Getting started with the REST API
Informer's REST API is the same API its own interface uses, so anything you can do on screen you can do over HTTP, from any language. This page covers what every integration needs first: where to send requests, how to authenticate, and how to read what comes back.
Base URL
Every endpoint is relative to your Informer instance. The reference pages write paths as /api/..., so prefix them with your host:
https://your-instance.entrinsik.com/api/
Authentication
Every request after login must be authenticated. There are two ways to do it.
API tokens
For scripts, services, and anything that runs unattended, create an API token and send it as a bearer token:
curl https://your-instance.entrinsik.com/api/datasets \
-H "Authorization: Bearer YOUR_API_TOKEN"
Tokens are the safer choice: each one can be tracked, restricted to a host name or IP range, and revoked on its own, independent of any password. A token's type decides how far it reaches:
- API tokens (
api) are the general-purpose kind, created by a Super User, and either Read Only or Full Access. - Entity-scoped tokens (
dataset,report,query,visual,datasource,assistant) work only against that one entity. This is how a single Dataset can be handed to an external system without exposing the rest of the API. - App tokens (
app_viewfor external links,webhookfor inbound webhooks) are minted on behalf of Apps.
Create tokens on the API Tokens page under Administration (see API Tokens in the Help Center), or over the API:
{
"type": "api",
"notes": "CI integration",
"readOnly": false
}
{
"_links": {
"self": {
"href": "https://informer.example.com/api/tokens/00000000-0000-4000-8000-000000000001"
},
"inf:token-type": {
"href": "https://informer.example.com/api/token-types/api"
}
},
"permissions": {
"edit": true,
"delete": true
},
"id": "00000000-0000-4000-8000-000000000001",
"type": "api",
"readOnly": false,
"notes": "CI integration",
"restrict": null,
"host": null,
"cidr": null,
"data": null,
"requests": 0,
"blocked": 0,
"lastAccessedAt": null,
"expiresAt": null,
"createdAt": "2026-01-15T16:20:00.000Z",
"updatedAt": "2026-01-15T16:20:00.000Z",
"tenant": "acme",
"username": "admin",
"reportId": null,
"queryId": null,
"visualId": null,
"datasourceId": null,
"datasetId": null,
"appId": null,
"assistantId": null,
"oauthClientId": null,
"user": {
"permissions": {
"changeDomain": true,
"changeProfile": true,
"changePassword": false,
"manageMfa": true,
"delete": true,
"edit": true,
"reassign": true,
"superuser": true,
"enable": true,
"changeTheme": true,
"lock": true,
"setGlobalPermissions": true,
"manageLogin": false
},
"displayName": "acme Administrator",
"email": null
},
"assistant": null,
"oauthClient": null,
"typeName": "API",
"key": "eyJhbGciOiJIUzI1NiJ9.example-token-1.signature"
}
The API Tokens reference covers host and CIDR restrictions and how the key is derived.
Sessions
Interactive clients can log in the way the product does: post credentials to the login endpoint for the authentication domain (local unless your instance uses an SSO or directory domain), then send the returned sid cookie on later requests.
curl -X POST https://your-instance.entrinsik.com/api/login/local \
-H "Content-Type: application/json" \
-d '{"username": "your-username", "password": "your-password"}'
The captured response, and what changes when a domain has MFA enrolled (a login ticket comes back instead of a session), are on Login & Logout. MFA covers the rest of that flow, and SSO.
Reading responses
Responses are JSON in the HAL hypermedia format. Every resource carries _links, the places you can go next keyed by relation, with Informer's own relations prefixed inf:. The token response above is typical: _links.self names the token itself and _links["inf:token-type"] points at the driver behind it. When related resources are included in a response, they ride along under _embedded, keyed the same way.
Follow links rather than assembling URLs by hand. The href values already account for your instance's host, proxy, and path prefix, so a client that follows them keeps working when the deployment changes.
When the instance is unavailable
While an instance is being moved or maintained, its requests answer 503 Service Unavailable with a Retry-After header in seconds and data.code set to TENANT_PAUSED. Work that was already running finishes. Wait for the Retry-After interval, then send the request again. A 503 whose data.code is TENANT_HOLD_UNKNOWN means Informer could not confirm the instance's status; retry shortly.
A first request
A search is a good first call: one GET with a query parameter, answered by a paged collection. start, count, and total describe the page, and the matching Teams sit under _embedded["inf:team"], each with its own _links to follow.
{
"_links": {
"self": {
"href": "https://informer.example.com/api/teams?limit=10&start=0&q=order%2A&show=all"
}
},
"start": 0,
"count": 1,
"total": 1,
"aggs": {
"all": 13,
"mine": 0
},
"_embedded": {
"inf:team": [
{
"_links": {
"self": {
"href": "https://informer.example.com/api/teams/order-desk"
},
"inf:members": {
"href": "https://informer.example.com/api/teams/order-desk/members{?sort,limit,start,q}",
"templated": true
},
"inf:member": {
"href": "https://informer.example.com/api/teams/order-desk/members/{username}",
"templated": true
}
},
"permissions": {
"addComment": true,
"addMember": true,
"delete": true,
"removeMember": true,
"editMemberRole": true,
"write": true,
"reassign": true,
"assignOwnership": true
},
"id": "order-desk",
"name": "Order Desk",
"description": "Order fulfillment, returns, and customer support",
"domain": "local",
"data": null,
"icon": null,
"materialIcon": null,
"color": "teal",
"defaultRole": null,
"source": null,
"sourceId": null,
"lastViewedFeed": null,
"createdAt": "2026-01-15T16:20:00.000Z",
"updatedAt": "2026-01-15T16:20:00.000Z",
"_changes": null,
"tenant": "acme",
"_embedded": {
"inf:member": []
}
}
]
}
}
Where next
- API Reference: every endpoint, grouped by area. Each area opens with an overview of its concepts and permissions.
- Understanding API requests: the parts of a request (method, host, route, headers, parameters, payload) explained in the Help Center.
- Building on Informer: if you would rather run code inside Informer than call it from outside, Apps are the other big way in.