/objects

Read or replace the objects linked to the collection identified by collectionId. GET returns the linked objects; POST replaces the entire list, linking exactly the objects in the body and unlinking any that are absent. The collection _version is not changed.

GET /collection/objects/{collection_id} — Retrieve objects of a collection.

Retrieve objects of a collection.

get

• Requires an authenticated user with BAG_READ permission.
• The linked objects of the addressed collection are returned in position order, paginated by offset / limit.

Authorizations

BearerAuthAccessTokenQueryFylrAuthHeader

AuthorizationstringRequired

Access token in the Authorization header: Authorization: Bearer <token>.

Path parameters

collection_idintegerRequired

The collection id of the collection to access.

Query parameters

offsetintegerOptional

The offset when requesting the collection object list.

limitintegerOptional

The limit when requesting the collection object list. Default is 100.

Header parameters

x-fylr-authorizationstringOptional

The access token in form of Bearer <token>. You can also use authorization which does the same. authorization is looked at first.

authorizationstringOptional

The access token in form of Bearer <token>.

Responses

200

List of collection objects.

application/json

_versionintegerRead-onlyOptional

The _version of the collection.

countintegerOptional

The number of objects linked to this collection. In /api/collection/splice the number of objects to delete. Use -1 to delete all objects.

indexinteger · nullableOptional

The index to use for /api/collection/splice. Index 0 is to the left of the first object. Index which equals the number of existing objects in the collection is to the right of the last object.

offsetintegerRead-onlyOptional

The offset of list of objects.

limitintegerRead-onlyOptional

The maximum count of objects to list.

401

No authenticated user. The request must carry a valid access token.

application/json

403

The authenticated user lacks a required permission (BAG_READ on the collection for GET, plus LINK/UNLINK on the objects for POST). See code for the specific reason.

application/json

404

The collection addressed by the URL does not exist.

application/json

{
  "_version": 1,
  "count": 1,
  "index": 1,
  "offset": 1,
  "limit": 1,
  "objects": [
    {
      "_global_object_id": "text",
      "webfrontend_props": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "lookup:_global_object_id": {
        "_allow_defer": true,
        "_objecttype": "text",
        "_system_object_id": 1,
        "_uuid": "text",
        "additionalProperties": "text"
      }
    }
  ]
}

POST /collection/objects/{collection_id} — Replace objects of a collection.

Replace objects of a collection.

post

• Replaces the entire object list: the collection is linked to exactly the objects in the request body, and any object not present in the body is unlinked.
• Requires an authenticated user with BAG_READ permission.
• Linking objects to a collection requires LINK permission.
• If objects will be unlinked from the collection, the UNLINK permission is needed.
• The _version of the collection is not changed.

Authorizations

BearerAuthAccessTokenQueryFylrAuthHeader

AuthorizationstringRequired

Access token in the Authorization header: Authorization: Bearer <token>.

Path parameters

collection_idintegerRequired

The collection id of the collection to access.

Query parameters

allow_invalid_aclstring · booleanOptional

Allow storing the collection even if the owner doesn't have the necessary permissions for all objects to share the rights defined in the _acl property of the collection. The _invalid_acl flag will be set, if the user doesn't have sufficient permissions to share all objects of the collection. The user needs the permission BAG_ACL for the collection in order to use this parameter.

Differs from easydb 5: this confirmation is driven by the boolean allow_invalid_acl parameter. easydb 5 instead resolves the 202 confirmation with a collection_rights_policy query parameter; there is no allow_invalid_acl parameter in easydb 5.

background_invalid_aclstring · booleanOptional

If set, the invalid-ACL validity check (whether the collection owner may grant the rights of all linked objects) is not run inline. Instead a queued ACTION_COLLECTION_ACL_CHECK job is scheduled and the request returns immediately, before the check has resolved.

skip_indexstring · booleanOptional

If set, do not queue index jobs for objects added to or removed from the collection.

Header parameters

x-fylr-authorizationstringOptional

The access token in form of Bearer <token>. You can also use authorization which does the same. authorization is looked at first.

authorizationstringOptional

The access token in form of Bearer <token>.

Body

application/json

_versionintegerRead-onlyOptional

The _version of the collection.

countintegerOptional

The number of objects linked to this collection. In /api/collection/splice the number of objects to delete. Use -1 to delete all objects.

indexinteger · nullableOptional

The index to use for /api/collection/splice. Index 0 is to the left of the first object. Index which equals the number of existing objects in the collection is to the right of the last object.

offsetintegerRead-onlyOptional

The offset of list of objects.

limitintegerRead-onlyOptional

The maximum count of objects to list.

Responses

200

Short response of containing only the number of objects.

application/json

_versionintegerRead-onlyOptional

The _version of the collection.

countintegerRead-onlyOptional

The number of objects linked to this collection.

202

The collection owner lacks a grantable right for a linked object and the caller has BAG_ACL. Re-send with allow_invalid_acl=true to store the collection with sharing disabled.

application/json

400

The request could not be processed.

application/json

401

No authenticated user. The request must carry a valid access token.

application/json

403

The authenticated user lacks a required permission (BAG_READ on the collection for GET, plus LINK/UNLINK on the objects for POST). See code for the specific reason.

application/json

404

The collection addressed by the URL does not exist.

application/json

{
  "_version": 1,
  "count": 1
}