Skip to main content

FileMaker Data API: an independent reference

This is an independent, task-oriented reference for the Claris FileMaker Data API, the REST interface to FileMaker Server databases. I wrote it as a portfolio sample. It is not affiliated with or endorsed by Claris; the official documentation remains the authority.

Two things make this sample worth your time as a hiring signal:

  1. The OpenAPI file is hand-authored. The interactive specification renders from a YAML file I wrote by hand in OpenAPI 3.1, not exported from a tool. Schemas, security schemes, and response envelopes are all explicit.
  2. I am certified on the platform. I hold Expert-level Claris certifications, so the reference reflects how the API actually behaves, not just what its endpoint list says.

Scope​

CoveredNot covered (see official docs)
Sessions: log in, log outRunning scripts
Records: create, read, list, edit, deleteSetting global fields
Finds: queries, operators, sorting, pagingLayout and database metadata
Container field uploadsExternal data source authentication and OData

How the API is shaped​

Every call except login and logout carries a bearer token and returns the same envelope:

{
  "response": {},
  "messages": [{ "code": "0", "message": "OK" }]
}

The base URL pattern is:

https://{host}/fmi/data/v1/databases/{database}

v1 can also be v2 or vLatest. This reference documents v1, which is the most widely deployed.

Read the gotchas first​

These are the behaviors that cost integrators real debugging time. Each is documented in context, but here they are up front:

  • The error code is a string. Success is "code": "0", not 0. Compare accordingly.
  • A find with no matches is an HTTP 404, carrying FileMaker error code 401. It is an empty result, not an authentication failure and usually not an error at all. Handle it deliberately.
  • Log out with the token in the URL path, not in the Authorization header. It is the only endpoint shaped that way.
  • _offset starts at 1, not 0.
  • In find requests, offset and limit are strings in the JSON body, unlike the integer query parameters on the records endpoint.
  • The API account needs the fmrest extended privilege in its privilege set. Without it, credentials that work fine in FileMaker Pro fail here.

Sections​