--- title: "Integrating with Bynder" description: "Security, performance and operational parameters for building against the Bynder APIs, SDKs and MCP server" url: "https://earlyaccess.developers.bynder.com/getting-started/integrate" image: "https://earlyaccess.developers.bynder.com/_og/d/c_Ocean.takumi,title_Integrating+with+Bynder,description_~U2VjdXJpdHksIHBlcmZvcm1hbmNlIGFuZCBvcGVyYXRpb25hbCBwYXJhbWV0ZXJzIGZvciBidWlsZGluZyBhZ2FpbnN0IHRoZSBCeW5kZXIgQVBJcywgU0RLcyBhbmQgTUNQIHNlcnZlcg,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMxMjZERkUifX19,p_Ii9nZXR0aW5nLXN0YXJ0ZWQvaW50ZWdyYXRlIg,s_NeFTlFC_eTj3Xo13.png" --- # Integrating with Bynder The operational contract behind every integration: exactly what a token can reach, how many requests we allow, and which identifier format each endpoint expects. [View the scope directory](#oauth-20-scope-directory)[Getting started](https://earlyaccess.developers.bynder.com/getting-started) [Getting started](https://earlyaccess.developers.bynder.com/getting-started) shows you how to register an OAuth client, choose a grant type and make your first call. This page covers what comes next: the limits, identifiers and permission boundaries you need to design around before you ship. Not authenticated yet? Start with [Getting started](https://earlyaccess.developers.bynder.com/getting-started) for OAuth client registration, the three supported grant types and a working token request. Come back here to pick the right scopes and size your request volume. ## [Security and reliability at a glance](#security-and-reliability-at-a-glance) OAuth 2.0 Bearer tokens in JWT format 29 Granular scopes 4,500 Requests per 5 minutes, per IP 5 min Automatic cooldown ### [What this means for your integration](#what-this-means-for-your-integration) #### Access is consented, not assumed Every token carries a fixed set of scopes. An application reaches only the data and actions the user has explicitly consented to - and only where the user's own permissions already allow it. A scope never widens what someone can see. #### Throttling is predictable Rate limits protect performance for every tenant on the platform. The ceiling is published, the response code is standard, and recovery needs no intervention - so you can design retry behavior up front rather than discovering it in production. Plan for HTTP 429 We process up to **4,500 requests per five-minute window from a single IP address**. Exceeding the limit returns `HTTP 429 Too Many Requests` and pauses access for that IP. The pause lifts automatically after a five-minute cooldown - no support ticket needed. Build exponential backoff into your client and batch requests where you can. ## [Identifiers and UUID formats](#identifiers-and-uuid-formats) Bynder endpoints use two distinct UUID formats depending on the API version you call. Sending the wrong format to the wrong version is one of the most common causes of a failed request, so route carefully. | API version | UUID format | Grouping pattern | Example | | :-------------- | :------------- | :--------------- | :----------------------------------- | | v4 (/api/v4) | ColdFusion | 8-4-4-16 | 00000000-0000-0000-0000000000000000 | | Standard (/api) | UUID version 4 | 8-4-4-4-12 | 00000000-0000-0000-0000-000000000000 | Spot the difference Both formats are 32 hexadecimal characters. Only the hyphen placement differs: the ColdFusion format used by `/api/v4` has **three** hyphens and a 16-character final group, while standard UUID v4 has **four** hyphens and a 12-character final group. Newer endpoints require UUID v4. ## [OAuth 2.0 scope directory](#oauth-20-scope-directory) Scopes limit an access token to specific operational domains. We only grant scopes that match the user's underlying permissions, so a token can never exceed what its user could already do. Select a domain to see the scopes it contains. Admin and users Assets and usage Collections Metaproperties Workflow and campaigns System and integrations | Scope | Allowed operations | | :------------------- | :-------------------------------------------------------------------------- | | admin.profile:read | Retrieve specific or all security profiles | | admin.user:read | Retrieve users, specific users, temporary access tokens, and workflow users | | admin.user:write | Create, modify, or delete users | | current.profile:read | Retrieve the security profile of the active user | | current.user:read | Retrieve the current active user | | Scope | Allowed operations | | :---------------- | :------------------------------------------------------------------------------- | | asset:read | Retrieve assets, download locations, versions, recently removed assets, and search for similar assets | | asset:write | Modify, delete, add or remove tags, save as new asset, or save as a new version | | asset.usage:read | Retrieve asset usage data | | asset.usage:write | Create or delete asset usage records | | Scope | Allowed operations | | :--------------- | :------------------------------------------------------------------- | | collection:read | Retrieve collections and view assets within a specific collection | | collection:write | Create, modify, delete, share, and manage assets within a collection | Covers taxonomy and product information management. | Scope | Allowed operations | | :------------------- | :------------------------------------------------------------------------------- | | meta.assetbank:read | Retrieve metaproperties, options, dependencies, and PIM metadata | | meta.assetbank:write | Create, modify, and delete metaproperties, dependencies, options, and dependency groups | | meta.workflow:read | Retrieve workflow metaproperties | | Scope | Allowed operations | | :---------------------- | :------------------------------------------------------ | | workflow.campaign:read | Retrieve campaigns and specific campaign details | | workflow.campaign:write | Create, modify, delete, or close campaigns | | workflow.group:read | Retrieve groups and specific group details | | workflow.group:write | Create, modify, or delete workflow groups | | workflow.job:read | Retrieve jobs, campaign jobs, stages, and finished jobs | | workflow.job:write | Create, modify, or delete jobs and stages | | workflow.job:approve | Finish or approve a job | | workflow.preset:read | Retrieve specific job presets | | Scope | Allowed operations | | :-------------------------- | :---------------------------------------------------------- | | analytics.api:read | Access the Analytics API | | antivirus.asset.audit:read | Retrieve a list of, or a specific, quarantined asset | | antivirus.asset.audit:write | Update the review status for quarantined assets | | brandstore.order:read | Retrieve order information, specific orders, and orderlines | | brandstore.order:write | Modify brandstore orderlines | | webhooks.config:read | Retrieve webhook configurations | | webhooks.config:write | Create, update, patch, or delete webhook configurations | Request the narrowest scope that works Ask for `:read` where you do not need to write. Narrow scopes reduce your review burden with security teams and limit the blast radius if a credential is ever exposed. ## [Where to go next](#where-to-go-next) [](https://earlyaccess.developers.bynder.com/apis) [ ### Rights and access controls Go deeper on the governance endpoints behind these scopes: content access, metaproperty visibility and antivirus quarantine. ](https://earlyaccess.developers.bynder.com/apis) [](https://earlyaccess.developers.bynder.com/apis) [](https://earlyaccess.developers.bynder.com/apis)[Governance endpoints →](https://earlyaccess.developers.bynder.com/apis) [](https://earlyaccess.developers.bynder.com/mcp) [ ### Bynder MCP Connect an AI assistant to your portal with the Model Context Protocol, using the same credentials and the same permissions. ](https://earlyaccess.developers.bynder.com/mcp) [](https://earlyaccess.developers.bynder.com/mcp) [](https://earlyaccess.developers.bynder.com/mcp)[MCP reference →](https://earlyaccess.developers.bynder.com/mcp)