Workfront API URL
For information about the URL that you will use to call the Workfront API, see Domain format for Adobe Workfront API calls.
REST Basics
This section provides a high-level introduction of how to interact with the Workfront REST API for the following REST principles:
Object URI
Each object in the system is given a unique URI consisting of the object type and the ID. The following examples show URIs describing three unique objects:
/attask/api/v15.0/project/4c78821c0000d6fa8d5e52f07a1d54d0
/attask/api/v15.0/task/4c78821c0000d6fa8d5e52f07a1d54d1
/attask/api/v15.0/issue/4c78821c0000d6fa8d5e52f07a1d54d2
The object type is case insensitive and can be either the abbreviated ObjCode (such as proj) or the alternate object name (project).
For a list of objects, valid ObjCodes, and object fields, see API Explorer.
Category
object, and a custom field is a Parameter
object.Operations
Objects are manipulated by sending an HTTP request to their unique URI. The operation to be performed is specified by the HTTP method.
The standard HTTP methods correspond to the following operations:
- GET - Retrieves an object by ID, searches for all objects by a query, runs reports, or executes named queries
- POST - Inserts a new object
- PUT - Edits an existing object
- DELETE - Deletes an object
In order to work around client deficiencies or protocol length limits, the method parameter can be used to override HTTP behavior. For example, a GET operation may be implemented by posting the following URI:
GET /attask/api/v15.0/project?id=4c78...54d0&method=get
GET /attask/api/v15.0/project/4c78...54d0?method=get
Response
Each request is given a response in JSON format. The response has either a data attribute if the request was successful or an error attribute if there was a problem. For example, the request
GET /attask/api/v15.0/proj/4c7c08b20000002de5ca1ebc19edf2d5
returns a JSON response similar to the following:
{
"data": [
{
"percentComplete": 0,
"status": "CUR",
"priority": 2,
"name": "Brand New Project",
"ID": "4c7c08b20000002de5ca1ebc19edf2d5"
}
]
}
Special security has been added around PUT, POST, and DELETE requests. Any request that results in writing to or deleting from the database can only be executed if the sessionID=abc123 is included in the URI. The following examples show how this would look for a DELETE request:
GET /attask/api/v15.0/project?id=4c78...54d0&method=delete&sessionID=abc123
GET /attask/api/v15.0/project/4c78...54d0?method=delete&sessionID=abc123
Authentication
The API authenticates each request to ensure that the client has access to view or modify a requested object.
Authentication is performed by passing in a session ID which can be given using one the following methods:
Request Header Authentication
The preferred method of authentication is to pass a request header named SessionID containing the session token. This has the advantage of being safe against Cross-site Request Forgery (CSRF) attacks and not interfering with the URI for caching purposes.
The following is an example of a request header:
GET /attask/api/v15.0/project/search
SessionID: abc1234
Cookie-Based Authentication
The API uses the same cookie-based authentication that is used by the web UI to the system. Where, if a client logs into Workfront using the web UI, any AJAX calls made from within the same browser uses the same authentication.
Login
/login
endpoint or API keys. Instead, use one of the following authentication methods:- Server authentication with JWT
- User authentication with OAuth2
Using a valid username and password, you can use the following request to obtain a session ID:
POST /attask/api/v15.0/login?username=admin&password=user
This sets a cookie to authenticate future requests as well as return a JSON response with the newly created sessionID, the userID of the logged in user, and other session attributes.
Generating an API Key
You can generate an API Key when you log into the system as that user, as shown in the following example:
PUT /attask/api/v15.0/user?action=generateApiKey&username= username&password=password&method=put
Retrieving a Previously-Generated API Key
You can also retrieve an API Key that has been previously generated for a particular user by running getApiKey:
PUT /attask/api/v15.0/user?action=getApiKey&username=user@email.com&password=userspassword&method=put
You can then use this result to authenticate any API call by adding “apiKey” as a request parameter with this value in place of a sessionID or username and password. This is beneficial from a security perspective.
The following request is an example of retrieving data from a project using the apiKey:
GET /attask/api/v15.0/project/abc123xxxxx?apiKey=123abcxxxxxxxxx
Invalidating an API Key
If the apiKey value has been compromised, you can run “clearApiKey” which invalidates the current API Key, as shown in the following example:
GET /attask/api/v15.0/user?action=clearApiKey&username=user@email.com&password=userspassword&method=put
Once cleared, you can run getApiKey again to generate a new API Key.
Logout
When a session is complete, you can use the following request to log the user out, preventing any further access with the sessionID.
GET /attask/api/v15.0/logout?sessionID=abc1234
The sessionID to be logged out can be specified either as a cookie, request header, or request parameter.
To log out a user:
-
Navigate to your login screen, but do not log in.
-
Change the URL to /attask/api/v15.0/project/search.
Notice the page cannot be found. -
Replace the word search with login?username=admin&password=user, substituting your username and password for admin and *user
*This session is stored in the browser as a cookie and does not need to be restated in each subsequent GET request. -
Change the URL back to /attask/api/v15.0/project/search.
-
Notice the response provided.
You must always include the sessionID provided after login when performing PUT, POST, and DELETE requests.
GET Behavior
Use the HTTP GET method to retrieve an object or multiple objects and to run reports.
Retrieving Objects
You can enhance a search for objects using modifiers and filters.
Retrieving an Object Using the Object ID
If you know the ID of an object, you can retrieve the object by accessing its unique URI. For example, the request
GET /attask/api/v15.0/project/4c78821c0000d6fa8d5e52f07a1d54d0
returns a response similar to the following:
{
"percentComplete": 0,
"status": "CUR",
"priority": 2,
"name": "Brand New Project",
"ID": "4c7c08b20000002de5ca1ebc19edf2d5"
}
You can retrieve multiple objects in the same request by specifying the id request parameter and giving a comma-separated list of IDs, as shown in the following example:
GET /attask/api/v15.0/project?id=4c78...54d0,4c78...54d1
Notice the /attask/api/v15.0/project?id=… request is the same as the /attask/api/v15.0/project/...
request.