canonical: https://jentic.com/apis/hyland.com/hyland

# Hyland ECM REST API

Jentic publishes the only available OpenAPI specification for Hyland ECM REST API, keeping it validated and agent-ready. The Hyland Saperion Enterprise Content Management API exposes 44 endpoints for managing documents, folders, archives, users, access control lists, and workflow tasks across an on-premises ECM deployment. It supports archive-scoped document retrieval, document revisions, named ACLs, and named-vs-numeric folder lookups. Authentication is HTTP basic against the customer-hosted server defined in the base URL placeholder.

## For AI agents

Manage Hyland Saperion documents, folders, archives, users, and ACLs from an AI agent or backend automation that needs structured ECM access.

## Scope

Does not handle e-signature, OCR, or content authoring - use for document retrieval, archive management, ACL administration, and folder navigation in Hyland Saperion only.

## Capabilities

- Retrieve a document by id, including specific revisions, from a Hyland archive
- List archives, archive-scoped folders, and archive-scoped document collections
- Create, update, and delete named or numeric access control lists
- Restore deleted ACLs and deleted documents from the recycle bin
- Look up archive field metadata by archive id or by archive name
- Manage user records inside a Hyland ECM deployment

## Use cases

### Automated Document Retrieval

Pull contract or invoice documents out of Hyland Saperion on demand from a downstream workflow such as a finance approval bot or a contract review service. The `/documents/{documentId}` and `/archive/documents/{archiveId}` endpoints support direct retrieval, and `/documents/revisions/{revisionId}` returns specific historical versions when audit trails matter.

Example prompt: GET `/documents/{documentId}` for the requested invoice id and stream the response into the approval workflow.

### ACL and Compliance Management

Run periodic audits and remediation against Hyland ACLs by listing `/management/acls`, looking up specific ACLs by id or by name, and restoring deleted ACLs from `/management/deleted/acls` when records are lost. Supports compliance teams that need to prove who had access to which archive on which date.

Example prompt: GET `/management/acls` and reconcile each entry against the compliance baseline.

### Archive Discovery and Field Mapping

When integrating Hyland with a new downstream system, programmatically discover archives via /archives and inspect their field schemas via `/archive/{archiveId}/fields` to build mapping configuration. The named-archive lookup `/archives/{archive-name}` supports symbolic names, which is useful when archive ids vary across environments.

Example prompt: GET `/archives/Invoices` then GET `/archive/{archiveId}/fields` to build the field mapping.

### AI Agent ECM Assistant

Give an internal AI assistant the ability to fetch documents from Hyland on staff request without exposing the full ECM UI. Through Jentic the agent searches for 'retrieve a Hyland document', loads the input schema, and executes with the document id. Basic-auth credentials stay in your Jentic One instance rather than the agent context, which is essential for content that may be regulated.

Example prompt: Search Jentic for 'retrieve a Hyland document by id', load the schema, and execute with the document id.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/documents/{documentId}` | Retrieve a document by id |
| GET | `/documents/revisions/{revisionId}` | Retrieve a specific document revision |
| GET | `/archives` | List archives on the server |
| GET | `/archive/{archiveId}/fields` | List fields for an archive |
| GET | `/management/acls` | List access control lists |
| GET | `/management/deleted/acls` | List deleted ACLs eligible for restore |
| GET | `/archive/folders/{archiveId}` | List folders in an archive |

## Key resources

- **Documents** — Retrieve, update, and version Hyland documents and revisions
- **Archives** — List archives and inspect archive-scoped folders, documents, and fields
- **ACLs** — Manage named and numeric access control lists, including deleted-ACL restore
- **Folders** — List and look up folders within archives
- **Users** — Manage user records inside the Hyland deployment

## Why Jentic

- **Setup:** Wiring the Hyland ECM REST API by hand means holding HTTP basic credentials, targeting your own Saperion server host under `/ecm/api`, and learning its archive and folder URL conventions yourself. Through Jentic you install once, import the Hyland ECM REST API from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** This API puts document, revision, and archive ids in the URL path (`/documents/{documentId}`, `/archive/{archiveId}/fields`), so a rule can pin your agent to one document or archive: it can read that resource and nothing else. You choose the operations it may call, so ACL administration is not included unless you add it.
- **Credential handling:** Your Hyland basic credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'retrieve a Hyland document' or 'list archive fields', and Jentic returns the matching ECM operation with its input schema so the agent calls the right endpoint without learning Saperion-specific URL conventions.

## Related APIs

- **Box API** — Box is a cloud-native content platform with similar document, folder, and permissions APIs
- **Dropbox API** — Dropbox provides simpler cloud document storage with sharing and team-folder APIs
- **Dropbox Sign API** — Dropbox Sign handles e-signature flows that pair with Hyland ECM for the post-signature archive

## FAQ

### Why is there no official OpenAPI spec for Hyland ECM REST API?

Hyland publishes Javadoc-based REST documentation rather than an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Hyland Saperion via structured tooling. It is validated against the documented API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Hyland ECM REST API use?

The Hyland API uses HTTP basic authentication against the customer-hosted Saperion server defined in the {server} placeholder of the base URL. Through Jentic the basic credentials sit in the credential vault and Jentic injects the Authorization header at execution time.

### Can I retrieve a specific revision of a Hyland document?

Yes. GET `/documents/revisions/{revisionId}` returns a specific historical revision of a document. Use it alongside `/documents/{documentId}` when audit trails or version comparison are required for compliance workflows.

### What are the rate limits for the Hyland ECM REST API?

Hyland Saperion is customer-hosted, so rate limits are determined by the customer's deployment capacity rather than a vendor-set quota. Coordinate batch reads with the Saperion administrator and watch for HTTP 429 or 503 responses to back off automatically.

### How do I list archives on a Hyland server through Jentic?

Search Jentic for 'list Hyland archives', load the schema for GET /archives, and execute against the configured {server} host. Install with pip install jentic and use the async search, load, and execute pattern.

### Can I restore a deleted ACL in Hyland?

Yes. List candidate deleted ACLs at `/management/deleted/acls` and call the corresponding restore operation under `/management/deleted/acls/{aclId}` to recover one. This is useful when a permission set is removed in error and needs to be reinstated.

### Can I limit what my agent is allowed to do with the Hyland ECM REST API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials your agent may use, and this API puts document, revision, and archive ids directly in the URL path, so you can pin the agent to a single document or archive with GET `/documents/{documentId}` or GET `/archive/{archiveId}/fields` and nothing else. You pick the exact operations it can call, so ACL administration under `/management/acls` and deleted-ACL restore under `/management/deleted/acls` stay out of reach unless you explicitly add them. The basic-auth credential lives in your own instance and is injected only when a permitted call runs.