Your instance
Enter your domain only — the platform sets the path (
/api vs /yurbi/api). Values fill every sample & power Send.
API Reference
Every call is a POST to your own Yurbi server. Authenticate with Quickstart to get a session token, then pass it on every other call. New here? Start with the Introduction.
Base https://your-yurbi-server.com/api
Format JSON
Auth Session token
Method POST
Authentication
Log in
POST
/api/login/DoLogin
Authenticate a user and receive a session token. On success the token is in LoginSession.SessionToken and ErrorCode is 0. Invalid credentials return ErrorCode 101 with "Login Failed - Username or Password is invalid." and a null session. Yurbi maintains one session per user: each successful login issues a new token and ends that user's previous session. The full response is around 200 KB, because LoginUser.Language.phraselist carries the interface phrase table. The sample below shortens that list.
Common use: Start here. Run this once, copy the returned token into the Session token field at the top of the page, and every other sample is ready to send. Because a new login ends the previous session, cache the token on your server and reuse it across requests rather than logging in per call, and give each integration its own Yurbi user. The accounts
scheduler and yurbi are reserved for internal services and cannot sign in.Body parameters
| UserIdstring | Required | The user's login name. |
| UserPasswordstring | Required | The user's PIN or password. |
| isGuestboolean | Required | Set true only for a guest login; otherwise false. |
| bolForceLoginboolean | Required | Send true. The field is required; omitting it returns ErrorCode 9000. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"LoginSession": {
"ErrorCode": 0,
"ErrorMessage": "",
"SessionToken": "QK[OFHLQSDQROJQULKPJQPGXG",
"SessionFlag": 0,
"isGuestSession": false,
"SessionTimeLeft": 0,
"SessionExpir": "2026-08-27T14:33:48.4458383+00:00",
"Duo2FA_State": "",
"Duo2FA_AuthURI": null,
"Duo2FA_AuthStatus": null
},
"LoginUser": {
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234363032231617",
"LoginName": "apitest",
"FirstName": "API",
"LastName": "Test",
"EmailAddress": "",
"Company": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:05:03",
"ModifyDate": "2026-08-27T14:05:03",
"LoginDate": "2026-08-27T14:05:03",
"Pin": null,
"AuthType": "PIN",
"isAdmin": true,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": true,
"SecurityGroups": [
{
"GroupId": "1",
"GroupName": "Administrators",
"GroupDescription": "Yurbi Admins",
"GroupRoles": [
{
"RoleId": "1",
"RoleName": "Admin"
}
],
"GroupStatus": 0
}
],
"ComboName": "Test, API",
"FullName": "API Test",
"UserApplications": [
{
"ApplicationID": "1001",
"ApplicationName": "Sample Data",
"ApplicationRoleID": "7",
"ApplicationRoleName": "Architect",
"ApplicationRoleType": "0",
"applicationUserDataSourceID": ""
}
],
"Language": {
"id": 1,
"nativename": "English",
"englishname": "English",
"iso_name": "EN",
"phraselist": [
{
"internalname": "Login",
"text": "Log In",
"dialog": "Main"
}
]
},
"timezone": -6,
"timezonename": "America/Bahia_Banderas",
"isFastCache": 0,
"FastCacheLimit": 30,
"bforcepasschange": false
},
"Tenant_Mode": false,
"ProductName": "Yurbi",
"ProductType": 2,
"ProductVersion": "12.26.08.24",
"LicensedFeatures": [
{
"Feature": "monthly active users",
"count": "100",
"id": "86"
}
],
"maustate": "Normal",
"maxrecords": "500000"
}
Authentication
Check session
POST
/api/Session/CheckSession
Confirm a session token is still valid. A valid token returns ErrorCode 0 with the session's current SessionExpir. An expired or unknown token returns ErrorCode 101 with "Session Expired" and a SessionExpir of 0001-01-01T00:00:00.
Common use: Cheap to call before a long-running job. Like any authenticated request, it also extends the session, resetting the expiry to the current time plus the server's session timeout.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | The session token to validate. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"SessionToken": "QK[OFHLQSDQROJQULKPJQPGXG",
"SessionFlag": 0,
"isGuestSession": false,
"SessionExpir": "2026-08-27T14:41:05.1956089+00:00"
}
Authentication
Refresh session
POST
/api/Session/RefreshSession
Extend a session token's lifetime without a full re-login, resetting SessionExpir to the current time plus the server's session timeout. That timeout is SESSION_TIMEOUT in app settings and defaults to 20 minutes.
Common use: Use this to keep a session alive across a long idle period, such as an embedded dashboard left open on a wall display. Integrations that make requests regularly do not need it: every authenticated call already moves the expiry forward.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | The session token to extend. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"SessionToken": "JDEJGZRMSTXHYJJTOEHMSNYMN",
"SessionFlag": 0,
"isGuestSession": false,
"SessionExpir": "2026-08-27T14:41:01.738885"
}
Authentication
Reset session passport
POST
/api/Session/ResetPassport
Rebuild the session's passport — its cached licence and permission state — and return it. The response describes licensed modules, registered servers and SMTP configuration for the instance.
Common use: Use it after changing a user's group membership or roles so the change applies to their current session instead of waiting for their next login. Yurbi also refreshes the passport internally after a report is saved, to recalculate embedded and anonymous licence consumption.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | The session token whose passport should be rebuilt. |
| withReturnboolean | Optional | Reserved. Send false. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"isFirstRun": true,
"isExpiredBase": false,
"isValidBase": false,
"isValidTrial": false,
"Version": 0,
"ProdType": 0,
"TotalReportCount": 0,
"TotalUserCount": 0,
"YurbiModuleProfiles": [],
"isSchedulerLicensed": false,
"isConnectLicensed": false,
"isRolesLicensed": false,
"isLDAPLicensed": false,
"isAppShieldLicensed": false,
"RegisteredServerList": [],
"YurbiLicenses": [],
"TrialLicenses": [],
"TeamLicenses": [],
"EnterpriseLicenses": [],
"SMTPServerList": []
}
Authentication
Log out
POST
/api/login/DoLogout
End a session and release its token. Returns a bare 0 rather than a JSON object. Afterwards the token returns ErrorCode 101 from Check session.
Common use: Call this when a script finishes so you don't leave sessions open on the server.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | The session token to end. |
Edit any value, then Send
Invalid JSON
Response
Example response
0
Users
New user template
POST
/api/Contact/NewContact
Return an empty user object with every collection initialised. Fill it in and pass it to Save user.
Common use: Start every user creation here rather than hand-building the object, so new fields added in later Yurbi releases are present with sensible defaults.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": null,
"ID": null,
"LoginName": null,
"FirstName": null,
"LastName": null,
"EmailAddress": null,
"Company": null,
"Tag1": null,
"twofa": null,
"Pin": null,
"AuthType": null,
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": false,
"SecurityGroups": [],
"UserApplications": [],
"Preferences": [],
"timezone": 0,
"timezonename": null,
"isFastCache": 0
}
Users
Create or update a user
POST
/api/Contact/SaveContact
Create a user or update an existing one. user.ID decides which: send null to create, or an existing ID to update. Set withpin to true when the payload carries a Pin to apply. App access is assigned in the same call through user.UserApplications, and Profile Tags through Tag1–Tag4.
Common use: The core of user provisioning. A complete provision is this call followed by Add user to group: this sets identity, credentials, Profile Tags and app roles; that sets the library role inside the tenant's group.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| withpinboolean | Required | True when user.Pin should be applied. |
| userobject | Required | The user object. Start from New user template. ID null creates; an existing ID updates. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234395265102835",
"LoginName": "jsmith",
"FirstName": "Jane",
"LastName": "Smith",
"EmailAddress": "[email protected]",
"Company": "Acme",
"Tag1": "TENANT-A",
"Tag2": "",
"Tag3": "",
"Tag4": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:58:46",
"ModifyDate": "2026-08-27T14:58:47",
"LoginDate": "2026-08-27T14:58:46",
"Pin": null,
"AuthType": "PIN",
"Description": "",
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": true,
"SecurityGroups": [
{
"GroupId": "12",
"GroupName": "Tenant A",
"GroupRoles": [
{
"RoleId": "3",
"RoleName": "Modify"
}
],
"GroupStatus": 0
}
],
"ComboName": "Smith, Jane",
"FullName": "Jane Smith",
"UserApplications": [
{
"ApplicationID": "1001",
"ApplicationName": "Sample Data",
"ApplicationRoleID": "7",
"ApplicationRoleName": "Architect",
"ApplicationRoleType": "0",
"applicationUserDataSourceID": ""
}
],
"Preferences": [],
"UserState": 0,
"Language": {
"id": 1,
"nativename": "English",
"englishname": "English",
"iso_name": "EN",
"phraselist": null
},
"timezone": -5,
"timezonename": "America/New_York",
"isFastCache": 0,
"FastCacheLimit": 0,
"lockdate": "0001-01-01T00:00:00",
"bforcepasschange": false
}
Users
Update my profile
POST
/api/Contact/SaveMYContact
Update the profile of the user who owns the session. Same payload shape as Save user, scoped to the caller.
Common use: Use this for a self-service profile screen in your own application, so users can change their name or email without an administrator.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| withpinboolean | Required | True when a new Pin is being set. |
| userobject | Required | The signed-in user's object with the fields to change. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234395265102835",
"LoginName": "jsmith",
"FirstName": "Jane",
"LastName": "Smith",
"EmailAddress": "[email protected]",
"Company": "Acme",
"Tag1": "TENANT-A",
"Tag2": "",
"Tag3": "",
"Tag4": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:58:46",
"ModifyDate": "2026-08-27T14:58:47",
"LoginDate": "2026-08-27T14:58:46",
"Pin": null,
"AuthType": "PIN",
"Description": "",
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": true,
"SecurityGroups": [
{
"GroupId": "12",
"GroupName": "Tenant A",
"GroupRoles": [
{
"RoleId": "3",
"RoleName": "Modify"
}
],
"GroupStatus": 0
}
],
"ComboName": "Smith, Jane",
"FullName": "Jane Smith",
"UserApplications": [
{
"ApplicationID": "1001",
"ApplicationName": "Sample Data",
"ApplicationRoleID": "7",
"ApplicationRoleName": "Architect",
"ApplicationRoleType": "0",
"applicationUserDataSourceID": ""
}
],
"Preferences": [],
"UserState": 0,
"Language": {
"id": 1,
"nativename": "English",
"englishname": "English",
"iso_name": "EN",
"phraselist": []
},
"timezone": -5,
"timezonename": "America/New_York",
"isFastCache": 0,
"FastCacheLimit": 0,
"lockdate": "0001-01-01T00:00:00",
"bforcepasschange": false
}
Users
List users
POST
/api/Contact/GetContactList
Return every user on the instance as an array. Each entry carries its own ErrorCode; there is no wrapper object.
Common use: Use it to resolve a login name to an ID, to audit tenant membership, or to fetch the full object a delete requires.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234395265102835",
"LoginName": "jsmith",
"FirstName": "Jane",
"LastName": "Smith",
"EmailAddress": "[email protected]",
"Company": "Acme",
"Tag1": "TENANT-A",
"Tag2": "",
"Tag3": "",
"Tag4": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:58:46",
"ModifyDate": "2026-08-27T14:58:47",
"LoginDate": "2026-08-27T14:58:46",
"Pin": null,
"AuthType": "PIN",
"Description": "",
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": true,
"SecurityGroups": [
{
"GroupId": "12",
"GroupName": "Tenant A",
"GroupRoles": [
{
"RoleId": "3",
"RoleName": "Modify"
}
],
"GroupStatus": 0
}
],
"ComboName": "Smith, Jane",
"FullName": "Jane Smith",
"UserApplications": [
{
"ApplicationID": "1001",
"ApplicationName": "Sample Data",
"ApplicationRoleID": "7",
"ApplicationRoleName": "Architect",
"ApplicationRoleType": "0",
"applicationUserDataSourceID": ""
}
],
"Preferences": [],
"UserState": 0,
"Language": {
"id": 1,
"nativename": "English",
"englishname": "English",
"iso_name": "EN",
"phraselist": []
},
"timezone": -5,
"timezonename": "America/New_York",
"isFastCache": 0,
"FastCacheLimit": 0,
"lockdate": "0001-01-01T00:00:00",
"bforcepasschange": false
}
]
Users
Get a user
POST
/api/Contact/GetContactById
Return a single user by ID, including group memberships, app assignments and Profile Tags.
Common use: Cheaper than listing every user when you already hold an ID — for example to confirm a provisioning run applied the roles you expected.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| ContactIdstring | Required | The user's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234395265102835",
"LoginName": "jsmith",
"FirstName": "Jane",
"LastName": "Smith",
"EmailAddress": "[email protected]",
"Company": "Acme",
"Tag1": "TENANT-A",
"Tag2": "",
"Tag3": "",
"Tag4": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:58:46",
"ModifyDate": "2026-08-27T14:58:47",
"LoginDate": "2026-08-27T14:58:46",
"Pin": null,
"AuthType": "PIN",
"Description": "",
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": true,
"SecurityGroups": [
{
"GroupId": "12",
"GroupName": "Tenant A",
"GroupRoles": [
{
"RoleId": "3",
"RoleName": "Modify"
}
],
"GroupStatus": 0
}
],
"ComboName": "Smith, Jane",
"FullName": "Jane Smith",
"UserApplications": [
{
"ApplicationID": "1001",
"ApplicationName": "Sample Data",
"ApplicationRoleID": "7",
"ApplicationRoleName": "Architect",
"ApplicationRoleType": "0",
"applicationUserDataSourceID": ""
}
],
"Preferences": [],
"UserState": 0,
"Language": {
"id": 1,
"nativename": "English",
"englishname": "English",
"iso_name": "EN",
"phraselist": []
},
"timezone": -5,
"timezonename": "America/New_York",
"isFastCache": 0,
"FastCacheLimit": 0,
"lockdate": "0001-01-01T00:00:00",
"bforcepasschange": false
}
Users
Delete a user
POST
/api/Contact/DeleteContact
Remove a user. The request takes the whole user object under user, not an ID, so fetch it first with List users or Get a user. The deleted record is echoed back with ErrorCode 0; group membership and application assignments are already detached, so those collections come back null or empty.
Common use: Deprovisioning. Removing the user releases the licence seats consumed by their application assignments.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| userobject | Required | The complete user object to delete. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234395265102835",
"LoginName": "jsmith",
"FirstName": "Jane",
"LastName": "Smith",
"EmailAddress": "[email protected]",
"Company": "Acme",
"Tag1": "TENANT-A",
"Tag2": "",
"Tag3": "",
"Tag4": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:58:46",
"ModifyDate": "2026-08-27T14:58:47",
"LoginDate": "2026-08-27T14:58:46",
"Pin": null,
"AuthType": "PIN",
"Description": "",
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": false,
"SecurityGroups": null,
"UserApplications": [],
"Preferences": [],
"UserState": 0,
"ComboName": "Smith, Jane",
"FullName": "Jane Smith",
"Language": {
"id": 1,
"nativename": null,
"englishname": null,
"iso_name": null,
"phraselist": null
},
"timezone": -5,
"timezonename": "America/New_York",
"isFastCache": 0,
"FastCacheLimit": 0,
"lockdate": "0001-01-01T00:00:00",
"bforcepasschange": false
}
Users
Unlock a user
POST
/api/Contact/UnlockContact
Clear a lockout applied after repeated failed sign-ins. Like Delete a user, it takes the whole user object under user. The account's lockdate is reset. The response returns the account record; membership and application collections are not populated on this call.
Common use: Wire this to a help-desk action so support staff can restore access without an administrator opening Yurbi.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| userobject | Required | The complete user object to unlock. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234395265102835",
"LoginName": "jsmith",
"FirstName": "Jane",
"LastName": "Smith",
"EmailAddress": "[email protected]",
"Company": "Acme",
"Tag1": "TENANT-A",
"Tag2": "",
"Tag3": "",
"Tag4": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:58:46",
"ModifyDate": "2026-08-27T14:58:47",
"LoginDate": "2026-08-27T14:58:46",
"Pin": null,
"AuthType": "PIN",
"Description": "",
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": false,
"SecurityGroups": null,
"UserApplications": [],
"Preferences": [],
"UserState": 0,
"ComboName": "Smith, Jane",
"FullName": "Jane Smith",
"Language": {
"id": 1,
"nativename": null,
"englishname": null,
"iso_name": null,
"phraselist": null
},
"timezone": -5,
"timezonename": "America/New_York",
"isFastCache": 0,
"FastCacheLimit": 0,
"lockdate": "0001-01-01T00:00:00",
"bforcepasschange": false
}
Groups & Roles
List security groups
POST
/api/Group/GetAllSecurityGroups
Return every security group with its full membership. Each member is a complete user object, so responses grow with the size of the instance.
Common use: Use it to audit which tenants exist and who belongs to them, and to fetch the group object required by Delete a security group.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ErrorCode": 0,
"ErrorMessage": "",
"GroupId": "12",
"GroupName": "Tenant A",
"GroupDescription": "All users for Tenant A",
"GroupCreated": "2026-08-27T14:58:49",
"GroupModified": "2026-08-27T14:58:49",
"GroupRoles": [],
"Membership": [
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234395265102835",
"LoginName": "jsmith",
"FirstName": "Jane",
"LastName": "Smith",
"EmailAddress": "[email protected]",
"Company": "Acme",
"Tag1": "TENANT-A",
"Tag2": "",
"Tag3": "",
"Tag4": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:58:46",
"ModifyDate": "2026-08-27T14:58:47",
"LoginDate": "2026-08-27T14:58:46",
"Pin": null,
"AuthType": "PIN",
"Description": "",
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": true,
"SecurityGroups": [
{
"GroupId": "12",
"GroupName": "Tenant A",
"GroupRoles": [
{
"RoleId": "3",
"RoleName": "Modify"
}
],
"GroupStatus": 0
}
],
"ComboName": "Smith, Jane",
"FullName": "Jane Smith",
"UserApplications": [
{
"ApplicationID": "1001",
"ApplicationName": "Sample Data",
"ApplicationRoleID": "7",
"ApplicationRoleName": "Architect",
"ApplicationRoleType": "0",
"applicationUserDataSourceID": ""
}
],
"Preferences": [],
"UserState": 0,
"Language": {
"id": 1,
"nativename": null,
"englishname": null,
"iso_name": null,
"phraselist": []
},
"timezone": -5,
"timezonename": "America/New_York",
"isFastCache": 0,
"FastCacheLimit": 0,
"lockdate": "0001-01-01T00:00:00",
"bforcepasschange": false
}
],
"AllUsers": [],
"AllRoles": [],
"GroupStatus": 0
}
]
Groups & Roles
Get a security group
POST
/api/Group/GetSecurityGroupById
Return a single group with its membership.
Common use: The quickest way to confirm that Add user to group or Remove user from group did what you expected.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| GroupIdstring | Required | The group's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"GroupId": "12",
"GroupName": "Tenant A",
"GroupDescription": "All users for Tenant A",
"GroupCreated": "2026-08-27T14:58:49",
"GroupModified": "2026-08-27T14:58:49",
"GroupRoles": [],
"Membership": [
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "639234395265102835",
"LoginName": "jsmith",
"FirstName": "Jane",
"LastName": "Smith",
"EmailAddress": "[email protected]",
"Company": "Acme",
"Tag1": "TENANT-A",
"Tag2": "",
"Tag3": "",
"Tag4": "",
"twofa": "none",
"CreateDate": "2026-08-27T14:58:46",
"ModifyDate": "2026-08-27T14:58:47",
"LoginDate": "2026-08-27T14:58:46",
"Pin": null,
"AuthType": "PIN",
"Description": "",
"isAdmin": false,
"isSuperAdmin": false,
"isBuilder": false,
"isAgent": false,
"isArchitect": true,
"SecurityGroups": [
{
"GroupId": "12",
"GroupName": "Tenant A",
"GroupRoles": [
{
"RoleId": "3",
"RoleName": "Modify"
}
],
"GroupStatus": 0
}
],
"ComboName": "Smith, Jane",
"FullName": "Jane Smith",
"UserApplications": [
{
"ApplicationID": "1001",
"ApplicationName": "Sample Data",
"ApplicationRoleID": "7",
"ApplicationRoleName": "Architect",
"ApplicationRoleType": "0",
"applicationUserDataSourceID": ""
}
],
"Preferences": [],
"UserState": 0,
"Language": {
"id": 1,
"nativename": null,
"englishname": null,
"iso_name": null,
"phraselist": []
},
"timezone": -5,
"timezonename": "America/New_York",
"isFastCache": 0,
"FastCacheLimit": 0,
"lockdate": "0001-01-01T00:00:00",
"bforcepasschange": false
}
],
"AllUsers": [],
"AllRoles": [],
"GroupStatus": 0
}
Groups & Roles
New group template
POST
/api/Group/NewSecurityGroup
Return an empty security group object ready to fill in and pass to Save a security group.
Common use: Start here when creating a group so every collection is initialised.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": null,
"GroupId": null,
"GroupName": null,
"GroupDescription": null,
"GroupCreated": "2026-08-27T14:58:48.6587525+00:00",
"GroupModified": "2026-08-27T14:58:48.658753+00:00",
"GroupRoles": [],
"Membership": [],
"AllUsers": [],
"AllRoles": [],
"GroupStatus": 0
}
Groups & Roles
Create or update a group
POST
/api/Group/SaveSecurityGroup
Create a security group or update an existing one. group.GroupId decides which: null creates and the server returns the new ID; an existing ID updates.
Common use: In a multi-tenant deployment you create one group per tenant, then scope that tenant's library folder to it. Keep tenants in separate groups so scheduling and sharing pickers only ever show a user their own colleagues.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| groupobject | Required | The group object. Start from New group template. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"GroupId": "12",
"GroupName": "Tenant A",
"GroupDescription": "All users for Tenant A",
"GroupCreated": "0001-01-01T00:00:00",
"GroupModified": "0001-01-01T00:00:00",
"GroupRoles": [],
"Membership": [],
"AllUsers": [],
"AllRoles": [],
"GroupStatus": 0
}
Groups & Roles
Delete a security group
POST
/api/Group/DeleteSecurityGroup
Remove a security group. The request takes the whole group object under group, so fetch it first with List security groups. The deleted record is echoed back with ErrorCode 0.
Common use: Tenant offboarding. Remove the tenant's users first, then the folder, then the group.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| groupobject | Required | The complete group object to delete. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"GroupId": "12",
"GroupName": "Tenant A",
"GroupDescription": "All users for Tenant A",
"GroupCreated": "2026-08-27T14:58:49",
"GroupModified": "2026-08-27T14:58:49",
"GroupRoles": [],
"Membership": [],
"AllUsers": [],
"AllRoles": [],
"GroupStatus": 0
}
Groups & Roles
Add user to group
POST
/api/Group/AddUser
Add a user to a security group with a role. The role controls what the user may do with content in folders scoped to that group. Returns the plain-text string User Added Successfully. Supply valid IDs: an unrecognised ContactId returns an error message rather than a status.
Common use: The second half of user provisioning. Role IDs come from List roles: 2 View, 3 Modify, 4 Delete are the usual library roles.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| GroupIdstring | Required | The group to add the user to. |
| ContactIdstring | Required | The user's ID. |
| RoleIdstring | Required | The role to grant within the group. |
Edit any value, then Send
Invalid JSON
Response
Example response
"User Added Successfully."
Groups & Roles
Remove user from group
POST
/api/Group/RemoveUser
Remove a user from a security group. Returns the plain string "User Removed Successfully.".
Common use: Use it when a person moves between tenants or leaves a team, without deleting their account.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| GroupIdstring | Required | The group to remove the user from. |
| ContactIdstring | Required | The user's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
"User Removed Successfully."
Groups & Roles
List roles
POST
/api/Contact/GetRolesList
Return the fixed role list used by group membership and app assignment. Note these entries use ERROR_CODE and ERROR_MESSAGE rather than the usual casing.
Common use: Roles 1–4 govern what a user can do with library content inside a group. Roles 5–7 are licence-consuming application roles assigned through
UserApplications on Save user.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ERROR_CODE": 0,
"ERROR_MESSAGE": "",
"RoleId": "0",
"RoleName": "None",
"RoleDescription": "No access to resources within this group"
},
{
"ERROR_CODE": 0,
"ERROR_MESSAGE": "",
"RoleId": "1",
"RoleName": "Admin",
"RoleDescription": "Full access to resources assigned to this group"
},
{
"ERROR_CODE": 0,
"ERROR_MESSAGE": "",
"RoleId": "2",
"RoleName": "View",
"RoleDescription": "Read-Only access to resources within this group"
},
{
"ERROR_CODE": 0,
"ERROR_MESSAGE": "",
"RoleId": "3",
"RoleName": "Modify",
"RoleDescription": "Edit permissions granted on resources assigned to this group"
},
{
"ERROR_CODE": 0,
"ERROR_MESSAGE": "",
"RoleId": "4",
"RoleName": "Delete",
"RoleDescription": "Delete permissions granted on resources assigned to this group"
},
{
"ERROR_CODE": 0,
"ERROR_MESSAGE": "",
"RoleId": "5",
"RoleName": "Builder",
"RoleDescription": "Consumes Builder License Type"
},
{
"ERROR_CODE": 0,
"ERROR_MESSAGE": "",
"RoleId": "6",
"RoleName": "Agent",
"RoleDescription": "Consumes Agent License Type"
},
{
"ERROR_CODE": 0,
"ERROR_MESSAGE": "",
"RoleId": "7",
"RoleName": "Architect",
"RoleDescription": "Consumes Architect License Type"
}
]
Data Security
New data tag template
POST
/api/DataTag/NewDataTag
Return an empty data tag object ready to fill in and pass to Save a data tag.
Common use: A data tag holds a value that differs per group or per user — a tenant id, a region, a cost centre. An AppShield policy then references that tag in a constraint, so one report serves every tenant while returning only their rows.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ID": "",
"Label": "New Data Tag",
"SecurityGroups": [],
"Contacts": [],
"DataTypeEnum": 1,
"isGroup": false,
"isUser": true,
"isActive": true,
"DefaultValue": "",
"TagGroup": "",
"Index": 0,
"ErrorCode": 0,
"ErrorMessage": "",
"ModifiedDate": "0001-01-01T00:00:00",
"CreatedDate": "0001-01-01T00:00:00"
}
Data Security
Create or update a data tag
POST
/api/DataTag/SaveDataTag
Create a data tag or update an existing one. An empty ID creates and the server returns the new one. Per-group values go in SecurityGroups: set RelationshipType and RelationType to tag_grp, RightID to the group's ID, and the value itself in Option1. Per-user values use the Contacts collection the same way. DefaultValue applies to anyone with no specific value assigned.
Common use: Create one tag per security dimension, then add a value for each tenant group as you onboard them. Set
isGroup true and isUser false for group-scoped tagging.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| datatagobject | Required | The data tag object. Start from New data tag template. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ID": "639234411252055064",
"Label": "tenantid",
"SecurityGroups": [
{
"ErrorCode": 0,
"ErrorMessage": "",
"LeftID": "639234411252055064",
"RightID": "12",
"RelationshipType": "tag_grp",
"RelationType": "tag_grp",
"Option1": "TENANT-A",
"Option2": "",
"Option3": "",
"Option4": "",
"Option5": "",
"Option6": "",
"Option7": "",
"Option8": "",
"Option9": "",
"Option10": "",
"PermissionTypeEnum": 20
}
],
"Contacts": [],
"DataTypeEnum": 1,
"isGroup": true,
"isUser": false,
"isActive": true,
"DefaultValue": "NONE",
"TagGroup": "Tenancy",
"Index": 0,
"ErrorCode": 0,
"ErrorMessage": "",
"ModifiedDate": "2026-08-27T15:25:25",
"CreatedDate": "2026-08-27T15:25:25"
}
Data Security
List data tags
POST
/api/DataTag/GetAllDataTags
Return every data tag with its group and user value assignments.
Common use: Use it to confirm a tenant's value was written, and to fetch the object required by Delete a data tag.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ID": "639234411252055064",
"Label": "tenantid",
"SecurityGroups": [
{
"ErrorCode": 0,
"ErrorMessage": "",
"LeftID": "639234411252055064",
"RightID": "12",
"RelationshipType": "tag_grp",
"RelationType": "tag_grp",
"Option1": "TENANT-A",
"Option2": "",
"Option3": "",
"Option4": "",
"Option5": "",
"Option6": "",
"Option7": "",
"Option8": "",
"Option9": "",
"Option10": "",
"PermissionTypeEnum": 20
}
],
"Contacts": [],
"DataTypeEnum": 1,
"isGroup": true,
"isUser": false,
"isActive": true,
"DefaultValue": "NONE",
"TagGroup": "Tenancy",
"Index": 0,
"ErrorCode": 0,
"ErrorMessage": "",
"ModifiedDate": "2026-08-27T15:25:25",
"CreatedDate": "2026-08-27T15:25:25"
}
]
Data Security
Delete a data tag
POST
/api/DataTag/DeleteDataTag
Remove a data tag. Takes the whole tag object under datatag, so fetch it first with List data tags. Returns a {Code, Message} result.
Common use: Remove a security dimension you no longer use. Check that no active policy still references the tag before deleting it.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| datatagobject | Required | The complete data tag object to delete. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"Code": 0,
"Message": "Data Tag Successfully Deleted"
}
Data Security
New policy template
POST
/api/AppShield/NewPolicy
Return an empty AppShield policy with a generated name and date, ready to fill in and pass to Save a policy.
Common use: Always start a policy here. Save a policy expects the collections this template initialises.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": null,
"ErrorMessage": null,
"id": null,
"Name": "New AppShield Policy",
"Description": "AppShield Policy Created 08/27/2026 14:58:50",
"CreatedDate": "2026-08-27T14:58:50.949385+00:00",
"ModifiedDate": "08/27/2026 14:58:50",
"CreatedBy": null,
"ModifiedBy": null,
"Constraints": [],
"Groups": null,
"Users": null,
"isActive": false
}
Data Security
List policies
POST
/api/AppShield/GetAllAppshieldPolicies
Return every AppShield policy on the instance with its constraints, assigned groups and assigned users.
Common use: Use it to audit which policies are active and which groups they cover, and to fetch the object Delete a policy requires.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ErrorCode": "0",
"ErrorMessage": "",
"id": "639234411233338341",
"Name": "Tenant row-level security",
"Description": "Constrains every report to the caller's tenant id",
"CreatedDate": "2026-08-27T15:25:23.3338367+00:00",
"ModifiedDate": "08/27/2026 15:25:23",
"CreatedBy": {
"ID": "639234363032231617",
"LoginName": "apitest",
"FullName": "API Test"
},
"Constraints": [],
"Groups": [
{
"GroupId": "12"
}
],
"Users": [],
"isActive": false
}
]
Data Security
Create or update a policy
POST
/api/AppShield/SaveAppShieldPolicy
Create or update an AppShield policy and assign it to groups and users in the same call. Build the policy from New policy template; Constraints, Groups and Users must be arrays rather than null. The groups and users parameters are arrays of IDs and are what the assignment is built from. The response echoes the saved policy and is large, because it embeds the full user records of everyone the policy touches. When updating a policy, build the request from the compact object returned by List policies rather than resending a previous save response, which can exceed the request size limit.
Common use: Assign the policy to All Users so every account is constrained, then let the data tag decide what each tenant sees. Set
isActive true when you are ready to enforce it.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| policyobject | Required | The policy object, built from the template. |
| isDeepSaveboolean | Required | Save the policy together with its constraints. |
| groupsarray | Required | Group IDs the policy applies to. Send an empty array for none. |
| usersarray | Required | User IDs the policy applies to. Send an empty array for none. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": "0",
"ErrorMessage": "",
"id": "639234411233338341",
"Name": "Tenant row-level security",
"Description": "Constrains every report to the caller's tenant id",
"CreatedDate": "2026-08-27T15:25:23.3338367+00:00",
"ModifiedDate": "08/27/2026 15:25:23",
"CreatedBy": {
"ID": "639234363032231617",
"LoginName": "apitest",
"FullName": "API Test"
},
"Constraints": [],
"Groups": [
{
"GroupId": "12"
}
],
"Users": [],
"isActive": false
}
Data Security
Delete a policy
POST
/api/AppShield/DeletePolicy
Remove an AppShield policy. Takes the whole policy object under policy, so fetch it first with List policies. Returns a plain status string.
Common use: Tenant offboarding, or replacing a policy with a revised constraint set.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| policyobject | Required | The complete policy object to delete. |
Edit any value, then Send
Invalid JSON
Response
Example response
"App Shield Policy Deleted"
Data Security
Add group to policy
POST
/api/AppShield/AddGroup
Attach a security group to an existing policy. Returns the plain-text string Success. An unknown policy id returns Policy not found. Other inputs, including an unknown group id, also return Success, so confirm the assignment by reading the policy back with List policies.
Common use: Use it to bring a newly created tenant group under an existing policy without rewriting the policy object.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| policyidstring | Required | The policy's ID. |
| groupidstring | Required | The security group's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
"Success"
Data Security
Remove group from policy
POST
/api/AppShield/RemoveGroup
Detach a security group from a policy. Returns the plain-text string Success. An unknown policy id returns Policy not found. Other inputs, including an unknown group id, also return Success, so confirm the assignment by reading the policy back with List policies.
Common use: Use it when a tenant no longer needs a policy's constraint, or while testing a policy against a single group.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| policyidstring | Required | The policy's ID. |
| groupidstring | Required | The security group's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
"Success"
Apps & Servers
List applications
POST
/api/App/GetApplicationList
Return every application on the instance with its licence position, the users assigned to it, and its registered database servers. Responses are large: each entry embeds a full module profile including user records.
Common use: Use it to discover application IDs, to check how many Agent, Builder and Architect seats a module has consumed, and to confirm an integration user has been granted the role it needs.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ReportModule": {
"ID": "1003",
"Name": "Test Load",
"ModuleType": "anydb1003",
"ProductCode": "ANYDB",
"isAnyDbApp": true
},
"ModuleProfile": {
"isLicensed": true,
"LicensedQuanity": 999,
"ConsumedQuanity": 1,
"NextExpiration": "12/31/2035",
"IsExpired": false,
"ArchitectConsumptionCount": 3,
"BuilderConsumptionCount": 1,
"AgentConsumptionCount": 1,
"Membership": []
},
"Status": 0,
"RegisteredServers": [
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "17769733521",
"ReportModule": {
"ID": "1003",
"Name": "Test Load",
"ModuleType": "anydb1003",
"ProductCode": "ANYDB",
"isAnyDbApp": true,
"isPremiumApp": false,
"isAPIApp": false
},
"ModuleType": "ANYDB",
"TimeZone": 0,
"DaylightSavings": false,
"DatabaseOwner": "",
"DatabaseServer": "db.internal.example.com",
"DatabaseLogin": "reporting",
"DatabaseName": "sales",
"DatabasePassword": "",
"DatabaseDriver": "POSTGRESQL",
"DatabasePlatform": "postgresql",
"CommandTimeout": 30,
"ConnectionTimeout": 10,
"Permissions": [],
"MappedAnyDB": "",
"DisplayName": "Test Load",
"allowstoredproc": 0,
"allowdirectsql": 0,
"datasources": [],
"additionalparams": ""
}
]
}
]
Apps & Servers
List registered servers
POST
/api/RegServers/GetAdminRegisteredServers
Return every registered database server with its connection settings. DatabasePassword is always returned empty.
Common use: Use it to find the
ID (the RegServerID) that App Builder calls require, and to audit which databases an instance connects to.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "17769733521",
"ReportModule": {
"ID": "1003",
"Name": "Test Load",
"ModuleType": "anydb1003",
"ProductCode": "ANYDB",
"isAnyDbApp": true,
"isPremiumApp": false,
"isAPIApp": false
},
"ModuleType": "ANYDB",
"TimeZone": 0,
"DaylightSavings": false,
"DatabaseOwner": "",
"DatabaseServer": "db.internal.example.com",
"DatabaseLogin": "reporting",
"DatabaseName": "sales",
"DatabasePassword": "",
"DatabaseDriver": "POSTGRESQL",
"DatabasePlatform": "postgresql",
"CommandTimeout": 30,
"ConnectionTimeout": 10,
"Permissions": [],
"MappedAnyDB": "",
"DisplayName": "Test Load",
"allowstoredproc": 0,
"allowdirectsql": 0,
"datasources": [],
"additionalparams": ""
}
]
Apps & Servers
List time zones
POST
/api/RegServers/GetTimeZones
Return the time zone list Yurbi uses for users and registered servers.
Common use: Populate a time zone picker when provisioning users, so the
timezone and timezonename you send to Save user are values Yurbi recognises.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"Name": "Eastern Time",
"Code": "GMT -0500",
"Offset": -5
},
{
"Name": "Central Time",
"Code": "GMT -0600",
"Offset": -6
}
]
Apps & Servers
Register an AnyDB app
POST
/api/RegServers/InsertAnyDbModule
Create a new AnyDB application shell. The returned module carries the ID used by every App Builder call.
Common use: The first step when provisioning a tenant that needs its own data source. After creating the app, grant your integration user the Architect role on it, or subsequent App Builder calls will not see it.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| appnamestring | Required | Name for the new application. |
| descriptionstring | Required | Description for the new application. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": null,
"ID": "1010",
"Name": "Tenant A Data",
"ModuleType": "anydb1010",
"ProductCode": "ANYDB",
"isAnyDbApp": true
}
Apps & Servers
Save a registered server
POST
/api/RegServers/SaveRegSrv
Create or update the database connection behind an application. Test the settings with Test connection before saving.
Common use: Point a newly registered AnyDB app at its database, or rotate credentials on an existing connection.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| regserverobject | Required | The registered server object. |
| bsaveasanydbboolean | Optional | Save as an AnyDB application. |
| badvrptboolean | Optional | Enable advanced report support. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "17769733521",
"ReportModule": {
"ID": "1003",
"Name": "Test Load",
"ModuleType": "anydb1003",
"ProductCode": "ANYDB",
"isAnyDbApp": true,
"isPremiumApp": false,
"isAPIApp": false
},
"ModuleType": "ANYDB",
"TimeZone": 0,
"DaylightSavings": false,
"DatabaseOwner": "",
"DatabaseServer": "db.internal.example.com",
"DatabaseLogin": "reporting",
"DatabaseName": "sales",
"DatabasePassword": "",
"DatabaseDriver": "POSTGRESQL",
"DatabasePlatform": "postgresql",
"CommandTimeout": 30,
"ConnectionTimeout": 10,
"Permissions": [],
"MappedAnyDB": "",
"DisplayName": "Test Load",
"allowstoredproc": 0,
"allowdirectsql": 0,
"datasources": [],
"additionalparams": ""
}
Apps & Servers
Test connection
POST
/api/RegServers/TestConnection
Test a database connection without saving it. Returns a plain string: "Passed" on success, otherwise a message describing the failure, for example "Test Failed - Name or service not known".
Common use: Validate credentials during provisioning before writing them with Save a registered server.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| regserverobject | Required | The connection settings to test. |
Edit any value, then Send
Invalid JSON
Response
Example response
"Passed"
App Builder
List AnyDB apps
POST
/api/AppBuilder/GetAnyDbModulesList
Return every AnyDB application with its registered server. ID is the RegServerID and ReportModule.ID is the ModuleID — App Builder calls need both.
Common use: The starting point for any App Builder work: resolve the app you are about to read or modify.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ErrorCode": 0,
"ErrorMessage": "",
"ID": "17769733521",
"ReportModule": {
"ID": "1003",
"Name": "Test Load",
"ModuleType": "anydb1003",
"ProductCode": "ANYDB",
"isAnyDbApp": true,
"isPremiumApp": false,
"isAPIApp": false
},
"ModuleType": "ANYDB",
"TimeZone": 0,
"DaylightSavings": false,
"DatabaseOwner": "",
"DatabaseServer": "db.internal.example.com",
"DatabaseLogin": "reporting",
"DatabaseName": "sales",
"DatabasePassword": "",
"DatabaseDriver": "POSTGRESQL",
"DatabasePlatform": "postgresql",
"CommandTimeout": 30,
"ConnectionTimeout": 10,
"Permissions": [],
"MappedAnyDB": "",
"DisplayName": "Test Load",
"allowstoredproc": 0,
"allowdirectsql": 0,
"datasources": [],
"additionalparams": ""
}
]
App Builder
Get an AnyDB app
POST
/api/AppBuilder/GetAnyDbModule
Return an application's report types, including their SQL tables, joins and field trees. Responses are large — an app with a few hundred tables runs to several megabytes.
Common use: Read this before writing with Save an AnyDB app: it gives you the next free
RepTypeID and a snapshot to roll back to.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| moduleidstring | Required | The application's module ID. |
| regserveridstring | Required | The registered server ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ReportTypes": [
{
"ErrorCode": 0,
"Moduleid": 1003,
"RepTypeID": 0,
"RepTypeName": "Sales_Orders",
"SQLTables": [
{
"tablename": "sales_orders",
"tableowner": "",
"tablealias": "Sales_Orders"
}
],
"FieldTree": [
{
"id": 0,
"fname": "Data",
"flevel": "0",
"nodetype": "G",
"idx_order": 1
},
{
"id": 2,
"fname": "order_id",
"flevel": "0:2",
"nodetype": "F",
"tablealias": "Sales_Orders",
"sqlfieldname": "order_id",
"datatype": "cha",
"idx_order": 3
}
]
}
],
"DBSQLTableList": {
"AllDbtables": []
},
"isExcelCSV": false
}
App Builder
Save an AnyDB app
POST
/api/AppBuilder/SaveAnyDbModule
Write report types to an application. Each report type in the payload is replaced in full; report types you leave out are untouched. Returns 1 on success and 0 otherwise, so confirm the result by reading the module back.
Common use: Send only the report types you are creating or changing rather than posting a whole module back. See Building apps & reports for the join and field tree rules.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| anydbmoduleobject | Required | The module payload containing the report types to write. |
Edit any value, then Send
Invalid JSON
Response
Example response
1
App Builder
Get a table definition
POST
/api/AppBuilder/GetTableDef
Return the columns of a database table as the driver reports them. datatype is the native database type, not a Yurbi field code.
Common use: Use it when building a report type to see what columns exist and whether they accept nulls, before mapping them into a field tree.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| tablenamestring | Required | The table to describe. |
| tableownerstring | Optional | Schema or owner. Send an empty string when the app registers tables without one. |
| regserveridstring | Required | The registered server ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"columnname": "order_id",
"datatype": "text",
"tablealias": null,
"MaxLength": 1,
"isNullValueAllowed": true
},
{
"columnname": "order_date",
"datatype": "timestamp without time zone",
"tablealias": null,
"MaxLength": 1,
"isNullValueAllowed": true
},
{
"columnname": "revenue",
"datatype": "real",
"tablealias": null,
"MaxLength": 24,
"isNullValueAllowed": true
}
]
App Builder
List field type codes
POST
/api/AppBuilder/GetDataTypes
Return the Yurbi field type codes and what each one does. These codes appear throughout report metadata as Fieldtype and yurbitype.
Common use: Use it when mapping database columns into a field tree, and when deciding how a value should be formatted or converted for display.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"name": "cha",
"description": "Character type field",
"id": 1
},
{
"name": "num",
"description": "Integer and other numeric field types",
"id": 2
},
{
"name": "dat",
"description": "SQL datetime field",
"id": 4
},
{
"name": "doz",
"description": "sql date only field with no timezone conversions.",
"id": 28
}
]
App Builder
List report types
POST
/api/RegServers/GetReportTypes
List the report types available in an app. A report type is the semantic layer a report is built on — it defines which tables are in play and how they join. Every report belongs to exactly one, and a report references its report type by name, so names must stay unique within an app.
Common use: Populate a report-type picker, or check whether a report type already exists before creating one.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| ModuleTypestring | Required | The module type, e.g. ANYDB. |
| RegServerIDstring | Required | The app's RegServerID. |
| ReportModuleIDstring | Required | The app's ModuleID. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"reporttypeid": 0,
"name": "Sales Pipeline Dataset",
"moduleid": 1001
},
{
"reporttypeid": 1,
"name": "Manufacturing Dataset",
"moduleid": 1001
}
]
App Builder
Get a report type's field tree
POST
/api/RegServers/GetReportTree
Return the browsable field tree for one report type: folders (type: "Folder") containing fields (type: "Field"). Each field node carries everything NewField needs — dbfieldname, dbtablealias, dbparenttablealias, fieldtype and Tag. Pass a node straight through to NewField to add it to a report.
Common use: Render a field picker, or drive report authoring from a script: read the tree, pick nodes, hand them to
NewField.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| RegServerIDstring | Required | The app's RegServerID. |
| ReportTypestring | Required | The report type's name. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"rootnode": {
"id": 0,
"text": "Sales Pipeline Dataset",
"type": "Folder",
"Tag": "RN",
"children": [
{
"id": 1,
"text": "Service Data",
"type": "Folder",
"Tag": "900000",
"children": [
{
"id": 2,
"text": "Ticket ID",
"type": "Field",
"Tag": "900001",
"dbfieldname": "Report_ID",
"dbtablealias": "Service Data",
"dbparenttablealias": "Service Data",
"fieldtype": "cha",
"ReportFieldName": "Ticket ID",
"children": []
}
]
}
]
}
}
Library
List a folder's contents
POST
/api/library/GetListByFolderID
Return the reports and dashboards in a folder. itemtype identifies the kind of item — 0 is a dashboard and other values are report output types. item_flags is a JSON string rather than an object.
Common use: Use it to browse a tenant's folder, and filter on
itemtype before passing IDs to report endpoints: dashboards are returned here too and are not valid report IDs.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| LibraryIDstring | Required | The folder ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"id": 1776974455,
"ReportName": "Count of Records",
"ReportType": "Sales_Orders",
"AppDisplayName": "Test Load",
"ModType": "anydb1003",
"folderid": 2,
"folderpath": "",
"Published": "",
"Description": "Count of Records",
"PluginId": 0,
"error_code": 0,
"error_message": null,
"CreatedDate": "2026-04-23T20:00:55Z",
"CreatedBy": "Ferguson, David",
"ModifiedBy": "Ferguson, David",
"LastModified": "2026-04-23T20:00:51Z",
"Permissions": [],
"Application": "Test Load",
"isUserAdmin": true,
"isUserView": true,
"isUserModify": true,
"isUserDelete": true,
"itemtype": 1,
"itemsubtype": "",
"isFav": false,
"index": 0,
"isUserArchitect": true,
"isUserBuilder": true,
"isUserAgent": true,
"isPublicView": false,
"isEmbedable": false,
"isPrivate": false,
"item_flags": "{\"isLagacyMode\":0,\"visualizationOnly\":0,\"DisplayFullRecords\":0}"
}
]
Library
Get the library tree
POST
/api/library/GetAllLibraryTree
Return the folder tree the calling user can see. Each entry wraps its tree under a rootnode key: the Public Library (libtype 1), the caller's personal library (libtype 2), and Favorites when includefav is true. isUserAdmin, isUserModify and isUserDelete describe what the caller may do in each folder.
Common use: Use it to find a writable folder before saving a report. Folders scoped to a security group appear only for members of that group, so the tree differs per user.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| includefavboolean | Optional | Include the Favorites tree. |
| includePersonalboolean | Optional | Include personal folders. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"rootnode": {
"id": 0,
"text": "Public Library",
"level": "###",
"libtype": 1,
"children": [
{
"id": 2,
"text": "Tenant A",
"children": [],
"level": "0",
"isUserAdmin": true,
"isUserModify": true,
"isUserDelete": true,
"isUserView": false,
"isPublicView": false,
"libtype": 1
}
]
}
},
{
"rootnode": {
"id": 0,
"text": "My Library",
"children": [],
"level": "###",
"libtype": 2
}
}
]
Library
New folder template
POST
/api/library/NewLibraryFolder
Return an empty folder object ready to fill in and pass to Save a folder. The folder's name is the fname field.
Common use: Start here when creating a tenant's folder so every field the save expects is present.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"error_code": 0,
"error_message": "",
"ParentLibrary": null,
"id": 0,
"folderpath": null,
"fname": "New Folder",
"flevel": null,
"fmodtype": null,
"isParent": false,
"isHidden": false,
"InheritPermissions": false,
"Permissions": [],
"isUserAdmin": false,
"isUserView": false,
"isUserModify": false,
"isPublicView": false,
"isUserDelete": false,
"isPersonalFolder": false,
"isRestricted": false
}
Library
Create or update a folder
POST
/api/library/SaveLibraryFolder
Create or update a library folder. Set the name in fname. Scope the folder to security groups through the Permissions array: one entry per group, with RelationshipType and RelationType set to fld_grp, RightID set to the group ID, and PermissionTypeEnum 2. A folder with no group permissions is visible to All Users.
Common use: Give each tenant a folder scoped to that tenant's group and nothing else. Members can then save and share content inside it, while the folder stays invisible to every other tenant.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| libraryfolderobject | Required | The folder object. Start from New folder template. |
| isSharedboolean | Optional | True for a shared folder in the Public Library. |
| currentUserIdstring | Optional | Owner for a personal folder. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"error_code": 0,
"error_message": "",
"ParentLibrary": null,
"id": 4,
"folderpath": "",
"fname": "Tenant A",
"flevel": ":4",
"fmodtype": "AHD",
"isParent": false,
"isHidden": false,
"InheritPermissions": false,
"Permissions": [
{
"ErrorCode": 0,
"ErrorMessage": "",
"LeftID": "4",
"RightID": "12",
"RelationshipType": "fld_grp",
"RelationType": "fld_grp",
"PermissionTypeEnum": 2
}
],
"Application": null,
"isUserAdmin": true,
"isUserView": true,
"isUserModify": true,
"isPublicView": false,
"isUserDelete": true,
"isPersonalFolder": false,
"isRestricted": false
}
Library
Get a folder
POST
/api/library/GetFolderById
Return a single folder with its permission assignments.
Common use: Confirm a folder is scoped to the group you expect after provisioning a tenant.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| folderidstring | Required | The folder ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"error_code": 0,
"error_message": "",
"ParentLibrary": null,
"id": 4,
"folderpath": "",
"fname": "Tenant A",
"flevel": ":4",
"fmodtype": "AHD",
"isParent": false,
"isHidden": false,
"InheritPermissions": false,
"Permissions": [
{
"ErrorCode": 0,
"ErrorMessage": "",
"LeftID": "4",
"RightID": "12",
"RelationshipType": "fld_grp",
"RelationType": "fld_grp",
"PermissionTypeEnum": 2
}
],
"Application": null,
"isUserAdmin": true,
"isUserView": true,
"isUserModify": true,
"isPublicView": false,
"isUserDelete": true,
"isPersonalFolder": false,
"isRestricted": false
}
Library
Delete a folder
POST
/api/library/DelFolder
Delete a library folder and its contents. Returns a {returncode, message} result reporting how many items were affected.
Common use: Tenant offboarding. Remove the folder before the group it is scoped to.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| folderidstring | Required | The folder ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"returncode": 0,
"message": "Delete Action Complete: 1 affected"
}
Library
Delete a report
POST
/api/library/DelReport
Delete a report by ID. Returns 0 on success and 9000 on failure — the opposite of the numeric conventions used elsewhere.
Common use: Roll back a report created by an automated build, or remove content during offboarding.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| ReportIdstring | Required | The report's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
0
Library
Search reports
POST
/api/library/SearchReports
Search library items by name. Returns an array of matches, or an empty array when nothing matches.
Common use: The quickest way to resolve a report name to an ID. Results respect the caller's permissions, so a tenant user only ever sees their own content.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| searchstringstring | Required | Text to match against item names. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"id": 1776974455,
"ReportName": "Count of Records",
"ReportType": "Sales_Orders",
"AppDisplayName": "Test Load",
"ModType": "anydb1003",
"folderid": 2,
"folderpath": "",
"Published": "",
"Description": "Count of Records",
"PluginId": 0,
"error_code": 0,
"error_message": null,
"CreatedDate": "2026-04-23T20:00:55Z",
"CreatedBy": "Ferguson, David",
"ModifiedBy": "Ferguson, David",
"LastModified": "2026-04-23T20:00:51Z",
"Permissions": [],
"Application": "Test Load",
"isUserAdmin": true,
"isUserView": true,
"isUserModify": true,
"isUserDelete": true,
"itemtype": 1,
"itemsubtype": null,
"isFav": false,
"index": 0,
"isUserArchitect": true,
"isUserBuilder": true,
"isUserAgent": true,
"isPublicView": false,
"isEmbedable": false,
"isPrivate": false,
"item_flags": null
}
]
Library
Search dashboards
POST
/api/Dashboard/SearchDashboardList
Search dashboards by name. Returns a compact list — note the field names differ from report search results.
Common use: Resolve a dashboard name to the ID used in embed URLs and favourite calls.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| searchstring | Optional | Text to match. Send an empty string to list all. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"id": 1,
"name": "Sales Overview",
"descr": "Tenant A sales",
"weight": 0,
"isFav": 1,
"isPersonal": 0
}
]
Library
Favourite a dashboard
POST
/api/library/FavDash
Add a dashboard to the calling user's favourites. Takes DashboardId; the favourite is recorded against the session's user. Returns a number rather than an envelope. Confirm the change through isFav in Search dashboards.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| DashboardIdstring | Required | The dashboard's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
0
Library
Un-favourite a dashboard
POST
/api/library/UnFavDash
Remove a dashboard from the calling user's favourites. Returns a number rather than an envelope. Confirm the change through isFav in Search dashboards.
Common use: The counterpart to Favourite a dashboard.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| DashboardIdstring | Required | The dashboard's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
1
Library
Favourite a report
POST
/api/library/FavReport
Add a report to the calling user's favourites. The favourite is recorded against the session's user, so no contact ID is needed. Returns a number rather than an envelope. Treat any 2xx response as accepted and confirm the change through isFav in Search reports.
Common use: Back a star control in your own interface. Confirm the change through
isFav in Search reports.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| ReportIdstring | Required | The report's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
1
Library
Un-favourite a report
POST
/api/library/UnFavReport
Remove a report from the calling user's favourites. Returns a number rather than an envelope. Treat any 2xx response as accepted and confirm the change through isFav in Search reports.
Common use: The counterpart to Favourite a report.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| ReportIdstring | Required | The report's ID. |
Edit any value, then Send
Invalid JSON
Response
Example response
1
Reports
New report template
POST
/api/Report/NewReport
Return an empty report object with every collection initialised, ready to fill in and pass to Save a report.
Common use: Always start here. Save a report expects collections such as
linkreports to be present, and this template supplies them.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ReportID": null,
"Reportname": "New Report",
"ModType": null,
"ReportType": null,
"ServerName": null,
"Description": "",
"FieldList": [],
"Permissions": [],
"AdHocFields": [],
"linkreports": [],
"FormLayout": [],
"OutputType": 1,
"OutputTypeClass": null,
"Distinct": 0,
"TopN": null,
"folderid": 0
}
Reports
New report field
POST
/api/Report/NewField
Turn a node from Get the report tree into a report field, filling in derived values such as RenamedField, the alias used in the generated SQL.
Common use: Use this rather than hand-building field objects: the naming and aliasing rules are applied for you. Set
fieldindex yourself, starting at 1, and give Criteria an empty array before saving.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| fieldobject | Required | A Field node from the report tree. |
| bAdvRptboolean | Optional | True when building an advanced report. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"fieldindex": 0,
"DbParentTableAlias": "Sales_Orders",
"DbTableAlias": "Sales_Orders",
"DbFieldName": "order_id",
"DisplayFieldName": "Order",
"ReportFieldName": "Order",
"RenamedField": "Order",
"Fieldtype": "cha",
"SearchCriteria": "",
"strGroup": null,
"Formula": "",
"tbl5": "Y",
"grouped": 0,
"Criteria": null,
"ERROR_CODE": 0,
"ERROR_MESSAGE": ""
}
Reports
New criteria template
POST
/api/Report/NewCriteria
Return an empty criteria object for a report field.
Common use: Start here when adding a filter by hand, then set
Field to the field's display name, choose an Op, and set bprompt true if the value should be prompted at run time.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| fieldobject | Optional | The field the criteria belongs to. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"Index": 0,
"Field": null,
"Op": null,
"Value1": null,
"Value2": null,
"Logical": null,
"Nested": false,
"cond": null,
"bskip": false,
"bprompt": false,
"sortorder": null,
"vrpt": null,
"vrpt_displaycol": null,
"vrpt_valuecol": null,
"vdefaulttop": 0,
"bgetvalues": false,
"flags": null
}
Reports
New totals template
POST
/api/Report/NewTotals
Return an empty totals object for a report field.
Common use: Use it when adding totals or subtotals to a report field before saving.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| typestring | Optional | Totals type to pre-set on the returned object. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"type": null,
"func": null,
"field1": null,
"field2": null,
"Value2": null,
"percent": null,
"addgtotal": false
}
Reports
Create or update a report
POST
/api/Report/SaveReport
Create a report or update an existing one. report.ReportID decides which: an empty string creates and the server returns the new ID; an existing ID updates. Build the object from New report template so its collections are populated, and set folderid to a folder the user can modify.
Common use: The end of the report build sequence: template, fields, then save. Preview the SQL first with Get SQL to check the statement before writing anything.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| reportobject | Required | The report object, built from the template. |
| processlinksboolean | Optional | Process linked reports on save. Defaults to true. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ReportID": "1787843241",
"Reportname": "Orders by Customer",
"ModuleName": "Test Load",
"ModType": "anydb1003",
"ReportType": "Sales_Orders",
"folderid": 2,
"OutputType": 1,
"FieldList": [
{
"fieldindex": 1,
"DbParentTableAlias": "Sales_Orders",
"DbTableAlias": "Sales_Orders",
"DbFieldName": "order_id",
"DisplayFieldName": "Order",
"ReportFieldName": "Order",
"RenamedField": "Order",
"Fieldtype": "cha",
"SearchCriteria": "",
"strGroup": null,
"Formula": "",
"tbl5": "Y",
"grouped": 0,
"Criteria": []
}
]
}
Reports
Update a report
POST
/api/Report/UpdateReport
Update an existing report from a report object carrying its ReportID. The response echoes the fields supplied in the request, so send the complete object — most usefully the Report node from Get report metadata — rather than a partial one.
Common use: Use it when you already hold a report object — from Get report metadata, for example — and want to change it without going through the create-or-update branch of Save.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| reportobject | Required | The report object to update, including its ReportID. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ReportID": "1787843241",
"Reportname": "Orders by Customer",
"Description": "Updated via the API"
}
Reports
Get a report definition
POST
/api/Report/GetReport
Return a report's stored definition — fields, criteria, output settings, permissions and audit information. Connection fields such as DbLogin and DbPass are returned empty, and CreatedBy and LastModifiedBy are null on reports created before audit information was recorded.
Common use: Use it to inspect or clone a report definition. To run a report, use Get report metadata instead, which returns the object Run a report requires.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| ReportIdstring | Required | The report's ID. |
| isbuilderboolean | Optional | True when loading the report for editing. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"ReportID": "1787843241",
"Reportname": "Orders by Customer",
"ModuleName": "Test Load",
"ModType": "anydb1003",
"ReportType": "Sales_Orders",
"ServerName": "db.internal.example.com",
"DbLogin": "",
"DbPass": "",
"DbName": "",
"DbDriver": "",
"folderid": 2,
"OutputType": 1,
"OutputTypeClass": "datagrid",
"FieldList": [
{
"fieldindex": 1,
"DbParentTableAlias": "Sales_Orders",
"DbTableAlias": "Sales_Orders",
"DbFieldName": "order_id",
"DisplayFieldName": "Order",
"ReportFieldName": "Order",
"RenamedField": "Order",
"Fieldtype": "cha",
"SearchCriteria": "",
"strGroup": "/Sales_Orders/Order",
"Formula": "",
"tbl5": "Y",
"grouped": 0,
"Criteria": []
}
],
"Permissions": [],
"CreatedBy": {
"LoginName": "jsmith",
"FullName": "Jane Smith"
},
"LastModifiedBy": {
"LoginName": "jsmith",
"FullName": "Jane Smith"
},
"CreatedDate": "2026-04-23T20:00:55Z",
"LastModifiedDate": "2026-04-23T20:00:51Z"
}
Reports
Get generated SQL
POST
/api/Report/GetSQL
Return the SQL a report object would generate, as a plain string. Prompt placeholders appear unresolved until prompts have been applied.
Common use: Preview a report before saving or running it. Pair it with Compile criteria to see the statement with criteria compiled in.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| Reportobjobject | Required | A report object — the Report node of a metadata response, or one you have assembled. |
Edit any value, then Send
Invalid JSON
Response
Example response
"Select \"Sales_Orders\".\"order_id\" AS \"Order\" From \"sales_orders\" \"Sales_Orders\" Where 1=1 And ((\"Sales_Orders\".\"customer_id\" = 1115))"
Reports
Compile criteria
POST
/api/Report/ReportProcUI
Compile a report's structured criteria into the SQL fragments the engine uses, and return the report object with those fragments filled in.
Common use: Run this before Get generated SQL when you have built criteria by hand, so the preview includes the WHERE clause.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| db_platformstring | Required | Target platform, for example postgresql, oracle or mssql. |
| reportobject | Required | The report object whose criteria should be compiled. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"FieldList": [
{
"fieldindex": 1,
"DisplayFieldName": "Order",
"SearchCriteria": "? In ('D','O')",
"tbl10": "? In ('D','O')",
"tbl11": "And"
}
]
}
Reports
List SQL functions
POST
/api/Report/GetSQLFunctions
Return the SQL functions available for formula fields on a database platform. expression is the template, where ? stands for the field the formula is attached to.
Common use: Populate a formula picker, and confirm which aggregate and conversion functions a platform supports before writing a formula into a field.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| db_platstring | Required | Database platform, for example postgresql, oracle or mssql. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"id": "4",
"name": "SUM",
"description": "Sum of numeric values in a group; NULLs ignored.",
"expression": "SUM(?)",
"type": "Aggregate",
"dbplat": "4",
"rdatatype": "num",
"systemdefault": false,
"error_message": null
},
{
"id": "36",
"name": "UPPER",
"description": "Convert character data to uppercase.",
"expression": "UPPER(?)",
"type": "String",
"dbplat": "4",
"rdatatype": "cha",
"systemdefault": false,
"error_message": null
}
]
Reports
Get report metadata
POST
/api/Report/GetReportMetadataById
Return the runtime metadata for a report: Report holds the definition and Prompts holds any prompts it defines. Prompts is null when the report has none. An unknown ID returns ErrorCode 586 with "Report does not exist." inside Report. Dashboards are not reports and return the same error.
Common use: The first call in the run sequence. Pass the whole response to Run a report, or set prompt values first when
Prompts is not empty.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| ReportIDstring | Required | The report's ID. |
| isTargetboolean | Optional | True when loading a drill-down target. |
| PreviousMetadataobject | Optional | Prior metadata to carry forward. Send null. |
| Criteriastring | Optional | Additional criteria to apply. Send null. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"Report": {
"ReportID": "1738259678",
"Reportname": "Tickets by Customer",
"ModuleName": "Ticket Data",
"ErrorCode": 0,
"ErrorMessage": "",
"ModType": "anydb1009",
"ReportType": "Service Data",
"folderid": 2,
"OutputType": 1,
"FieldList": [
{
"fieldindex": 1,
"DbParentTableAlias": "Sales_Orders",
"DbTableAlias": "Sales_Orders",
"DbFieldName": "order_id",
"DisplayFieldName": "Order",
"ReportFieldName": "Order",
"RenamedField": "Order",
"Fieldtype": "cha",
"SearchCriteria": "",
"strGroup": "/Sales_Orders/Order",
"Formula": "",
"tbl5": "Y",
"grouped": 0,
"Criteria": []
}
],
"Permissions": [],
"linkreports": [],
"AdHocFields": []
},
"Prompts": [
{
"HasError": false,
"ErrorCode": 0,
"ErrorMessage": null,
"PromptField": {
"fieldindex": 3,
"DbParentTableAlias": "Service Data",
"DbTableAlias": "Service Data",
"DbFieldName": "customer_id",
"DisplayFieldName": "Customer ID",
"ReportFieldName": "Customer ID",
"Fieldtype": "num",
"SearchCriteria": "? = Prompt for:Customer ID#:#num#:##:#",
"strGroup": "/Service Data/Customer ID",
"RenamedField": "Customer_ID",
"Criteria": [
{
"Index": 0,
"Field": "Customer ID",
"Op": "=",
"Value1": "1115",
"Value2": "",
"Logical": "And",
"cond": "is",
"bskip": false,
"bprompt": true,
"bgetvalues": true,
"sortorder": "None"
}
]
},
"isSkipable": false,
"isBetween": false,
"isInList": false,
"isLike": false,
"isGreaterThan": false,
"isLessThan": false,
"isSkipped": false,
"LowValue": null,
"HighValue": null
}
]
}
Reports
Get prompt values
POST
/api/Report/GetFieldValues
Return the selectable values for a prompt as {key, val} pairs. For a date prompt the list contains relative expressions such as [Today] and [Last Month], which are intended for interface pickers; send an explicit date when setting the value through the API.
Common use: Populate a dropdown in your own interface so users choose from real values. Pass the prompt object exactly as it came from Get report metadata.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| Reportobjobject | Required | The metadata object the prompt belongs to. |
| Promptobject | Required | The prompt to list values for. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"key": "1115",
"val": "1115"
},
{
"key": "1006",
"val": "1006"
},
{
"key": "1043",
"val": "1043"
}
]
Reports
Apply one prompt
POST
/api/Report/ReplacePrompt
Apply a value for a single prompt and return the updated metadata. Only the prompt you pass is compiled into the report's criteria, so for a report with several prompts call this once per prompt, passing the previous response back in as Reportobj each time. Set the value on LowValue, and HighValue as well when isBetween is true. The applied value appears in the returned Report, compiled into that field's criteria; the Prompts array is echoed back as it was supplied in Reportobj. Return the prompt object otherwise unchanged: it is matched to its field by table alias, field name, display name and field index.
Common use: Use it when your interface applies prompts one at a time. To apply them all at once, use Apply all prompts instead.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| Reportobjobject | Required | The metadata object, or the response from the previous call in the chain. |
| Promptobject | Required | One prompt with its value set. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"Report": {
"ReportID": "1738259678",
"Reportname": "Tickets by Customer",
"ModuleName": "Ticket Data",
"ErrorCode": 0,
"ErrorMessage": "",
"ModType": "anydb1009",
"ReportType": "Service Data",
"folderid": 2,
"OutputType": 1,
"FieldList": [
{
"fieldindex": 1,
"DbParentTableAlias": "Sales_Orders",
"DbTableAlias": "Sales_Orders",
"DbFieldName": "order_id",
"DisplayFieldName": "Order",
"ReportFieldName": "Order",
"RenamedField": "Order",
"Fieldtype": "cha",
"SearchCriteria": "",
"strGroup": "/Sales_Orders/Order",
"Formula": "",
"tbl5": "Y",
"grouped": 0,
"Criteria": []
}
],
"Permissions": [],
"linkreports": [],
"AdHocFields": []
},
"Prompts": [
{
"HasError": false,
"ErrorCode": 0,
"ErrorMessage": null,
"PromptField": {
"fieldindex": 3,
"DbParentTableAlias": "Service Data",
"DbTableAlias": "Service Data",
"DbFieldName": "customer_id",
"DisplayFieldName": "Customer ID",
"ReportFieldName": "Customer ID",
"Fieldtype": "num",
"SearchCriteria": "? = Prompt for:Customer ID#:#num#:##:#",
"strGroup": "/Service Data/Customer ID",
"RenamedField": "Customer_ID",
"Criteria": [
{
"Index": 0,
"Field": "Customer ID",
"Op": "=",
"Value1": "1115",
"Value2": "",
"Logical": "And",
"cond": "is",
"bskip": false,
"bprompt": true,
"bgetvalues": true,
"sortorder": "None"
}
]
},
"isSkipable": false,
"isBetween": false,
"isInList": false,
"isLike": false,
"isGreaterThan": false,
"isLessThan": false,
"isSkipped": false,
"LowValue": "1115",
"HighValue": ""
}
]
}
Reports
Apply all prompts
POST
/api/Report/ReplacePromptCollection
Apply values for every prompt on a report in one call and return the metadata with those values compiled into the report's criteria. Set each value on the prompt's LowValue, and HighValue as well when isBetween is true. Send the Prompts array in the same order and length as the metadata returned it: values are matched to prompts by position.
Common use: The recommended way to run a prompted report. Take the metadata, set
LowValue and HighValue on each prompt, call this once, then pass the result to Run a report.Requires a session token in the request body.
Body parameters
| Reportobjobject | Required | The metadata object from Get report metadata. |
| Promptsarray | Required | The prompts with values set, in the order metadata returned them. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"Report": {
"ReportID": "1738259678",
"Reportname": "Tickets by Customer",
"ModuleName": "Ticket Data",
"ErrorCode": 0,
"ErrorMessage": "",
"ModType": "anydb1009",
"ReportType": "Service Data",
"folderid": 2,
"OutputType": 1,
"FieldList": [
{
"fieldindex": 1,
"DbParentTableAlias": "Sales_Orders",
"DbTableAlias": "Sales_Orders",
"DbFieldName": "order_id",
"DisplayFieldName": "Order",
"ReportFieldName": "Order",
"RenamedField": "Order",
"Fieldtype": "cha",
"SearchCriteria": "",
"strGroup": "/Sales_Orders/Order",
"Formula": "",
"tbl5": "Y",
"grouped": 0,
"Criteria": []
}
],
"Permissions": [],
"linkreports": [],
"AdHocFields": []
},
"Prompts": [
{
"HasError": false,
"ErrorCode": 0,
"ErrorMessage": null,
"PromptField": {
"fieldindex": 3,
"DbParentTableAlias": "Service Data",
"DbTableAlias": "Service Data",
"DbFieldName": "customer_id",
"DisplayFieldName": "Customer ID",
"ReportFieldName": "Customer ID",
"Fieldtype": "num",
"SearchCriteria": "? = Prompt for:Customer ID#:#num#:##:#",
"strGroup": "/Service Data/Customer ID",
"RenamedField": "Customer_ID",
"Criteria": [
{
"Index": 0,
"Field": "Customer ID",
"Op": "=",
"Value1": "1115",
"Value2": "",
"Logical": "And",
"cond": "is",
"bskip": false,
"bprompt": true,
"bgetvalues": true,
"sortorder": "None"
}
]
},
"isSkipable": false,
"isBetween": false,
"isInList": false,
"isLike": false,
"isGreaterThan": false,
"isLessThan": false,
"isSkipped": false,
"LowValue": "1115",
"HighValue": ""
}
]
}
Reports
Run a report
POST
/api/Report/GetReportData
Execute a report and return its rows. Reportobj must be the complete metadata object from Get report metadata, with prompts applied when the report has any. Rows are in Data, one object per row keyed by column, and Columns describes each column. Check HasError rather than ErrorCode on this endpoint: a failed execution returns HasError: true with the message in ErrorMessage while ErrorCode stays 0. The response also carries interface bindings such as jqxColumns, and etime, the execution time in milliseconds.
Common use: The final step of the report workflow. Detail reports can return very large payloads — there is no paging, so use a report with a
TopN limit or an aggregate when you only need a summary. Set supressprompts true to run a prompted report without supplying values.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| Reportobjobject | Required | The prepared metadata object. |
| IsDrillDownboolean | Optional | Whether this is a drill-down run. Defaults to false. |
| DrillDownCriteriaobject | Optional | Criteria for a drill-down; null otherwise. |
| TargetReportobjobject | Optional | Target report for a drill-down; null otherwise. |
| supresspromptsboolean | Optional | Run without applying prompts, returning the unfiltered result. |
| cacheokboolean | Optional | Allow a cached result to be returned. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": "",
"HasError": false,
"ReportID": "1738259678",
"OutputType": 1,
"Columns": [
{
"headerText": "Customer",
"key": "Customer_ID",
"dataType": "number",
"width": 0,
"dataFormatString": null,
"yurbitype": "num",
"columngroup": ""
},
{
"headerText": "Tickets",
"key": "Ticket_ID",
"dataType": "number",
"width": 0,
"dataFormatString": null,
"yurbitype": "num",
"columngroup": ""
}
],
"Data": [
{
"Customer_ID": 1115,
"Ticket_ID": 10
}
],
"GroupMetadata": [],
"groups": [],
"IsFromCache": false,
"IsTopLevel": true,
"ContainsDrilldown": false,
"etime": "79",
"dbtime": null
}
Reports
List output types
POST
/api/Report/GetOutputTypes
Return the output types a report can use. id is the value carried by a report's OutputType and by itemtype in library listings; uiclass is the matching interface class.
Common use: Use it to label report types in your own interface, and to choose an
OutputType when creating a report.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"id": 1,
"name": "DataGrid",
"uiclass": "datagrid"
},
{
"id": 2,
"name": "Chart",
"uiclass": "chart"
},
{
"id": 3,
"name": "KPI Text",
"uiclass": "kpi_metric"
},
{
"id": 4,
"name": "KPI Gauge",
"uiclass": "kpi_gauge"
},
{
"id": 6,
"name": "Pie Chart",
"uiclass": "pie-chart"
},
{
"id": 7,
"name": "Combo Chart",
"uiclass": "combochart"
},
{
"id": 8,
"name": "Pivot Grid",
"uiclass": "pivotgrid"
},
{
"id": 9,
"name": "Tree Map",
"uiclass": "treemap"
},
{
"id": 10,
"name": "Vector Map",
"uiclass": "vectormap"
},
{
"id": 11,
"name": "Skyline",
"uiclass": "skyline"
},
{
"id": 12,
"name": "Aggregate Grid",
"uiclass": "datagrid2"
},
{
"id": 13,
"name": "Adv Pivot Grid",
"uiclass": "pivotgrid2"
},
{
"id": 14,
"name": "Chartv2",
"uiclass": "chart2"
}
]
Email (SMTP)
Get SMTP configuration
POST
/api/SMTP/GetSMTP
Return the instance's outgoing mail configuration. SMTPPassword is always returned empty. The settings are nested inside a realm; SMTPRealm.SMTPSetting is null on the master realm.
Common use: Confirm mail is configured before relying on scheduled delivery, and fetch the object required by Save SMTP configuration.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": null,
"SMTPId": "177341830687",
"SMTPHost": "smtp.example.com",
"SMTPPort": "587",
"SMTPFromAddress": "[email protected]",
"SMTPRequiredSecurity": "True",
"SMTPUserName": "[email protected]",
"SMTPPassword": "",
"SMTPCreated": "03/13/2026 16:11:46",
"SMTPModified": "03/13/2026 16:11:46",
"SMTPEnableSSL": "True",
"SMTPRealm": {
"ErrorCode": 0,
"ErrorMessage": "",
"RealmId": "1",
"RealmName": "MASTER",
"RealmDescription": "This is a default realm. Cannot be edited.",
"RealmCreated": "2009-06-29T00:00:00",
"RealmModified": "2009-06-29T00:00:00",
"ProviderList": [],
"SMTPSetting": null
}
}
Email (SMTP)
Save SMTP configuration
POST
/api/SMTP/SaveSMTP
Create or update the outgoing mail configuration. Read the current settings with Get SMTP configuration, change what you need, and send the whole object back. Supply SMTPPassword whenever SMTPRequiredSecurity is true, since it is never returned by a read.
Common use: Point a new instance at your mail relay as part of an automated deployment.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| smtpobject | Required | The SMTP configuration object. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": null,
"SMTPId": "177341830687",
"SMTPHost": "smtp.example.com",
"SMTPPort": "587",
"SMTPFromAddress": "[email protected]",
"SMTPRequiredSecurity": "True",
"SMTPUserName": "[email protected]",
"SMTPPassword": "",
"SMTPCreated": "03/13/2026 16:11:46",
"SMTPModified": "03/13/2026 16:11:46",
"SMTPEnableSSL": "True",
"SMTPRealm": {
"ErrorCode": 0,
"ErrorMessage": "",
"RealmId": "1",
"RealmName": "MASTER",
"RealmDescription": "This is a default realm. Cannot be edited.",
"RealmCreated": "2009-06-29T00:00:00",
"RealmModified": "2009-06-29T00:00:00",
"ProviderList": [],
"SMTPSetting": null
}
}
Email (SMTP)
Delete SMTP configuration
POST
/api/SMTP/DeleteSMTP
Remove the outgoing mail configuration. Takes the whole configuration object under smtp, so read it first with Get SMTP configuration.
Common use: Clear mail settings when decommissioning an instance. Scheduled delivery stops working once the configuration is removed.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| smtpobject | Required | The SMTP configuration object to remove. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"ErrorCode": 0,
"ErrorMessage": null,
"SMTPId": null,
"SMTPHost": null,
"SMTPPort": null,
"SMTPFromAddress": null,
"SMTPRequiredSecurity": null,
"SMTPUserName": null,
"SMTPPassword": null,
"SMTPRealm": null,
"SMTPEnableSSL": null
}
Instance Settings
Get instance settings
POST
/api/AppSettings/GetAppSettings
Return the instance's configuration: session timeout, record limits, tenant mode, single sign-on, two-factor settings and scheduler concurrency. Boolean values are returned as the strings "True" and "False".
Common use: Read
SESSION_TIMEOUT to size your token cache, MaxRecords to understand result limits, and TENANT_MODE_ENABLED, SSOEnabled and SSOHeader to verify a deployment without opening the interface.Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"DebugLevel": 0,
"SESSION_TIMEOUT": 20,
"PROMPT_VALUES_LIMIT": 10000,
"SSOEnabled": "True",
"SSOHeader": "ssoheadertoken",
"IIS_PASSTHROUGH_ENABLED": "False",
"TENANT_MODE_ENABLED": "False",
"USERTZ_MODE_ENABLED": "False",
"GUEST_FASTCACHE": "False",
"FastCacheMin": 30,
"duo_clientid": "",
"duo_clientsecret": "",
"duo_apihost": "",
"duo_redirect": "",
"duo_enabled": "False",
"bulkemail_enabled": "False",
"sqlnolocks": "False",
"SchedulerMode": 8,
"MaxRecords": 500000,
"Productname": "Yurbi",
"enableallusersgrp": "False",
"enforcestrongpassword": "False"
}
Instance Settings
Save instance settings
POST
/api/AppSettings/SaveAppSettings
Update instance configuration. Read the current settings first, change what you need, and send the whole object back — omitted values are not preserved.
Common use: Apply a standard configuration when provisioning a new instance, for example enabling tenant mode and setting the session timeout.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| appsettingsobject | Required | The complete settings object. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"DebugLevel": 0,
"SESSION_TIMEOUT": 20,
"PROMPT_VALUES_LIMIT": 10000,
"SSOEnabled": "True",
"SSOHeader": "ssoheadertoken",
"IIS_PASSTHROUGH_ENABLED": "False",
"TENANT_MODE_ENABLED": "False",
"USERTZ_MODE_ENABLED": "False",
"GUEST_FASTCACHE": "False",
"FastCacheMin": 30,
"duo_clientid": "",
"duo_clientsecret": "",
"duo_apihost": "",
"duo_redirect": "",
"duo_enabled": "False",
"bulkemail_enabled": "False",
"sqlnolocks": "False",
"SchedulerMode": 8,
"MaxRecords": 500000,
"Productname": "Yurbi",
"enableallusersgrp": "False",
"enforcestrongpassword": "False"
}
Instance Settings
Get audit settings
POST
/api/Audit/GetAuditTypes
Return every auditable event with whether it is recorded and how long it is retained. recorded is -1 when the event is captured and 0 when it is not; retention is in days.
Common use: Confirm which events an instance captures before relying on the audit trail for compliance reporting.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ID": 1,
"type": 0,
"symbol": "Login Success",
"recorded": -1,
"retention": 365,
"options": ""
},
{
"ID": 2,
"type": 1,
"symbol": "Login Failure",
"recorded": -1,
"retention": 365,
"options": ""
},
{
"ID": 7,
"type": 6,
"symbol": "Report Execution",
"recorded": -1,
"retention": 365,
"options": ""
},
{
"ID": 16,
"type": 15,
"symbol": "Report Execution SQL",
"recorded": 0,
"retention": 365,
"options": ""
}
]
Instance Settings
Save audit settings
POST
/api/Audit/SaveAuditTypes
Update which events are audited and how long each is retained. Send the full list as returned by Get audit settings, with recorded and retention adjusted.
Common use: Apply a standard audit policy across instances, or enable SQL capture temporarily while diagnosing a report.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
| AuditTypeListarray | Required | The complete list of audit types with their settings. |
Edit any value, then Send
Invalid JSON
Response
Example response
[
{
"ID": 1,
"type": 0,
"symbol": "Login Success",
"recorded": -1,
"retention": 365,
"options": ""
},
{
"ID": 2,
"type": 1,
"symbol": "Login Failure",
"recorded": -1,
"retention": 365,
"options": ""
},
{
"ID": 7,
"type": 6,
"symbol": "Report Execution",
"recorded": -1,
"retention": 365,
"options": ""
},
{
"ID": 16,
"type": 15,
"symbol": "Report Execution SQL",
"recorded": 0,
"retention": 365,
"options": ""
}
]
Licensing
Refresh licences
POST
/api/LicenseManager/RefreshInstalledLicenses
Re-read installed licence keys from the licence service and update the instance's entitlements.
Common use: Call it after purchasing additional seats or renewing, so the instance picks up the change without a restart. Confirm the result with List applications, which reports licensed and consumed quantities per module.
Requires a session token in the request body.
Body parameters
| sessionTokenstring | Required | A valid session token. |
Edit any value, then Send
Invalid JSON
Response
Example response
{
"returncode": 0,
"message": ""
}
Licensing
Get installation ID
POST
/api/LicenseManager/GetInstallationID
Return the instance's installation identifier as a plain string, formatted as six groups of four digits. This endpoint does not require a session token — it is used during activation, before anyone can sign in.
Common use: Identify an instance during licence activation, and record it alongside your own deployment inventory.
Body parameters
Edit any value, then Send
Invalid JSON
Response
Example response
"4446-4836-3034-3631-4452-3666"