Flow Server API Reference
All 108 Flow Server HTTP endpoints with their routes and declared authorisation policies, read from the controller source.
Infohub's hosts expose 108 HTTP endpoints between them, of which 82 belong to Flow Server across 17 controller families. Everything the web client displays, it fetches from Flow Server, and integrators already build on it.
| Host | Endpoints | Audience |
|---|---|---|
Flow-Server |
82 | The web client, and external integrators |
Flow-Platform |
21 | Internal host-to-host traffic — not an integration surface |
Flow-Bootstrap |
5 | Internal host-to-host traffic — not an integration surface |
Only Flow Server's API is an integration surface. The Bootstrap and Platform endpoints exist so Infohub's own components can talk to each other — deploying instances, running realtime jobs. They are listed here for completeness and for diagnosis, not as an API to build against. They carry no authorisation attributes at all, and both hosts listen on every network interface by default, so treat them as strictly internal and firewall them accordingly.
This list is read from the controller source at v7.2.0. It is the authoritative route set for this release — but see Flow Server REST API for the rules about depending on it, because not every route here is a supported integration surface.
Treat this as an internal-network service. Flow Server is designed to sit inside your network behind your own perimeter. Confirm the authorisation each endpoint you rely on actually enforces before exposing the server more widely, and see HTTPS and Certificates.
How authorisation is declared#
Flow Server defines three named policies, with an authenticated-user policy as the server default:
| Policy | Meaning |
|---|---|
ServerKey |
Requires a server key — used for host-to-host calls rather than end users. |
Username |
Requires an authenticated user. This is also the server's default policy. |
UsernameOrServerKey |
Accepts either an authenticated user or a server key. |
anonymous |
Explicitly opts out of authorisation with [AllowAnonymous]. |
authorised |
Requires authorisation under the default policy. |
none declared |
Declares no policy attribute. Some of these authorise inside the method instead — see the note below. |
An action inherits its controller's policy unless it declares its own.
Within Flow Server, 19 actions declare no policy attribute. Most of those are the single-page client's own routes and the token endpoints, which have to be reachable before anyone is authenticated; the chart, form and export actions among them authorise in the method body instead, checking the caller against the object being requested. So an empty policy column is not by itself a statement about who may call an endpoint.
The Bootstrap and Platform rows are a different matter, and are covered by the warning above.
Data#
The values behind the web client — chart data, measure values, event scheme data, form data, time-period values. The integration-friendly read surface.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/v1/Data/charts/{chartId:int} |
anonymous |
GetChartData |
POST |
/api/v1/Data/eventPeriods/{eventPeriodId:long}/comments |
UsernameOrServerKey |
PostEventPeriodComment |
GET |
/api/v1/Data/eventPeriods/{eventPeriodId:long}/eventAttributeValues/history |
anonymous |
GetEventAttributeValueHistory |
POST |
/api/v1/Data/eventSchemes/{eventSchemeId:int}/eventPeriods |
Username |
AddEventPeriod |
PUT |
/api/v1/Data/eventSchemes/{eventSchemeId:int}/eventPeriods |
Username |
UpdateEventPeriods |
DELETE |
/api/v1/Data/eventSchemes/{eventSchemeId:int}/eventPeriods/{eventPeriodId:long} |
Username |
RemoveEventPeriod |
PUT |
/api/v1/Data/eventSchemes/{eventSchemeId:int}/eventPeriods/{eventPeriodId:long} |
Username |
EditEventPeriod |
POST |
/api/v1/Data/eventSchemes/{eventSchemeId:int}/eventPeriods/{eventPeriodId:long}/eventAttributes/{eventAttributeId:int}/eventAttributeValues |
Username |
AddEventPeriodAttributeValue |
PUT |
/api/v1/Data/eventSchemes/{eventSchemeId:int}/eventPeriods/{eventPeriodId:long}/measures/{measureId:int}/measureValues/{measureValueId:long} |
Username |
EditEventPeriodMeasureValue |
POST |
/api/v1/Data/eventSchemes/{eventSchemeId:int}/eventPeriods/{eventPeriodId:long}/split |
Username |
SplitEventPeriod |
GET |
/api/v1/Data/forms/{formId:int} |
UsernameOrServerKey |
GetFormData |
POST |
/api/v1/Data/measureEventPeriod/{measureValueId:long}/comments |
UsernameOrServerKey |
PostMeasureEventPeriodValueComment |
GET |
/api/v1/Data/measureEventPeriod/{measureValueId:long}/history |
anonymous |
GetMeasureEventPeriodValueHistory |
PUT |
/api/v1/Data/measures/{measureId:int}/timeSchemes/{timeSchemeId:int}/timePeriodValues |
Username |
UpdateMeasureValues |
GET |
/api/v1/Data/measures/{measureId:int}/timeSchemes/{timeSchemeId:int}/timePeriodValues/{measureValueVersion?} |
anonymous |
GetTimeSchemeMeasureValues |
PUT |
/api/v1/Data/measures/{measureId:int}/timeSchemes/{timeSchemeId:int}/timeSliceValues |
Username |
UpdateMeasureValues |
POST |
/api/v1/Data/measures/{measureId:int}/values |
UsernameOrServerKey |
PostMeasureValues |
GET |
/api/v1/Data/measures/{measureId:int}/values/{measureValueId:long} |
UsernameOrServerKey |
GetMeasureValue |
POST |
/api/v1/Data/measures/manuallyEntered/{measureId:int}/timeSchemes/{timeSchemeId:int}/timePeriodValues |
UsernameOrServerKey |
PostMeasureTimePeriodValue |
POST |
/api/v1/Data/measures/replicated/{measureId:int}/timeSchemes/{timeSchemeId:int}/timePeriodValues |
ServerKey |
PostReplicatedMeasureTimePeriodValue |
GET |
/api/v1/Data/timePeriodValues/{measureValueId:long} |
anonymous |
GetTimePeriodValue |
GET |
/api/v1/Data/timePeriodValues/{measureValueId:long}/comments |
anonymous |
GetTimePeriodValueComments |
POST |
/api/v1/Data/timePeriodValues/{measureValueId:long}/comments |
UsernameOrServerKey |
PostTimePeriodValueComment |
GET |
/api/v1/Data/timePeriodValues/{measureValueId:long}/history |
anonymous |
GetTimePeriodValueHistory |
POST |
/api/v1/Data/timePeriodValues/{measureValueId:long}/link |
anonymous |
GetTimePeriodValueLink |
GET |
/api/v1/Data/timeSchemes/{timeSchemeId:int}/timePeriodValues/{measureValueId:long}/details |
anonymous |
GetTimePeriodValueDetails |
Model#
The shape of the model: folders, metrics, measures, event schemes. Answers "what exists".
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/v1/Model/{filter1}/{filter2}/{filter3?} |
UsernameOrServerKey |
GetModel |
GET |
/api/v1/Model/eventschemes |
UsernameOrServerKey |
GetEventSchemes |
GET |
/api/v1/Model/eventschemes/{id:int?} |
UsernameOrServerKey |
GetEventSchemes |
GET |
/api/v1/Model/find/{retrieval}/{interval}/{searchstring} |
UsernameOrServerKey |
FindItems |
GET |
/api/v1/Model/folders |
UsernameOrServerKey |
GetFolders |
GET |
/api/v1/Model/folders/{id:int?}/{descendants?} |
UsernameOrServerKey |
GetFolders |
GET |
/api/v1/Model/folders/{id:int}/metrics |
UsernameOrServerKey |
GetFolders |
GET |
/api/v1/Model/folders/{metricFolderID:int}/eventschemes |
UsernameOrServerKey |
GetFoldersEventSchemes |
GET |
/api/v1/Model/folders/{metricFolderId:int}/eventschemes/{id:int?} |
UsernameOrServerKey |
GetFolderEventSchemes |
GET |
/api/v1/Model/folders/{metricFolderID:int}/folders |
UsernameOrServerKey |
GetFoldersFolders |
GET |
/api/v1/Model/folders/{metricFolderID:int}/metrics |
UsernameOrServerKey |
GetFoldersMetrics |
GET |
/api/v1/Model/folders/{metricFolderId:int}/metrics/{id:int?} |
UsernameOrServerKey |
GetFolderMetrics |
GET |
/api/v1/Model/folders/{retrieval}/{interval}/{parent}/{filter?} |
UsernameOrServerKey |
GetFolders |
GET |
/api/v1/Model/items/{retrieval}/{interval}/{parent} |
UsernameOrServerKey |
GetItems |
GET |
/api/v1/Model/measures |
UsernameOrServerKey |
GetMeasures |
GET |
/api/v1/Model/measures/{filter1}/{filter2?} |
UsernameOrServerKey |
GetMeasures |
GET |
/api/v1/Model/measures/{id:int?} |
UsernameOrServerKey |
GetMeasures |
GET |
/api/v1/Model/metrics |
UsernameOrServerKey |
GetMetricsMetrics |
GET |
/api/v1/Model/metrics/{id:int?} |
UsernameOrServerKey |
GetMetrics |
GET |
/api/v1/Model/metrics/{metricID:int}/measures |
UsernameOrServerKey |
GetMetricsMetrics |
RemotePlatforms#
Platform-to-platform communication in a multi-site deployment.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/RemotePlatforms |
— | GetRemotePlatforms |
GET |
/RemotePlatforms/{platformId:int}/consumers |
— | GetRemotePlatformConsumers |
GET |
/RemotePlatforms/{platformId:int}/consumers/{consumerId:int}/package |
— | GetRemotePlatformConsumerPackage |
GET |
/RemotePlatforms/{platformId:int}/dataSources |
— | GetRemotePlatformDataSources |
GET |
/RemotePlatforms/{platformId:int}/dataSources/{dataSourceId:int}/package |
— | GetRemotePlatformDataSourcePackage |
GET |
/RemotePlatforms/{platformId:int}/notificationServers |
— | GetRemotePlatformNotificationServers |
GET |
/RemotePlatforms/{platformId:int}/notificationServers/{notificationServerId:int}/package |
— | GetRemotePlatformNotificationServerPackage |
GET |
/RemotePlatforms/{platformId:int}/package |
— | GetRemotePlatformPackage |
GET |
/RemotePlatforms/{platformId:int}/realtimeDataSources |
— | GetRemoteRealtimePlatformDataSources |
GET |
/RemotePlatforms/{platformId:int}/realtimeDataSources/{dataSourceId:int}/package |
— | GetRemoteRealtimePlatformDataSourcePackage |
Jobs#
Background job submission and status.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs |
— | FindJob |
POST |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs |
— | CreateJob |
PUT |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs/{JobId} |
— | CompleteJob |
PUT |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs/{JobId}/streaming |
— | CompleteStreamingJob |
GET |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs/connectionProperties |
— | GetConnectionProperties |
GET |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs/lastTagConfigUpdate |
— | GetLastTagConfigUpdate |
GET |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs/startupConfig |
— | GetStartupConfig |
POST |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs/streaming |
— | CreateStreamingJob |
GET |
/realtimeDataSources/{RealtimeDataSourceId:int}/Jobs/tags |
— | GetTags |
Definition#
What a chart, dashboard, form, palette or theme is, as opposed to the data in it. For tooling that reasons about configuration.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/Definition/charts/{chartId:int} |
— | GetChart |
GET |
/api/Definition/dashboardloops/{dashboardLoopId:int} |
— | GetDashboardLoop |
GET |
/api/Definition/dashboards/{dashboardId:int} |
— | GetDashboard |
GET |
/api/Definition/forms/{formId:int} |
— | GetForm |
GET |
/api/Definition/palettes |
— | GetPalettes |
GET |
/api/Definition/themes |
— | GetThemes |
GET |
/api/Definition/themes/material |
— | CompileMaterialThemes |
TemplateStatus#
Template synchronisation state for federated template servers.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/ |
— | GetTemplates |
GET |
/export |
— | GetExport |
GET |
/forms |
— | GetForms |
GET |
/migration |
— | GetMigratedIDs |
GET |
/reports |
— | GetReports |
GET |
/status |
— | GetStatus |
Token#
Session and token issuing. Not an integration surface.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/Token |
— | GetUsername |
POST |
/api/Token |
anonymous |
CreateUserToken |
GET |
/api/Token/publicKey |
anonymous |
GetKey |
GET |
/api/Token/serverKey |
authorised |
CreateServerToken |
POST |
/api/Token/sign-out |
anonymous |
SignOut |
GET |
/api/Token/validate |
— | TestServerToken |
Config#
Administrative configuration. Not an integration surface.
| Method | Route | Declared policy | Action |
|---|---|---|---|
POST |
/api/v1/Config/measureLimits/{measureLimitId:int}/measureLimitInstances |
Username |
AddMeasureLimitInstance |
DELETE |
/api/v1/Config/measureLimits/{measureLimitId:int}/measureLimitInstances/{measureLimitInstanceId:int} |
Username |
DeleteMeasureLimitInstance |
PUT |
/api/v1/Config/measureLimits/{measureLimitId:int}/measureLimitInstances/{measureLimitInstanceId:int} |
Username |
EditMeasureLimitInstance |
PUT |
/api/v1/Config/measureLimitValues/{measureLimitValueId:int} |
Username |
UpdateMeasureLimitValue |
PUT |
/api/v1/Config/measures/replicated/{measureId:int}/measureLimits |
UsernameOrServerKey |
UpdateMeasureLimits |
User#
User and session management.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/User |
Username |
GetUserProperties |
PUT |
/api/User/favorites |
Username |
UpdateUserFavorites |
PUT |
/api/User/properties |
Username |
UpdateUserProperties |
PUT |
/api/User/subscriptions/{messageChannelId:int} |
Username |
UpdateUserSubscriptionsAsync |
Status#
Health and readiness.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/flow-software/flow/bootstrap/Status |
— | GetStatus |
GET |
/flow-software/flow/bootstrap/Status/CertHash |
— | GetCurrentCertificateHash |
GET |
/Status/measures |
— | GetAllMeasureStatuses |
GET |
/Status/measures/{status} |
— | GetFilteredMeasureStatuses |
DataSources#
Data source browse and preview surfaces.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/DataSources |
anonymous |
GetDataSources |
GET |
/api/DataSources/{dataSourceId:int}/rawValues |
anonymous |
GetDataSources |
Export#
Rendered chart output — Jpeg, Png, Pdf via headless render, and CSV where the chart type supports data export.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/Export/{exportType}/{id:int}/[action] |
— | Jpeg |
GET |
/api/Export/Charts/{id:int}/[action] |
— | SupportedTypes |
Template#
Chart template surfaces.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/v1/Template/charts |
UsernameOrServerKey |
GetCharts |
GET |
/api/v1/Template/charts/{chartId:int} |
UsernameOrServerKey |
GetChartsChart |
Proxy#
Request forwarding between Infohub hosts.
| Method | Route | Declared policy | Action |
|---|---|---|---|
POST |
/flow-software/flow/bootstrap/Proxy/{instanceId:guid}/platform |
— | PostPlatform |
POST |
/flow-software/flow/bootstrap/Proxy/{instanceId:guid}/server |
— | PostServer |
System#
Host and process plumbing. Not an integration surface.
| Method | Route | Declared policy | Action |
|---|---|---|---|
GET |
/api/System |
— | GetSystemInfo |
ConnectionStrings#
Connection string administration. Not an integration surface.
| Method | Route | Declared policy | Action |
|---|---|---|---|
POST |
/flow-software/flow/bootstrap/ConnectionStrings |
— | Post |
Diagnosing#
| Symptom | Likely cause |
|---|---|
401 on every call |
No bearer token, or the token was issued by a different instance |
403 on one endpoint only |
The action requires ServerKey rather than a user token |
404 on a route listed here |
The route exists in this release but the controller is hosted by a component you have not deployed |
| Route shape differs from the table | A class-level [Route] prefix is resolved here; confirm against the running server's own requests in browser dev-tools |
| Works in the browser, fails from a script | The client sends credentials and CORS headers the script does not — see the authorisation table above |