Repository navigation
feat(adapters): add read-only Claris FileMaker Data API adapter - #1624
Merged
Merged
Conversation
LOGIN_TOKEN with loginBasicAuth against FileMaker Server sessions, Bearer token with refreshOn401 for the 15-minute inactivity timeout, and four read-only tools (list layouts, layout metadata, find, get record). The find tool description states that FileMaker messages code 401 (HTTP 500) means no matching records, not auth failure. Closes HelpCode-ai#1405.
GallaGit
marked this pull request as ready for review
November 10, 2026 18:50
# Conflicts: # CITATION.cff # README.de.md # README.ja.md # README.md # README.zh-CN.md # glama.json # llms-full.txt # llms.txt # package.json # server.json
helpcodeai
approved these changes
Nov 10, 2026
helpcodeai
left a comment
helpcodeai
left a comment
Contributor
There was a problem hiding this comment.
Thanks @GallaGit, this is a clean adapter, and the live run against FileMaker Server 26 is what I hoped for.
What I checked:
- Auth:
LOGIN_TOKENwithloginBasicAuthsends Basic only on the sessions call, with the empty JSON body. The token is read fromresponse.tokenand sent as Bearer, andrefreshOn401plus the 900 s TTL cover the 15-minute inactivity timeout. The password is marked secret, andloginHeaderscarries no Authorization. - Read-only: three GETs and the POST
_find, all with read-only annotations. No record writes, scripts, containers or logout. - Inputs:
layoutandrecord_idare path-encoded. OptionalrecordId,limit,offsetandsortare left out when unset, and the spec pins that. - Code "401": the find description and the instructions both separate the empty result from HTTP 401, including the HTTP 200 answer you saw on Server 26.
- Self-hosted vs Cloud: the SSRF and TLS notes are accurate for both.
- Locally:
validate-adaptersshows no FileMaker warnings,adapter-count --checkis OK at 731, and regenerating the catalog leaves no diff. CI is green, and the logo is a plain path SVG.
Two small things for a later PR, neither blocking:
filemaker_get_layout_metadatanames its parameterrecordId, whilefilemaker_get_recordusesrecord_id. One name for both would be easier for the model.- FileMaker file names often contain spaces, and
FILEMAKER_DATABASEgoes intobaseUrlas typed. If you still have the trial server, could you check a file likeMy Contactsend to end?
I'll merge shortly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1405
Read-only adapter for Claris FileMaker Server through the FileMaker Data API, following the plan approved in #1405.
Auth
LOGIN_TOKENwithloginBasicAuth: true(from feat(engine): loginBasicAuth flag for LOGIN_TOKEN logins #1460):POST /fmi/data/vLatest/databases/{db}/sessionswith HTTP Basic and an empty JSON body, token read fromresponse.tokenand sent asBearer.tokenTTLSeconds: 900with proactive refresh, plusrefreshOn401: true, so an expired session (15 min of inactivity) triggers a fresh login.Tools (all read-only)
filemaker_list_layoutsfilemaker_get_layout_metadatafilemaker_find_records(POST_find)filemaker_get_recordThe
filemaker_find_recordsdescription and the instructions say that FileMaker code"401"inmessages[]means an empty result, not a failure, and is not the same as HTTP 401.Tests
RestEngine, response transforms, env var metadata, and the 401 wording.RUN_FILEMAKER_LIVE=1): ran against FileMaker Server 26.0.3 (trial, self-hosted in Docker) with a read-only file account that has thefmrestprivilege. 21/21 passing: sign-in, wrong password refused without echoing credentials, list layouts, metadata, find, get record.401"No records match the request". On FileMaker Server 26 this came back with HTTP 200, not 500, so the wording now covers both;952, which is what triggers the re-login.Opening as draft for early feedback. I will sign the CLA.