Every Portals service uses the same API address. Use this reference when you build integrations for sites, pages, menus, assets, security policies, site settings, currency mapping policies, announcements, or sign-in.
The Address
| Environment | Address |
|---|---|
| Production | portals.api.rhythmsoftware.com |
| Development | portals.api.dev.rhythmsoftware.com |
Each service uses its own path under that address:
| Path | Service |
|---|---|
/announcements | Announcements |
/assets | Assets |
/currencyMappingPolicies | Currency mapping policies |
/logins | Sign-in |
/menus | Menus |
/pages | Pages |
/securityPolicies | Security policies |
/settings | Portal hosting |
/sites | Sites |
/siteSettings | Site settings |
For example, you reach a site's hosting record at portals.api.rhythmsoftware.com/settings/<account>.
How Requests Are Handled
- Encrypted connections only. Send every request over an encrypted connection; production and account-specific addresses refuse unencrypted requests.
- Not cached. Every request goes straight to the service. Responses are not cached at the edge, and cookies are not forwarded, so the service cannot rely on them.
For example, a site's hosting record is reached at portals.api.rhythmsoftware.com/settings/<account>.
Additional Request Handling Details
- Encrypted connections only. Production and account-specific addresses refuse unencrypted requests.
- Not cached. Every request reaches the service directly. Responses are not cached at the edge, and cookies are not forwarded, so the service cannot rely on them.
- Credentials pass through unchanged. The authorization header and query string reach the service exactly as you sent them.
- Behind Rhythm's platform firewall. The address sits behind the same API firewall as the rest of Rhythm's platform.
Warning
Reaching the address does not authorize your request. Each service checks your identity and permissions separately; the address only routes your request to the right service.
Reading the API Description Without Signing In
You can read the published API description at swagger/* on the API address without signing in. The swagger/* description comes from a shared, publicly readable location, is read-only, and can take up to a day to show a newly published change because of caching.