templates/a9380047-07d7-48aa-b4b7-474d00f0f428?includePermissions=true&groupLimit=100&groupCursor=string' \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'Full detail of the security template.
Template classification. Set at creation and immutable thereafter.
Total number of permissions granted across all groups, including the watermark permission.
User ID of the template's creator.
User ID of the user who last updated the template.
Unix timestamp (ms) of the last update. Pass this value back as expectedLastUpdatedEpoch on PATCH to guard against concurrent edits.
{ "id": "a9380047-07d7-48aa-b4b7-474d00f0f428", "name": "Confidential", "type": "security-template", "groupCount": 34, "permissionCount": 12, "createdBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "createdEpoch": 1773070355217, "createdDate": "2026-03-11T14:32:35Z", "lastUpdatedBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "lastUpdatedEpoch": 1773070399999, "lastUpdatedDate": "2026-03-11T15:00:00Z", "groups": { "totalCount": 34, "items": [ … ], "pageInfo": { … } } }
Request
Partially update a security, rights, or access template. Only the fields present in the body are changed.
Business Rules:
typeis not an updatable field. If present in the body, the request is rejected with400. Type is fixed at creation because assets and metadata templates reference the template by id and assume its type.- At least one of
nameorgroupsmust be present, or the request is rejected with400. Unknown fields are also rejected with400. - When
groupsis present, it is a full replacement of the template's group/permission set — omitted groups are removed, not left alone. - Every
groups[].idandpermissionIds[]entry must be a well-formed UUID and must exist for the customer (groups) or in the permission catalog (permissions). Unknown ids are rejected with422. name, if changed, is re-checked for uniqueness per customer.
Optimistic Concurrency:
- Opt-in via
expectedLastUpdatedEpoch. If provided, it is compared against the template's currentlastUpdatedEpoch; a mismatch is rejected with409andcode: STALE_UPDATE. If omitted, the update proceeds last-write-wins.
The response body is returned in the same shape as GET /security/templates/{id}.
The user submitting the request must have the Security Template Management admin privilege.
JSON object with the fields to change. name and/or groups — at least one required. groups, when present, fully replaces the existing group/permission set. type cannot be included.
Updated display name. Same validation as creation (trimmed, non-empty, maximum 75 characters); re-checked for uniqueness if changed.
When present, this is a full replacement of the template's group/permission set — the service recomputes both stored columns from it. Omit to leave the current groups untouched.
- https://api.uat.tenovos.io/v1/security/templates/{templateId}
- https://api.tenovos.io/v1/security/templates/{templateId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
- Rename Only
- Replace Groups
curl -i -X PATCH \
https://api.uat.tenovos.io/v1/security/templates/a9380047-07d7-48aa-b4b7-474d00f0f428 \
-H 'Authorization: string' \
-H 'Content-Type: application/json' \
-H 'X-API-Key: YOUR_API_KEY_HERE' \
-d '{
"name": "Confidential - Marketing"
}'Updated. The response body is the template in the same shape as GET /security/templates/{id}.
Template classification. Set at creation and immutable thereafter.
Total number of permissions granted across all groups, including the watermark permission.
User ID of the template's creator.
User ID of the user who last updated the template.
Unix timestamp (ms) of the last update. Pass this value back as expectedLastUpdatedEpoch on PATCH to guard against concurrent edits.
{ "id": "a9380047-07d7-48aa-b4b7-474d00f0f428", "name": "Confidential - Marketing", "type": "security-template", "groupCount": 1, "permissionCount": 1, "createdBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "createdEpoch": 1773070355217, "createdDate": "2026-03-09T15:32:35.217Z", "lastUpdatedBy": "dc63db1b-1e63-43bc-877e-418931b6895c", "lastUpdatedEpoch": 1773070500000, "lastUpdatedDate": "2026-03-09T15:35:00.000Z", "groups": { "totalCount": 1, "items": [ … ], "pageInfo": { … } } }
Request
Permanently delete a security, rights, or access template the authenticated customer owns.
Delete Rules:
- Template must exist for the authenticated customer.
- Deletion is blocked when the template is still referenced: either it has stored dependencies, or it is applied somewhere — for
access-template, the count of metadata templates using it; otherwise, the count of assets using it. - There is no force-delete option. An in-use template can only be removed directly against the database, outside this API.
- On success, the deletion is recorded in
tenovos_delete_historyfor thesecurity-templatetype.
This action is permanent and cannot be undone.
The user submitting the request must have the Security Template Management admin privilege.
- https://api.uat.tenovos.io/v1/security/templates/{templateId}
- https://api.tenovos.io/v1/security/templates/{templateId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X DELETE \
https://api.uat.tenovos.io/v1/security/templates/a9380047-07d7-48aa-b4b7-474d00f0f428 \
-H 'Authorization: string' \
-H 'X-API-Key: YOUR_API_KEY_HERE'Invoke the Story Boards API to retrieve and manage Story Boards. Story Boards are curated content experiences that combine collections, saved searches, and other content blocks into a single shareable view.
Coming Soon: Additional endpoints for creating, updating, and deleting Story Boards.
Tenovos Webhook Subscriptions
For more information about our Webhooks, see the Webhook section of our Developer Portal