Skip to content
Getting Started
/
/
/
(NEW!) Create Security Us...

API Endpoint Reference (1.5)

Tenovos has introduced version 1.5 to provide non-breaking improvements over previous versions.

Key Changes:

  • Authentication Standards now include OAuth2 code flow.
  • Client ID is no longer required to be passed when requesting an Authorization token using our Standard Auth from v1.4
  • New endpoints have been added and will continue to be added until v2 is generally available to all customers.
    • Adaptive Template endpoints
    • A new Get Asset endpoint with a simplified Response
    • A new Create Asset endpoint with simplified payloads for the Request and Response
    • A new Update Asset endpoint with simplified payloads for the Request and Response
    • Metadata Admin API endpoints for managing Attributes, Groups, and Templates
  • We've made some performance improvements to most endpoints
Find out more about Tenovos
Download OpenAPI description
Download OpenAPI spec (YAML)
Download OpenAPI spec (JSON)
Overview
E-mail
product@tenovos.com
License
Tenovos Active Story Management
Terms of Service
Languages
Servers
https://api.uat.tenovos.io/v1
https://api.tenovos.io/v1

ACTIONS

Invoke the Action API to retrieve information about invoked Actions.

Operations

ADAPTIVE TEMPLATES

Invoke the API to retrieve information about invoked Actions.

Operations

ASSETS

Invoke the Asset API to create, retrieve, manipulate, and share Assets. This API also provides operations to manage Asset relationships and download Asset content.

Operations

AUTHENTICATION

Invoke the Authentication API to generate, refresh, and revoke access tokens. An access token is required to perform any authorized API operation.

Operations

CDN (Coming Soon!)

Tenovos Content Delivery Network (CDN) - Coming Soon!

Tenovos CDN: Pull Zone Overview

Tenovos CDN provides global content acceleration and optimization through a pull zone architecture, ensuring that your assets are delivered to end users with maximum speed, reliability, and efficiency. A Content Delivery Network (CDN) works by caching static content—such as images, videos, and other media—on servers distributed across the globe. When an asset is requested, the CDN serves it from the nearest edge location, reducing load times and offloading traffic from the origin server, which in this case is Tenovos DAM.

A pull zone is the core mechanism that powers this system. It automatically fetches content from the origin the first time it is requested, then caches it at the edge. Subsequent requests are served directly from the CDN cache, improving response times and reducing bandwidth consumption.

Through the Tenovos CDN API, you can create, update, and manage pull zones programmatically. Pull zones support advanced features such as global edge caching, cache purging, bandwidth controls, and real-time performance statistics like cache hit rate and geographic request distribution. Optional optimization settings allow you to enhance performance further by enabling image compression, WebP and AVIF support, and content minification.

With just a few API calls, you can fully integrate high-performance content delivery into your Tenovos workflows—no complex infrastructure required.

Operations

COLLECTIONS

Invoke the Collection API to create, retrieve, edit, and delete Collections. Collections are used to group and catalog related Assets for quick access and consumption. Collections can be configured as:

  • private: Visible only to the user who created the Collection.
  • secured: Visible to users with.

When retrieving the Assets within a Collection, the requesting user will only see the Assets that the user has access to view. For example, a librarian may see all Assets within a Collection, but a general consumer user may only see a portion of those Assets, due to limited security access.

Operations

METADATA

Invoke the Metadata API to manage Metadata Attributes, Groups, and Templates. A Metadata Template defines a set of Metadata Attributes of varying types, including Text, Date, Controlled Vocabulary, Tabular, and Cascading Attributes. When a Metadata Template is assigned to a new Asset, the corresponding Metadata Attributes will be available for population on the Asset.

Admin Endpoints (NEW!): Create, read, update, and delete Metadata Attributes and Metadata Groups. These endpoints require the Metadata Management admin privilege.

Operations

REQUESTS

Invoke these API's to create new Requests and manage existing Requests.

Operations

SECURITY

Invoke the Security API to manage Security Templates, Security Roles, Security User Groups, and the Permissions and Privileges that control what a user can see and do across the platform.

Operations

(NEW!) List Security User Groups (Paginated)

Request

Retrieve a paginated, searchable list of the security user groups configured for the authenticated customer. This endpoint only ever operates on type: security groups — there is no way to request channel groups through it.

Defaults:

  • sortField defaults to groupName.
  • order defaults to asc.
  • from defaults to 0.
  • limit defaults to 100 (clamped to 100 if a higher value is supplied).

Business Rules:

  • searchTerm is a case-insensitive substring match on group name. Special LIKE characters (%, _, \) are treated as literal text, not wildcards.
  • There is no type query parameter. Every group returned is type: security. Sending a type parameter of any value — including security — is rejected with 400; it is not silently ignored, and it never changes what's returned. Channel groups are created and managed exclusively by the Publishing flow under a separate privilege, never through this API.

The user submitting the request must have the User Management privilege.

Security
ApiKeyAuth or BasicAuth
Query
searchTermstring

Case-insensitive substring match on group name. Special LIKE characters (%, _, \) are treated as literal text.

sortFieldstring

Field to sort results by. Defaults to groupName.

Default "groupName"
Enum"groupName""userCount""createdEpoch""lastUpdatedEpoch"
orderstring

Sort direction. Defaults to asc.

Default "asc"
Enum"asc""desc"
frominteger

Result offset from which to start. Defaults to 0.

Default 0
Example: from=0
limitinteger

Number of results to return per page. Defaults to 100, maximum 100 (values above 100 are silently clamped).

Default 100
Example: limit=100
Headers
X-API-Keystringrequired

Customer-specific API key required to invoke API.

Authorizationstringrequired

Provided by Authentication Token creation operation.

curl -i -X GET \
  'https://api.uat.tenovos.io/v1/security/user-groups?searchTerm=string&sortField=groupName&order=asc&from=0&limit=100' \
  -H 'Authorization: string' \
  -H 'X-API-Key: YOUR_API_KEY_HERE'

Responses

Paginated list of security user groups.

Bodyapplication/json
groupsArray of objects

Groups on this page.

pageInfoobject
Response
application/json
{
  "groups": [
    { … }
  ],
  "pageInfo": {
    "from": 0,
    "limit": 100,
    "total": 1,
    "hasNextPage": false
  }
}

(NEW!) Create Security User Group

Request

Create a security user group for the authenticated customer. name is the only accepted field.

Business Rules:

  • name must be 1-255 characters after trimming, and unique per customer, case-insensitively — enforced by a database constraint, so a race between two concurrent creates for the same name always resolves to exactly one winner and a 409 for the loser.
  • type is not an accepted input field at all. Sending it, with any value, is rejected with 400 — the created group is always type: security; this is reflected in the response but can never be set by the caller.

The user submitting the request must have the User Management privilege.

Security
ApiKeyAuth or BasicAuth
Headers
X-API-Keystringrequired

Customer-specific API key required to invoke API.

Authorizationstringrequired

Provided by Authentication Token creation operation.

Content-Typestringrequired
Value"application/json"
Bodyapplication/jsonrequired

JSON object defining the group to create. name is the only accepted field.

namestringrequired

Display name of the group. 1-255 characters after trimming. Must be unique per customer, case-insensitively. type is not an accepted input field — the created group is always type: security.

Example: "Pied Piper Engineering"
curl -i -X POST \
  https://api.uat.tenovos.io/v1/security/user-groups \
  -H 'Authorization: string' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: YOUR_API_KEY_HERE' \
  -d '{
    "name": "Pied Piper Engineering"
  }'

Responses

Created. The response body is the new group in the same shape as GET /security/user-groups/{id} — a brand-new group always has userCount: 0 and usedIn.securityTemplates: [].

Headers
Locationstring

Path of the newly created group, e.g. /security/user-groups/{id}.

Bodyapplication/json
idstringrequired

Unique ID of the group. Opaque string — ids are generated as UUIDs, but this isn't a format guarantee.

Example: "group-hooli-corporate"
namestringrequired

Display name of the group.

Example: "Hooli Corporate"
typestringrequired

Always security for a group returned by this API. Response-only — never an accepted input field on create or update.

Value"security"
Example: "security"
userCountinteger

Number of users currently in this group.

Example: 24
usedInobject

Everywhere the group is currently referenced.

createdBystring or null(uuid)

User-profile id of the group's creator. null if the row has no recorded author.

Example: "dc63db1b-1e63-43bc-877e-418931b6895c"
createdEpochinteger

Unix timestamp (ms) of creation.

Example: 1734000000000
createdDatestring or null(date-time)

ISO 8601 creation date, derived from createdEpoch.

Example: "2024-12-12T12:00:00.000Z"
lastUpdatedBystring or null(uuid)

User-profile id of the last user to update the group. null if the row has no recorded author.

Example: "a5ae4577-8940-4ca9-bf2c-b1b65b4306ec"
lastUpdatedEpochinteger

Unix timestamp (ms) of the last update.

Example: 1755600000000
lastUpdatedDatestring or null(date-time)

ISO 8601 last-updated date, derived from lastUpdatedEpoch.

Example: "2025-08-19T12:00:00.000Z"
Response
application/json
{
  "id": "group-pied-piper-engineering",
  "name": "Pied Piper Engineering",
  "type": "security",
  "userCount": 0,
  "usedIn": {
    "securityTemplates": []
  },
  "createdBy": "dc63db1b-1e63-43bc-877e-418931b6895c",
  "createdEpoch": 1773070355217,
  "createdDate": "2026-03-09T15:32:35.217Z",
  "lastUpdatedBy": "dc63db1b-1e63-43bc-877e-418931b6895c",
  "lastUpdatedEpoch": 1773070355217,
  "lastUpdatedDate": "2026-03-09T15:32:35.217Z"
}

(NEW!) Bulk Create Security User Groups

Request

Create multiple security user groups for the authenticated customer in a single all-or-nothing batch. Either every name in the batch is created, or none are — there is no partial success.

Business Rules:

  • names must be a non-empty array of strings, maximum 50 entries per request. A batch over 50 names is rejected outright with a plain 400 ("maximum 50 user groups are allowed in a request") without itemizing individual names — this structural check runs before any per-name validation.
  • Each name follows the same rules as single-create (1-255 characters after trim).
  • A name repeated within the same request (case-insensitively, after trimming) is rejected — it is not silently de-duplicated.
  • All entries in one batch share the same createdEpoch/createdBy (one request, one actor, one timestamp), and each gets its own id.
  • There is no Location response header on this endpoint, since it creates multiple resources.

The user submitting the request must have the User Management privilege.

Security
ApiKeyAuth or BasicAuth
Headers
X-API-Keystringrequired

Customer-specific API key required to invoke API.

Authorizationstringrequired

Provided by Authentication Token creation operation.

Content-Typestringrequired
Value"application/json"
Bodyapplication/jsonrequired

JSON object listing the group names to create. Required: names — non-empty array, maximum 50 entries.

namesArray of strings[ 1 .. 50 ] itemsrequired

Non-empty array of group names to create. Maximum 50 entries per request. Each name follows the same rules as single-create (1-255 characters after trimming). A name repeated within the same request (case-insensitively, after trimming) is rejected — it is not silently de-duplicated.

Example: ["Hooli Corporate","Hooli EMEA","Hooli APAC"]
curl -i -X POST \
  https://api.uat.tenovos.io/v1/security/user-groups/bulk \
  -H 'Authorization: string' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: YOUR_API_KEY_HERE' \
  -d '{
    "names": [
      "Hooli Corporate",
      "Hooli EMEA",
      "Hooli APAC"
    ]
  }'

Responses

Created. Every entry in created is the full detail shape from GET /security/user-groups/{id}.

Bodyapplication/json
createdArray of objects(security-user-group-detail)
Response
application/json
{
  "created": [
    { … },
    { … },
    { … }
  ]
}

PEOPLE

Invoke the User API to retrieve User profile information.

Operations

STORY BOARDS

Invoke the Story Boards API to retrieve and manage Story Boards. Story Boards are curated content experiences that combine collections, saved searches, and other content blocks into a single shareable view.

Coming Soon: Additional endpoints for creating, updating, and deleting Story Boards.

Operations

WEBHOOKS

Tenovos Webhook Subscriptions

For more information about our Webhooks, see the Webhook section of our Developer Portal

Operations

PROOFING

Operations