REST API

Everything the interface can do happens through a REST API with JSON. It is open to you for scripts, reporting and your own integrations.

Paths

You reach the API through the same entry point as the interface:

Internal paths (/internal/, /actuator/ and some account paths) are blocked from outside.

Signing in with an API token

For scripts, create a personal API token: under the account icon, Profile → API tokens → Create token.

• You enter a Label and a Lifetime: 1 day, 7 days, 30 days or unlimited. Your operations team can cap the longest lifetime.
• The token is shown once. Keep it like a password.
• A token has exactly your rights – no more, no less. Up to 20 tokens per account are valid at the same time.
• A revoked token stops working within 30 seconds.

The token goes into the header of every request:

curl -H "Authorization: Bearer rmm_pat_…" \
  https://mirador.example.com/api/specifications

A token cannot manage tokens, passwords or accounts; that needs a signed-in session in the interface. For technical accounts, the administrator creates tokens in the administration, in the Users section, on the account in question.

Alternatively, a program signs in with username and password (POST /identity/api/auth/login) and receives a session token valid for 12 hours.

Looking up the paths

In the administration, the Request Points section shows the administrator the paths of the model and identity services with method and, where available, description, generated from the running system. Paths under /document/api/ and /intelligence/api/ are not listed.

Reporting changes from other tools

A connected tool can tell Mirador through a webhook that something has changed:

POST /api/adapters/<tool>/events
X-RMM-Webhook-Secret: <secret>

{ "externalProjectId": "BRAKE", "elementIds": ["BRAKE-12"] }

Mirador answers 202 and fetches the changes shortly afterwards. Without a configured secret the webhook is off (404); a wrong secret gives 401.

Your own adapters

Tools other than Jira and Jama can be connected through your own adapters – as a plugin Mirador loads, or as a separate service in any language that talks to Mirador over HTTP and JSON. An adapter runs only once the administrator approves it. Talk to us if you are planning one.