APIM
APIM management endpoints for publishing integrator.io APIs, exports, and imports to the APIM platform, retrieving console redirect URLs, and configuring APIM account settings.
Most routes require the apim:operations permission and an enabled APIM license. Setup, validate, HRID validate, and resume routes are production-environment only.
APIM schema
Returns a signed URL that opens the APIM console home page for the account.
Redirect URL.
Signed redirect URL for the APIM console.
Fully qualified URL to open in the APIM console.
https://subdomain.console.apim.integrator.io/#!/production/home/overviewUnauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
Failed to generate APIM console JWT token.
GET /v1/apim/redirect HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"url": "https://subdomain.apim.integrator.io/management/auth/external?token=eyJhbGciOiJSUzI1NiJ9..."
}Returns a signed URL that opens the APIM analytics dashboard for the account. Optionally scope the dashboard to a time range with from and to.
Start timestamp in milliseconds for the analytics window.
1763023108167End timestamp in milliseconds for the analytics window.
1763023408167Redirect URL.
Signed redirect URL for the APIM console.
Fully qualified URL to open in the APIM console.
https://subdomain.console.apim.integrator.io/#!/production/home/overviewUnauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
GET /v1/apim/redirect/analytics HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"url": "https://subdomain.console.apim.integrator.io/#!/production/analytics/dashboard?from=1763023108167&to=1763023408167"
}Returns a signed URL that opens a published resource in the APIM console.
APIM API identifier.
123e4567-e89b-12d3-a456-426614174000Integrator.io resource collection name.
exportsPossible values: Integrator.io resource identifier.
6756aceea7929d3f29126e6eRedirect URL.
Signed redirect URL for the APIM console.
Fully qualified URL to open in the APIM console.
https://subdomain.console.apim.integrator.io/#!/production/home/overviewResource is not published to APIM.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
GET /v1/apim/{apiId}/{modelPlural}/{_id}/view HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"url": "https://subdomain.console.apim.integrator.io/#!/production/apis/6a6201f6-9142-4137-a201-f69142f137f8"
}Returns APIs published in the APIM platform for the account. Results are paginated with page and perPage.
Page number for APIM API search results.
1Example: 1Number of APIs to return per page.
10Example: 10Paginated APIM API list.
Paginated list of APIs published in the APIM platform.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
GET /v1/apim/apis HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"apis": {
"data": [
{
"id": "6a6201f6-9142-4137-a201-f69142f137f8",
"name": "my-export",
"description": "Customer data export API",
"apiVersion": "1.0.0",
"definitionVersion": "V4",
"state": "STARTED",
"deploymentState": "DEPLOYED",
"visibility": "PUBLIC",
"lifecycleState": "PUBLISHED",
"createdAt": "2026-04-24T16:52:05.607Z",
"updatedAt": "2026-05-07T15:22:16.985Z"
}
],
"pagination": {
"page": 1,
"perPage": 10,
"pageCount": 1,
"pageItemsCount": 1,
"totalCount": 1
},
"links": {
"self": "https://subdomain.apim.integrator.io/apis/_search?page=1&perPage=10"
}
}
}Publishes an integrator.io resource to APIM as a new API.
Requires apim:operations permission and an enabled APIM license. Custom webhooks (non-integrator-extension) are rejected with 400. Upstream API management errors may be returned with the upstream HTTP status.
Integrator.io resource collection name.
exportsPossible values: Integrator.io resource identifier.
6756aceea7929d3f29126e6ePayload for publishing an integrator.io resource to APIM as a new API.
Context path for the new APIM API (without leading slash).
my-exportFlow name to associate with the published API.
my-flowHTTP method exposed by the published API endpoint. Defaults to POST.
POSTAPI definition version; omit for legacy v2 behavior.
v4Possible values: Published APIM API.
API object returned after publishing a resource to APIM.
APIM API identifier.
123e4567-e89b-12d3-a456-426614174000APIM environment identifier.
123e4567-e89b-12d3-a456-426614174001API display name in APIM.
my-exportAPI version string.
1.0.0API description in APIM.
Published context path.
/my-exportRuntime state of the API in APIM.
STARTEDAPI visibility in APIM.
PUBLICBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
POST /v1/apim/{modelPlural}/{_id}/manageAPI HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 89
{
"contextPath": "my-export",
"flowName": "my-flow",
"method": "POST",
"definitionVersion": "v4"
}{
"id": "123e4567-e89b-12d3-a456-426614174000",
"environmentId": "123e4567-e89b-12d3-a456-426614174001",
"name": "my-export",
"version": "1.0.0",
"context_path": "/my-export",
"state": "STARTED",
"visibility": "PUBLIC"
}Publishes an integrator.io resource to an existing APIM API.
Requires apim:operations permission and an enabled APIM license. Upstream API management errors may be returned with the upstream HTTP status.
Integrator.io resource collection name.
exportsPossible values: Integrator.io resource identifier.
6756aceea7929d3f29126e6ePayload for publishing an integrator.io resource to an existing APIM API.
APIM API identifier to publish the resource into.
123e4567-e89b-12d3-a456-426614174000Flow name to associate with the published API.
my-flowHTTP method exposed by the published API endpoint.
POSTUpdated APIM API.
API object returned after publishing a resource to APIM.
APIM API identifier.
123e4567-e89b-12d3-a456-426614174000APIM environment identifier.
123e4567-e89b-12d3-a456-426614174001API display name in APIM.
my-exportAPI version string.
1.0.0API description in APIM.
Published context path.
/my-exportRuntime state of the API in APIM.
STARTEDAPI visibility in APIM.
PUBLICBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
PUT /v1/apim/{modelPlural}/{_id}/manageAPI HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 85
{
"apiId": "123e4567-e89b-12d3-a456-426614174000",
"flowName": "my-flow",
"method": "POST"
}{
"id": "123e4567-e89b-12d3-a456-426614174000",
"environmentId": "123e4567-e89b-12d3-a456-426614174001",
"name": "my-export",
"version": "1.0.0",
"context_path": "/my-export",
"state": "STARTED",
"visibility": "PUBLIC"
}Publishes an OpenAPI specification to an existing APIM API.
When a signed URL is not required for the resource type, the server generates the OpenAPI document from the resource. The resource must already be published to the given apiId (400 if not).
Upstream API management errors may be returned with the upstream HTTP status.
APIM API identifier.
123e4567-e89b-12d3-a456-426614174000Integrator.io resource collection name.
exportsPossible values: Integrator.io resource identifier.
6756aceea7929d3f29126e6ePayload for publishing an OpenAPI specification to an APIM API.
Signed S3 URL containing the OpenAPI specification to publish.
https://s3.amazonaws.com/bucket/spec.yml?signature=...Published OpenAPI document.
APIM document record created after publishing an OpenAPI specification.
APIM document identifier.
123e4567-e89b-12d3-a456-426614174000Document name in APIM.
openapi-specDocument type in APIM.
SWAGGEROpenAPI specification content uploaded to APIM.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
POST /v1/apim/{apiId}/{modelPlural}/{_id}/openAPIspec HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 70
{
"signedUrl": "https://s3.amazonaws.com/bucket/spec.yml?signature=..."
}{
"id": "123e4567-e89b-12d3-a456-426614174000",
"name": "openapi-spec",
"type": "SWAGGER"
}Provisions APIM for the account with a subdomain and service account email. Processing is asynchronous and returns 202 Accepted with an empty body.
Production environment only. Requires apim:operations permission.
Initial APIM account setup payload.
Requested APIM subdomain for the account.
production-subdomainService account email for APIM management operations.
apim-service@example.comRequest accepted for asynchronous processing. Response has no body.
No content
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
Conflict — the submitted value is already in use.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
POST /v1/apim/setup HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 85
{
"subdomain": "production-subdomain",
"serviceAccountEmail": "apim-service@example.com"
}No content
Updates the service account email for an existing APIM account configuration.
Production environment only. Requires apim:operations permission.
Update payload for an existing APIM account configuration.
Updated service account email for APIM management operations.
apim-service@example.comUpdated service account email.
Response after updating APIM service account email.
Updated service account email for APIM management operations.
apim-service@example.comBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
PUT /v1/apim/setup HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 50
{
"serviceAccountEmail": "apim-service@example.com"
}{
"serviceAccountEmail": "apim-service@example.com"
}Checks whether a subdomain is available for APIM account setup.
Production environment only.
Subdomain to validate.
production-subdomainSubdomain is available.
Result of an APIM subdomain or environment HRID availability check.
When true, the submitted value is available for use.
Invalid subdomain format.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Subdomain is not available.
PUT /v1/apim/validate HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 36
{
"subdomain": "production-subdomain"
}{
"valid": true
}Checks whether an environment HRID is available for APIM configuration.
Production environment only.
Environment HRID to validate.
productionEnvironment HRID is available.
Result of an APIM subdomain or environment HRID availability check.
When true, the submitted value is available for use.
Invalid environment HRID format.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Environment HRID is not available.
PUT /v1/apim/hrid/validate HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 32
{
"environmentHRID": "production"
}{
"valid": true
}Returns the APIM subdomain and service account email configured for the account.
APIM settings.
APIM account configuration for the current user.
APIM subdomain assigned to the account.
production-subdomainService account email used for APIM management operations.
apim-service@example.comUnauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
GET /v1/apim/settings HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"subdomain": "production-subdomain",
"serviceAccountEmail": "apim-service@example.com"
}Resumes APIM for the account after it has been paused or suspended.
Production environment only. Requires manage:license permission (not apim:operations). Returns 204 even when APIM is not yet provisioned (no orgId on the user).
APIM resumed successfully, or APIM was not provisioned.
No content
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
PUT /v1/resumeAPIM HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
No content
Last updated
Was this helpful?