ISM API Overview

The ISM APIs allow any authenticated client application to access ISM functionality outside of the ISM web application.

• The APIs are built using GraphQL, an open-source query language for APIs, and are exposed through a single endpoint that ends with /graphql.

• ISM Core APIs - These APIs expose core ISM capabilities, including class library and catalog management.

• All API requests are sent to the same endpoint and are routed and processed based on the content of the request body.

Authentication

ISM APIs support the following existing CONNECT tokens.

Account access token: Account access token can be grabbed from CONNECT portal using below steps.

1. Go to Integrations, click Access Tokens.

   

2. Click Create access token.

   

3. Select Account access token and specify the relevant details

4. Click Create for an Account access token.

   

Service access token: Service access token can be fetched from CONNECT portal using the following steps:

5. Go to Integrations, click Access Tokens.

   

6. Click Create access token.

   

7. Select Service access token.

8. Click Create for a Service access token.

   

Service applications token: Service applications token can be fetched using the following steps:

9. Go to Integrations, click Service applications.

   

10. Click Create service application.

    

11. Select Service role and specify the relevant details.

12. Click Create.

    

    The application displays the Client ID and Client Secret.

    

13. Specify the required details in the body and headers.

14. Send the request to get the service application token.

    

    

User access token: This token can be fetched from the browser's network tab

Any one of these tokens can be used to access the ISM APIs endpoint.

Authorization

API access is governed by the assigned user role and follows the existing ISM access control rules.

Supported Roles

• Reader

• Author

• Creator

• Administrator

API Operations

• Query – Read-only requests

Response Status Codes

• 200 OK – The request was processed successfully.

• 401 Unauthorized – The request lacks valid authentication credentials. The client must authenticate to access the resource.

• 403 Forbidden – The client is authenticated but does not have sufficient permissions to access the requested resource.

• 500 Internal Server Error – The server encountered an unexpected condition that prevented it from fulfilling the request. This is a generic error returned when no more specific 5xx status code applies.