2026 August Release

API ReferencePermanent link for this heading

UsersPermanent link for this heading

POST /usersPermanent link for this heading

Creates one new user. The user state can be deactivated.

Request Body

The request body has the following fields:

Field

Type

Required

Description

email

string

Yes

Email address of the user.

externalkey

string

No

External identifier for the user in your own system, e.g. an ID from an external HR/user-management system.

firstname

string

Yes

First name.

lastname

string

Yes

Last name.

solutions

array of solution objects

Yes

List of solutions/licenses to assign to the user — see the table below.

Each entry of solutions[] has the following fields:

Field

Type

Required

Description

solution

string

Yes

Name of the solution, e.g. Fabasoft OneGov.

license

string

Yes

Type of license to assign, e.g. Full Access.

Responses

201 — Successful operation

Field

Type

Required

Description

id

string

No¹

COO address of the newly created user.

externalkey

string

No¹

External key of the user, if one was supplied.

email

string

No¹

Email address of the user.

firstname

string

No¹

First name of the user.

lastname

string

No¹

Last name of the user.

¹ Not marked as required in the schema, but the server always populates this field.

400 — User error

Field

Type

Required

Description

type

string

No¹

Identifier of the error, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

detail

string

No¹

Detailed explanation of the error.

status

integer

No¹

HTTP status code, repeated in the body.

¹ Not marked as required in the schema, but the server always populates this field.

404 — No User Found

Same GWSError structure as described above for this operation — see that table for the field explanations.

500 — Server error

Same GWSError structure as described above for this operation — see that table for the field explanations.

Python Example

Python example

import requests

url = f"{BASE_URL}/{SERVICE_COO}/users"

payload = {

    "email": "hugo.boss@example.com",

    "firstname": "Hugo",

    "lastname": "Boss",

    "externalkey": "extkey-123-49292",

    "solutions": [

        {"solution": "Fabasoft OneGov", "license": "Full Access"}

    ],

}

response = requests.post(url, json=payload, auth=AUTH)

print(response.status_code)

print(response.json())

Java Example

Java example

import java.net.URI;

import java.net.http.*;

import java.util.Base64;

String auth = Base64.getEncoder().encodeToString((AUTH_USER + ":" + AUTH_PASSWORD).getBytes());

String body = """

    {

      "email": "hugo.boss@example.com",

      "firstname": "Hugo",

      "lastname": "Boss",

      "externalkey": "extkey-123-49292",

      "solutions": [

        {"solution": "Fabasoft OneGov", "license": "Full Access"}

      ]

    }

    """;

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()

    .uri(URI.create(BASE_URL + "/" + SERVICE_COO + "/users"))

    .header("Authorization", "Basic " + auth)

    .header("Content-Type", "application/json")

    .POST(HttpRequest.BodyPublishers.ofString(body))

    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode());

System.out.println(response.body());

DELETE /users/{userId}Permanent link for this heading

Deactivate an existing user.

Parameters

Name

In

Required

Type

Description

userId

path

Yes

string

Email, externalkey or COO address of the user, e.g. hugo.boss@example.com.

Responses

204 — Successful operation

User was deactivated and licenses are available again. No response body.

400 — The user is already deactivated

Field

Type

Required

Description

type

string

No¹

Identifier of the error, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

detail

string

No¹

Detailed explanation of the error.

status

integer

No¹

HTTP status code, repeated in the body.

¹ Not marked as required in the schema, but the server always populates this field.

404 — No user was found

Same GWSError structure as described above for this operation — see that table for the field explanations.

500 — Internal server error

Same GWSError structure as described above for this operation — see that table for the field explanations.

Python Example

Python example

import requests

user_id = "hugo.boss@example.com"

url = f"{BASE_URL}/{SERVICE_COO}/users/{user_id}"

response = requests.delete(url, auth=AUTH)

print(response.status_code)

Java Example

Java example

import java.net.URI;

import java.net.http.*;

import java.util.Base64;

String auth = Base64.getEncoder().encodeToString((AUTH_USER + ":" + AUTH_PASSWORD).getBytes());

String userId = "hugo.boss@example.com";

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()

    .uri(URI.create(BASE_URL + "/" + SERVICE_COO + "/users/" + userId))

    .header("Authorization", "Basic " + auth)

    .DELETE()

   .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode());

GET /users/{userId}Permanent link for this heading

Returns a single user, looked up by their email address.

Parameters

Name

In

Required

Type

Description

userId

path

Yes

string

Email of the user, e.g. hugo.boss@example.com.

Responses

200 — Successful operation

Field

Type

Required

Description

id

string

No¹

COO address of the user.

externalkey

string

No¹

External key of the user.

email

string

No¹

Email address of the user.

firstname

string

No¹

First name of the user.

lastname

string

No¹

Last name of the user.

¹ Not marked as required in the schema, but the server always populates this field.

404 — No user was found

Field

Type

Required

Description

type

string

No¹

Identifier of the error, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

detail

string

No¹

Detailed explanation of the error.

status

integer

No¹

HTTP status code, repeated in the body.

¹ Not marked as required in the schema, but the server always populates this field.

Python Example

Python example

import requests

user_id = "hugo.boss@example.com"

url = f"{BASE_URL}/{SERVICE_COO}/users/{user_id}"

response = requests.get(url, auth=AUTH)

print(response.status_code)

print(response.json())

Java Example

Java example

import java.net.URI;

import java.net.http.*;

import java.util.Base64;

String auth = Base64.getEncoder().encodeToString((AUTH_USER + ":" + AUTH_PASSWORD).getBytes());

String userId = "hugo.boss@example.com";

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()

    .uri(URI.create(BASE_URL + "/" + SERVICE_COO + "/users/" + userId))

    .header("Authorization", "Basic " + auth)

    .GET()

    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode());

System.out.println(response.body());

TeamsPermanent link for this heading

POST /teamsPermanent link for this heading

Creates a new team.

Request Body

The request body has the following fields:

Field

Type

Required

Description

name

string

Yes

Name of the team.

externalkey

string

Yes

External key of the team. Must be unique in the organisation.

members

array of string

No

List of users to add as team members. Each entry can be the COO address (id), email address, or externalkey of an existing user.

Responses

201 — Successful operation

Field

Type

Required

Description

id

string

No¹

COO address of the newly created team.

externalkey

string

No¹

External key of the team.

name

string

No¹

Name of the team.

members

array of user objects

No¹

The team's members. Same structure as the response described under POST /users → Responses → 201.

¹ Not marked as required in the schema, but the server always populates this field.

400 — User error

Field

Type

Required

Description

type

string

No¹

Identifier of the error type, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

status

integer

No¹

HTTP status code, repeated in the body.

errors

array of error segments

No¹

One entry per individual validation problem — see the errors[] table below.

¹ Not marked as required in the schema, but the server always populates this field.

Each entry of errors[] has the following fields:

Field

Type

Required

Description

detail

string

No¹

Human-readable explanation of this specific validation error.

pointer

string

No¹

JSON Pointer (e.g. #/name) identifying which request field the error refers to.

¹ Not marked as required in the schema, but the server always populates this field.

500 — Server error

Field

Type

Required

Description

type

string

No¹

Identifier of the error, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

detail

string

No¹

Detailed explanation of the error.

status

integer

No¹

HTTP status code, repeated in the body.

¹ Not marked as required in the schema, but the server always populates this field.

Python Example

Python example

import requests

url = f"{BASE_URL}/{SERVICE_COO}/teams"

payload = {

    "name": "IT Department",

    "externalkey": "it-dept-01",

    "members": [

        "hugo.boss@example.com",

        "extkey-123-49292",

    ],

}

response = requests.post(url, json=payload, auth=AUTH)

print(response.status_code)

print(response.json())

Java Example

Java example

import java.net.URI;

import java.net.http.*;

import java.util.Base64;

String auth = Base64.getEncoder().encodeToString((AUTH_USER + ":" + AUTH_PASSWORD).getBytes());

String body = """

    {

      "name": "IT Department",

      "externalkey": "it-dept-01",

      "members": ["hugo.boss@example.com", "extkey-123-49292"]

    }

    """;

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()

    .uri(URI.create(BASE_URL + "/" + SERVICE_COO + "/teams"))

    .header("Authorization", "Basic " + auth)

    .header("Content-Type", "application/json")

    .POST(HttpRequest.BodyPublishers.ofString(body))

    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode());

System.out.println(response.body());

Fileplan EntriesPermanent link for this heading

POST /fileplanentriesPermanent link for this heading

Creates a fileplan entry.

Request Body

The request body has the following fields:

Field

Type

Required

Description

title

string

Yes

German title of the fileplan entry.

description

string

No

German description of the fileplan entry.

primaryrelated

string

Yes

COO address or external key (objexternalkey) of an existing fileplan, fileplan entry, or fileplan entry room under which this new entry will be created.

externalkey

string

No

External key of the fileplan entry. Must be unique in the organisation.

classification

string

No

Classification of the fileplan entry. Allowed values (case-insensitive): CONFIDENTIAL, CLASSIFIED, UNPROTECTED.

privacyprotection

boolean

No

Whether the fileplan entry is privacy protected.

disclosurestatus

string

No

Status of the disclosure. Allowed values (case-insensitive): PUBLIC, LIMITEDPUBLIC, PRIVATE, NOTASSESSED, NOFOIA.

disclosurestatusstatement

string

No

Free-text statement explaining the chosen disclosure status.

retentionperiod

integer

No

Retention period in years.

retentionperiodcomment

string

No

Comment for the retention period.

archivalvalue

string

No

Decision whether the fileplan entry is predestined to be archived. Allowed values (case-insensitive): NOTASSESSED, PROMPT, ARCHIVALWORTHY, NOTARCHIVALWORTHY, SAMPLING.

archivalvaluecomment

string

No

Comment for the archival value.

regularsafeguardperiod

integer

No

Safeguard period in years — the time period for which the fileplan entry is retained in the archive.

objsecsecurity

array of string

No

List of users granted admin/security rights on the fileplan entry. Each entry can be the COO address (id), email address, or externalkey of a user.

objsecchange

array of string

No

List of users granted change access. Same identifier rules as objsecsecurity.

objsecread

array of string

No

List of users granted read access. Same identifier rules as objsecsecurity.

Responses

201 — Successful operation

Field

Type

Required

Description

id

string

No¹

COO address of the newly created fileplan entry.

externalkey

string

No²

External key of the newly created fileplan entry, if one was supplied.

name

string

No¹

German name of the fileplan entry.

¹ Not marked as required in the schema, but the server always populates this field.  ² Not marked as required in the schema; the server always includes this field, but its value can be null.

400 — User error

Field

Type

Required

Description

type

string

No¹

Identifier of the error type, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

status

integer

No¹

HTTP status code, repeated in the body.

errors

array of error segments

No¹

One entry per individual validation problem — see the errors[] table below.

¹ Not marked as required in the schema, but the server always populates this field.

Each entry of errors[] has the following fields:

Field

Type

Required

Description

detail

string

No¹

Human-readable explanation of this specific validation error.

pointer

string

No¹

JSON Pointer (e.g. #/name) identifying which request field the error refers to.

¹ Not marked as required in the schema, but the server always populates this field.

500 — Server error

Field

Type

Required

Description

type

string

No¹

Identifier of the error, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

detail

string

No¹

Detailed explanation of the error.

status

integer

No¹

HTTP status code, repeated in the body.

¹ Not marked as required in the schema, but the server always populates this field.

Python Example

Python example

import requests

url = f"{BASE_URL}/{SERVICE_COO}/fileplanentries"

payload = {

    "title": "Gemeinderat",

    "primaryrelated": "COO.1.30000.1.3662",

    "description": "Sitzungen und Beschluesse des Gemeinderats",

    "classification": "CONFIDENTIAL",

    "disclosurestatus": "PRIVATE",

}

response = requests.post(url, json=payload, auth=AUTH)

print(response.status_code)

print(response.json())

Java Example

Java example

import java.net.URI;

import java.net.http.*;

import java.util.Base64;

String auth = Base64.getEncoder().encodeToString((AUTH_USER + ":" + AUTH_PASSWORD).getBytes());

String body = """

    {

      "title": "Gemeinderat",

      "primaryrelated": "COO.1.30000.1.3662",

      "description": "Sitzungen und Beschluesse des Gemeinderats",

      "classification": "CONFIDENTIAL",

      "disclosurestatus": "PRIVATE"

    }

    """;

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()

    .uri(URI.create(BASE_URL + "/" + SERVICE_COO + "/fileplanentries"))

    .header("Authorization", "Basic " + auth)

    .header("Content-Type", "application/json")

    .POST(HttpRequest.BodyPublishers.ofString(body))

    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode());

System.out.println(response.body());

DELETE /fileplanentries/{fpeId}Permanent link for this heading

Deletes a fileplan entry or fileplan entry room. Only empty fileplan entries and fileplan entry rooms — i.e. ones without children — can be deleted.

Parameters

Name

In

Required

Type

Description

fpeId (COO address)

path

Yes

string

COO address of a fileplan entry (room), e.g. COO.1.30000.1.1234. COO addresses are always unique on the system.

fpeId (externalkey)

path

Yes

string

Externalkey of a fileplan entry (room), e.g. cf14d3a0-72ba-45f4-8814-3035d5608708. Externalkeys are not guaranteed to be unique on the system.

Responses

204 — Successful operation

No response body.

400 — The fileplan entry (room) has child objects and cannot be deleted

Field

Type

Required

Description

type

string

No¹

Identifier of the error, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

detail

string

No¹

Detailed explanation of the error.

status

integer

No¹

HTTP status code, repeated in the body.

¹ Not marked as required in the schema, but the server always populates this field.

403 — Forbidden operation

Same GWSError structure as described above for this operation — see that table for the field explanations.

404 — No fileplan entry (room) was found

Same GWSError structure as described above for this operation — see that table for the field explanations.

Python Example

Python example

import requests

fpe_id = "COO.1.30000.1.1234"  # COO address or externalkey of a fileplan entry (room)

url = f"{BASE_URL}/{SERVICE_COO}/fileplanentries/{fpe_id}"

response = requests.delete(url, auth=AUTH)

print(response.status_code)

Java Example

Java example

import java.net.URI;

import java.net.http.*;

import java.util.Base64;

String auth = Base64.getEncoder().encodeToString((AUTH_USER + ":" + AUTH_PASSWORD).getBytes());

String fpeId = "COO.1.30000.1.1234"; // COO address or externalkey of a fileplan entry (room)

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()

    .uri(URI.create(BASE_URL + "/" + SERVICE_COO + "/fileplanentries/" + fpeId))

    .header("Authorization", "Basic " + auth)

    .DELETE()

    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode());

GET /fileplanentries/{fpeId}Permanent link for this heading

Returns a single fileplan entry.

Parameters

Name

In

Required

Type

Description

fpeId (COO address)

path

Yes

string

COO address of a fileplan entry, e.g. COO.1.30000.1.1234. COO addresses are always unique on the system.

fpeId (externalkey)

path

Yes

string

Externalkey of a fileplan entry, e.g. cf14d3a0-72ba-45f4-8814-3035d5608708. Externalkeys are not guaranteed to be unique on the system.

Responses

200 — Successful operation

name and description are multilingual objects: keys are ISO 639-1 language codes (e.g. de-ch, fr) and values are the translated strings. Which languages are present depends on the data in the system — the API does not guarantee a fixed set of languages.

Field

Type

Required

Description

id

string

No¹

Unique identifier (COO address) of the fileplan entry.

externalkey

string

No¹

Externalkey of the fileplan entry.

name

object

No¹

Translated name — see the multilingual note above.

description

object

No¹

Translated description — see the multilingual note above.

validfrom

string (date-time)

No²

Start of the validity period. Plain ISO 8601 string with millisecond precision and an explicit UTC offset, e.g. 2000-01-23T04:56:07.000+00:00. Can be null.

validto

string (date-time)

No²

End of the validity period. Same format as validfrom. Can be null.

primaryrelated

string

No¹

COO address of the parent object (either a fileplan or fileplan entry).

dossiers

array of string

No¹

COO addresses of child dossiers. Mutually exclusive with fileplanentries — a fileplan entry has either dossiers or child fileplan entries, not both.

fileplanentries

array of string

No¹

COO addresses of child fileplan entries. Mutually exclusive with dossiers.

businessnumber

string

No¹

Business number of the fileplan entry, e.g. 3.1.

location

string

No¹

Physical or organisational location of the fileplan entry, e.g. Archiv Bern.

responsible

object

No¹

The object responsible for the fileplan entry — see the responsible table below.

sequencenumber

integer

No¹

Current sequence number of the fileplan entry.

classification

string

No¹

Classification of the fileplan entry. See the allowed values listed under POST /fileplanentries → Request Body → `classification`.

privacyprotection

boolean

No¹

Whether the fileplan entry is privacy protected.

disclosurestatus

string

No¹

Status of the disclosure. See the allowed values listed under POST /fileplanentries → Request Body → `disclosurestatus`.

disclosurestatusstatement

string

No¹

Statement for the disclosure status.

retentionperiod

integer

No¹

Retention period in years.

retentionperiodcomment

string

No¹

Comment for the retention period.

archivalvalue

string

No¹

Decision whether the fileplan entry is predestined to be archived. See the allowed values listed under POST /fileplanentries → Request Body → `archivalvalue`.

archivalvaluecomment

string

No¹

Comment for the archival value.

regularsafeguardperiod

integer

No¹

Time period (in years) for which the fileplan entry is retained in the archive.

changedby

string

No¹

COO address of the user who last edited the fileplan entry.

modifiedat

string (date-time)

No²

Last modified timestamp. Same ISO 8601 format as validfrom, e.g. 2000-01-23T04:56:07.000+00:00. Can be null.

createdby

string

No¹

COO address of the user who created the fileplan entry.

createdat

string (date-time)

No²

Creation timestamp. Same ISO 8601 format as validfrom. Can be null.

administrators

array of string

No¹

COO addresses of users with admin rights on the fileplan entry.

changeaccess

array of string

No¹

COO addresses of users with change access.

readaccess

array of string

No¹

COO addresses of users with read access.

¹ Not marked as required in the schema, but the server always populates this field.  ² Not marked as required in the schema; the server always includes this field, but its value can be null.

responsible has the following fields:

Field

Type

Required

Description

name

string

No¹

Display name of the responsible object.

id

string

No¹

COO address of the responsible object.

¹ Not marked as required in the schema, but the server always populates this field.

404 — No fileplan entry was found

Field

Type

Required

Description

type

string

No¹

Identifier of the error, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

detail

string

No¹

Detailed explanation of the error.

status

integer

No¹

HTTP status code, repeated in the body.

¹ Not marked as required in the schema, but the server always populates this field.

Python Example

Python example

import requests

fpe_id = "COO.1.30000.1.1234"  # COO address or externalkey of a fileplan entry

url = f"{BASE_URL}/{SERVICE_COO}/fileplanentries/{fpe_id}"

response = requests.get(url, auth=AUTH)

print(response.status_code)

print(response.json())

Java Example

Java example

import java.net.URI;

import java.net.http.*;

import java.util.Base64;

String auth = Base64.getEncoder().encodeToString((AUTH_USER + ":" + AUTH_PASSWORD).getBytes());

String fpeId = "COO.1.30000.1.1234"; // COO address or externalkey of a fileplan entry

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()

    .uri(URI.create(BASE_URL + "/" + SERVICE_COO + "/fileplanentries/" + fpeId))

    .header("Authorization", "Basic " + auth)

    .GET()

    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode());

System.out.println(response.body());

POST /fileplanentries/{fpeId}Permanent link for this heading

Updates an existing fileplan entry.

Parameters

Name

In

Required

Type

Description

fpeId (COO address)

path

Yes

string

COO address of a fileplan entry, e.g. COO.1.30000.1.1234. COO addresses are always unique on the system.

fpeId (externalkey)

path

Yes

string

Externalkey of a fileplan entry, e.g. cf14d3a0-72ba-45f4-8814-3035d5608708. Externalkeys are not guaranteed to be unique on the system.

Request Body

The request body has the following field:

Field

Type

Required

Description

name

string

No

Title of the fileplan entry (room). Language is chosen by the requester's set Fabasphere language. Default value __empty__ — if this field is omitted (or explicitly sent as __empty__), the server treats it as if no value was provided, and the fileplan entry's name is left unchanged.

Responses

204 — Successful operation

No response body.

400 — Invalid data in the request body

Field

Type

Required

Description

type

string

No¹

Identifier of the error type, e.g. invalid-request-body.

title

string

No¹

Short summary of the error.

detail

string

No¹

Detailed explanation of the error.

status

integer

No¹

HTTP status code, repeated in the body.

errors

array of error segments

No¹

One entry per individual validation problem — see the errors[] table below.

¹ Not marked as required in the schema, but the server always populates this field.

Each entry of errors[] has the following fields:

Field

Type

Required

Description

detail

string

No¹

Human-readable explanation of this specific validation error.

pointer

string

No¹

JSON Pointer (e.g. #/name) identifying which request field the error refers to.

¹ Not marked as required in the schema, but the server always populates this field.

404 — No fileplan entry (room) was found

Same GWSResponseError structure as described above for this operation — see that table for the field explanations.

500 — Unexpected server-side error

Same GWSResponseError structure as described above for this operation — see that table for the field explanations.


Python Example

Python example

import requests

fpe_id = "COO.1.30000.1.1234"  # COO address or externalkey of a fileplan entry (room)

url = f"{BASE_URL}/{SERVICE_COO}/fileplanentries/{fpe_id}"

response = requests.post(url, json={"name": "Gemeinderat (aktualisiert)"}, auth=AUTH)

print(response.status_code)

Java Example

Java example

import java.net.URI;

import java.net.http.*;

import java.util.Base64;

String auth = Base64.getEncoder().encodeToString((AUTH_USER + ":" + AUTH_PASSWORD).getBytes());

String fpeId = "COO.1.30000.1.1234"; // COO address or externalkey of a fileplan entry (room)

String body = """

    {"name": "Gemeinderat (aktualisiert)"}

    """;

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()

    .uri(URI.create(BASE_URL + "/" + SERVICE_COO + "/fileplanentries/" + fpeId))

    .header("Authorization", "Basic " + auth)

    .header("Content-Type", "application/json")

    .POST(HttpRequest.BodyPublishers.ofString(body))

    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode());