API clients

Every client works from the same OpenAPI contract the platform publishes, so it always matches the API of the server you call. Every request and answer in the contract has an example.

Swagger UICopy Anchor Link

The quickest way: open <server>/swagger-ui.html in a browser, for example http://127.0.0.1:8080/swagger-ui.html after the Quick start. Sign in with POST /api/v1/auth/login, then choose Authorize and paste the token.

PostmanCopy Anchor Link

Postman imports the API directly from the installation you call, so the collection always matches that server.

1. Create an environment. Create an environment named BPMS with the variables in the table below and select it. Set baseUrl to your server, without a trailing slash, and username; put password only in the current value.

2. Import the API. Choose Import, then Link, and enter the address of the contract the installation serves, <baseUrl>/v3/api-docs, for example https://bpms.bpms.work/v3/api-docs. Import it as a Postman collection.

3. Authenticate the collection. In the collection, open Authorization, choose Bearer Token, and enter {{token}}. Check that the requests start with {{baseUrl}}.

4. Sign in. Open POST /api/v1/auth/login, set the body to {"username": "{{username}}", "password": "{{password}}"}, and add this post-response script, which stores the token:

   Copy Text

   pm.environment.set("token", pm.response.json().token);

5. Call the API. Send GET /api/v1/access/roles. A session lasts 9 hours by default; sign in again when calls start answering 401.

When the installation is updated, delete the collection and import it again from the same link: the environment keeps the URL, the credentials, and the token.

Clients without an accountCopy Anchor Link

Keep credentials outCopy Anchor Link

• Never put a real password or token in a request, a collection variable, or the initial value of an environment variable; use {{password}} and {{token}}. Signed in, Postman syncs collections to its own cloud.
• Never share an exported collection or environment that holds real values.
• If a token leaks, sign out with it, POST /api/v1/auth/logout: the session closes and the token stops working.