Skip to main content
API docs by Redocly

FileMaker Data API (independent reference) (1.0.0)

Download OpenAPI specification:Download

URL: https://j-arndt.github.io

REST access to FileMaker Server hosted databases.

An independently written OpenAPI description of the Claris FileMaker Data API, version v1, covering sessions, record operations, finds, and container uploads.

Read this first

  • Every response uses the same envelope: a response object and a messages array. Message code values are strings; success is "0".
  • Log in with HTTP Basic credentials to obtain a bearer token. Every other call sends Authorization: Bearer {token}. Tokens expire after 15 minutes of inactivity.
  • Logout is the one endpoint that carries the token in the URL path instead of a header.
  • A find that matches nothing returns HTTP 404 with FileMaker code 401. Treat it as an empty result, not a failure.
  • The authenticating account's privilege set must include the fmrest extended privilege.

This document is a portfolio work sample and is not affiliated with or endorsed by Claris International Inc.

Sessions

Log in to obtain a bearer token; log out to release it.

Log in (create a session)

Exchanges HTTP Basic credentials for a session token. The token is returned in the response body and in the X-FM-Data-Access-Token header. Send an empty JSON object as the body when no external data sources are involved.

Authorizations:
basicAuth
path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

Request Body schema: application/json
required
Array of objects

Credentials for external FileMaker data sources referenced by the file.

Array
database
string
username
string
password
string

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "response": {
    },
  • "messages": [
    ]
}

Log out (delete a session)

Invalidates a session token. Unusually for this API, the token travels in the URL path and no Authorization header is sent.

path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

token
required
string

The session token to invalidate.

Responses

Response samples

Content type
application/json
{
  • "response": { },
  • "messages": [
    ]
}

Records

Create, read, list, edit, and delete records through a layout.

List records

Returns a range of records in the layout's context. _offset starts at 1. _sort is a JSON array passed as a URL-encoded string.

Authorizations:
bearerAuth
path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

layout
required
string

Layout providing the field context for the call.

query Parameters
_offset
integer >= 1
Default: 1

One-based index of the first record to return. Defaults to 1.

_limit
integer >= 1
Default: 100

Maximum number of records to return. Defaults to 100.

_sort
string

URL-encoded JSON array of sort specifications, for example: [{"fieldName":"Name","sortOrder":"ascend"}]

Responses

Response samples

Content type
application/json
{
  • "response": {
    },
  • "messages": [
    ]
}

Create a record

Creates one record from a fieldData object. Only fields present on the layout can be set (a missing field raises FileMaker code 102). Container fields cannot be set here; use the container upload call.

Authorizations:
bearerAuth
path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

layout
required
string

Layout providing the field context for the call.

Request Body schema: application/json
required
required
object (FieldData)

Map of field name to value. Fields must exist on the layout in use.

object

Optional related records to create through portals on the layout.

Responses

Request samples

Content type
application/json
{
  • "fieldData": {
    }
}

Response samples

Content type
application/json
{
  • "response": {
    },
  • "messages": [
    ]
}

Get one record

Authorizations:
bearerAuth
path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

layout
required
string

Layout providing the field context for the call.

recordId
required
string

FileMaker internal record id, as returned by create, list, or find calls.

Responses

Response samples

Content type
application/json
{
  • "response": {
    },
  • "messages": [
    ]
}

Edit a record

Updates the fields present in fieldData, leaving all others untouched. Include the modId from a prior read to enable optimistic locking: the edit is rejected with FileMaker code 306 if the record changed after that read.

Authorizations:
bearerAuth
path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

layout
required
string

Layout providing the field context for the call.

recordId
required
string

FileMaker internal record id, as returned by create, list, or find calls.

Request Body schema: application/json
required
required
object (FieldData)

Map of field name to value. Fields must exist on the layout in use.

modId
string

Optional. When present, the edit fails with FileMaker code 306 if the record's current modId differs.

Responses

Request samples

Content type
application/json
{
  • "fieldData": {
    },
  • "modId": "7"
}

Response samples

Content type
application/json
{
  • "response": {
    },
  • "messages": [
    ]
}

Delete a record

Deletes the record immediately. Cascading deletion of related records follows the file's relationship settings, exactly as it would in FileMaker Pro.

Authorizations:
bearerAuth
path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

layout
required
string

Layout providing the field context for the call.

recordId
required
string

FileMaker internal record id, as returned by create, list, or find calls.

Responses

Response samples

Content type
application/json
{
  • "response": { },
  • "messages": [
    ]
}

Finds

Query records with FileMaker find grammar.

Find records

Runs a find using FileMaker query grammar. Fields inside one query object are ANDed; multiple query objects are ORed; a query object with "omit": "true" excludes its matches.

Criteria strings accept FileMaker find operators, for example >=100, Karl*, ==exact match, and 2025-01-01...2025-12-31.

Empty result behavior: no matches returns HTTP 404 with FileMaker code 401. Treat that combination as a found set of zero.

Note that offset and limit are strings in this request body, unlike the integer query parameters on the list call.

Authorizations:
bearerAuth
path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

layout
required
string

Layout providing the field context for the call.

Request Body schema: application/json
required
required
Array of objects

Query objects. Fields within one object are ANDed; objects are ORed against each other.

Array of objects (SortSpec)
offset
string
Default: "1"

One-based offset, as a string (a quirk of this endpoint).

limit
string
Default: "100"

Maximum records to return, as a string (a quirk of this endpoint).

Responses

Request samples

Content type
application/json
{
  • "query": [
    ],
  • "sort": [
    ],
  • "offset": "1",
  • "limit": "25"
}

Response samples

Content type
application/json
{
  • "response": {
    },
  • "messages": [
    ]
}

Containers

Upload files into container fields.

Upload a file into a container field

Uploads one file into a container field as multipart form data. The form part must be named upload. Use repetition 1 for non-repeating container fields.

Authorizations:
bearerAuth
path Parameters
database
required
string

Hosted file name, without the .fmp12 extension.

layout
required
string

Layout providing the field context for the call.

recordId
required
string

FileMaker internal record id, as returned by create, list, or find calls.

fieldName
required
string

Name of the container field on the layout.

fieldRepetition
required
integer >= 1

One-based repetition number of the container field.

Request Body schema: multipart/form-data
required
upload
required
string <application/octet-stream>

The file to store in the container field.

Responses

Response samples

Content type
application/json
{
  • "response": {
    },
  • "messages": [
    ]
}