Bynder Developer Platform

Integrating with Bynder

The operational contract behind every integration: exactly what a token can reach, how many requests we allow, and which identifier format each endpoint expects.

View the scope directory Getting started

Getting started shows you how to register an OAuth client, choose a grant type and make your first call. This page covers what comes next: the limits, identifiers and permission boundaries you need to design around before you ship.

Not authenticated yet?

Start with Getting started for OAuth client registration, the three supported grant types and a working token request. Come back here to pick the right scopes and size your request volume.

Security and reliability at a glance

OAuth 2.0

Bearer tokens in JWT format

Granular scopes

4,500

Requests per 5 minutes, per IP

5 min

Automatic cooldown

What this means for your integration

Least privilege

Access is consented, not assumed

Every token carries a fixed set of scopes. An application reaches only the data and actions the user has explicitly consented to - and only where the user's own permissions already allow it. A scope never widens what someone can see.

High availability

Throttling is predictable

Rate limits protect performance for every tenant on the platform. The ceiling is published, the response code is standard, and recovery needs no intervention - so you can design retry behavior up front rather than discovering it in production.

Plan for HTTP 429

We process up to 4,500 requests per five-minute window from a single IP address. Exceeding the limit returns HTTP 429 Too Many Requests and pauses access for that IP. The pause lifts automatically after a five-minute cooldown - no support ticket needed. Build exponential backoff into your client and batch requests where you can.

Identifiers and UUID formats

Bynder endpoints use two distinct UUID formats depending on the API version you call. Sending the wrong format to the wrong version is one of the most common causes of a failed request, so route carefully.

API version	UUID format	Grouping pattern	Example
`v4` (`/api/v4`)	ColdFusion	8-4-4-16	`00000000-0000-0000-0000000000000000`
Standard (`/api`)	UUID version 4	8-4-4-4-12	`00000000-0000-0000-0000-000000000000`

Spot the difference

Both formats are 32 hexadecimal characters. Only the hyphen placement differs: the ColdFusion format used by /api/v4 has three hyphens and a 16-character final group, while standard UUID v4 has four hyphens and a 12-character final group. Newer endpoints require UUID v4.

OAuth 2.0 scope directory

Scopes limit an access token to specific operational domains. We only grant scopes that match the user's underlying permissions, so a token can never exceed what its user could already do.

Select a domain to see the scopes it contains.

Admin and users

Assets and usage

Collections

Metaproperties

Workflow and campaigns

System and integrations

Scope	Allowed operations
`admin.profile:read`	Retrieve specific or all security profiles
`admin.user:read`	Retrieve users, specific users, temporary access tokens, and workflow users
`admin.user:write`	Create, modify, or delete users
`current.profile:read`	Retrieve the security profile of the active user
`current.user:read`	Retrieve the current active user

Scope	Allowed operations
`asset:read`	Retrieve assets, download locations, versions, recently removed assets, and search for similar assets
`asset:write`	Modify, delete, add or remove tags, save as new asset, or save as a new version
`asset.usage:read`	Retrieve asset usage data
`asset.usage:write`	Create or delete asset usage records

Scope	Allowed operations
`collection:read`	Retrieve collections and view assets within a specific collection
`collection:write`	Create, modify, delete, share, and manage assets within a collection

Scope	Allowed operations
`meta.assetbank:read`	Retrieve metaproperties, options, dependencies, and PIM metadata
`meta.assetbank:write`	Create, modify, and delete metaproperties, dependencies, options, and dependency groups
`meta.workflow:read`	Retrieve workflow metaproperties

Scope	Allowed operations
`workflow.campaign:read`	Retrieve campaigns and specific campaign details
`workflow.campaign:write`	Create, modify, delete, or close campaigns
`workflow.group:read`	Retrieve groups and specific group details
`workflow.group:write`	Create, modify, or delete workflow groups
`workflow.job:read`	Retrieve jobs, campaign jobs, stages, and finished jobs
`workflow.job:write`	Create, modify, or delete jobs and stages
`workflow.job:approve`	Finish or approve a job
`workflow.preset:read`	Retrieve specific job presets

Scope	Allowed operations
`analytics.api:read`	Access the Analytics API
`antivirus.asset.audit:read`	Retrieve a list of, or a specific, quarantined asset
`antivirus.asset.audit:write`	Update the review status for quarantined assets
`brandstore.order:read`	Retrieve order information, specific orders, and orderlines
`brandstore.order:write`	Modify brandstore orderlines
`webhooks.config:read`	Retrieve webhook configurations
`webhooks.config:write`	Create, update, patch, or delete webhook configurations

Request the narrowest scope that works

Ask for :read where you do not need to write. Narrow scopes reduce your review burden with security teams and limit the blast radius if a credential is ever exposed.

Where to go next

Rights and access controls

Go deeper on the governance endpoints behind these scopes: content access, metaproperty visibility and antivirus quarantine.

Governance endpoints →

Bynder MCP

Connect an AI assistant to your portal with the Model Context Protocol, using the same credentials and the same permissions.

MCP reference →