Lists the classes of one kind that are registered with this instance and a profile member can name, with the label the editor shows, whether the class is deprecated, and a link to its documentation page. The lists are the ones the editor offers and are instance-wide. For POST_PARSER and ENVIRONMENT_CHECK they are what a profile write accepts for the member. A write also accepts a class the instance configures but this list hides because it is deprecated while deprecated classes are disabled (PRE_PARSER, INTEGRATION_UNIT, and RESPONSE for a plain custom unit), and, for POST_EXECUTER, a pro post-executer or any class that loads as a post-executer. RESPONSE is what a custom response unit's customClass must name (a pro unit takes the pro ones among them); CUSTOM_CLASS and FILE_FILTER are the editor's lists, which a profile write does not check against. Classes are ordered by simple name. The documentation links come from the documentation index the instance holds in memory, so they are null until that index is loaded and never delay the answer. Requires the right to create or change profiles.
OAuth2 client-credentials flow for machine-to-machine access.
Exchange a client id/secret at /dw/register/oauth/token for a bearer token, then send it
as Authorization: Bearer <access_token>. Client credentials are provisioned in the
Lobster administration UI.
This is the client-credentials token endpoint of the Platform API. /oauth/token, the
token_endpoint advertised at /.well-known/oauth-authorization-server, serves the authorization
code flow of the OAuth2AuthorizationCode scheme.
OAuth 2.1 authorization code flow with PKCE, for acting as a signed-in user. It works with Microsoft and other single sign-on providers: the provider only confirms the user's identity to the platform, which then issues its own token.
POST /oauth/register(no authentication) with the JSON body{"redirect_uris": ["<redirect URI>"]}returns aclient_id. The user's browser has to reach the redirect URI.- Open
/oauth/authorizein the user's browser withresponse_type=code,client_id,redirect_uri,stateand acode_challengewithcode_challenge_method=S256.stateis a fresh unguessable value per request, andcode_challengeis the S256 hash of acode_verifierfreshly generated per request from a cryptographically secure random source (43 to 128 characters, RFC 7636). The user signs in on the platform's login page, and the browser is redirected to the redirect URI withcodeandstate; a callback whosestatediffers from the one sent is to be rejected. - The code is valid for 30 seconds. Exchange it at
POST /oauth/token, form-encoded, withgrant_type=authorization_code,code,redirect_uri,code_verifierandclient_id. - The answer carries
access_token(valid 30 minutes),refresh_token(valid 48 hours) andexpires_inin milliseconds. Refresh withgrant_type=refresh_token,refresh_tokenandclient_id.
Bearer token obtained from an authenticated browser or guest-user session.
Flow 1 — UI login: Log in via the Lobster web UI at /, then call
GET /auth/sessionBearerToken to exchange the session cookie for a bearer token.
Flow 2 — Guest user login token: Append a GuestUser loginToken as a URL
query parameter to the base URL to establish a password-free session:
GET <host>?loginToken=<GuestUser token>
Then call GET /auth/sessionBearerToken to obtain the bearer token.
The kind of class to list.
Classes returned.
Standard Platform API success envelope. Every response carries exactly one of data (success) or error (failure) at top level.
The classes of one kind registered with the instance. Read-only.
The type of this object, always core.ClassRegistry. Required where the member it is sent in accepts several types.
The registered classes, ordered by simple class name.
A class registered with the instance. Read-only.
The type of this object, always core.RegisteredClass. Required where the member it is sent in accepts several types.
The fully qualified class name, the value for the profile member.
Whether the class is marked deprecated; false where the kind has no such flag.
The label the editor shows for the class; the class name where the kind has no label. Not localised.
The documentation page of the class if the documentation has one, else the documentation's base URL. null only when both are unavailable.
The hint for the class's parameter, as the administrator curated it (German only). Only preparsers have one; null otherwise.
The base URL of the Lobster documentation, from the documentation index the instance holds in memory. null while that index is unavailable or its URL is unusable.
The kind the classes belong to.
kind is missing or not one of the listed values, or another query parameter was sent.
Authentication is required or the supplied credentials are invalid.
{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication is required to access this resource."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
The caller may neither create nor change profiles.
The requested resource does not exist. The code is resource-specific, e.g. PARTNER_NOT_FOUND, PROFILE_NOT_FOUND or CHANNEL_NOT_FOUND.
{
"error": {
"code": "PARTNER_NOT_FOUND",
"message": "Partner not found: 42"
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
An unexpected server error occurred.
{
"error": {
"code": "INTERNAL_ERROR",
"message": "An unexpected error occurred."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.