Skip to main content
The ACB exposes its functionality through a REST API at a single base URL, authenticated with a per-user Refresh Token that’s exchanged for short-lived Access Tokens. This page covers everything that’s shared across endpoints — base URL, authentication mechanics, status codes, rate limits. Per-endpoint detail lives on each endpoint page.
NOT AVAILABLE IN SAAS. ACB is on-premises only.

​
Base URL

All endpoints share the same base URL:
Replace <hostname> with the computer name where the ACB service is installed.
For ACB deployments updated from a version prior to 1.2, the URL prefix is EkranACB instead of SytecaACB. Use https://<hostname>/EkranACB/... exactly in scripts targeting those installs.

​
Authentication

ACB uses a two-step authentication model: a long-lived Refresh Token is exchanged for a short-lived Access Token, and the Access Token authenticates subsequent API calls.

​
1. Get the Refresh Token

The Refresh Token is generated per user in the Management Tool — see Set up user account for the procedure. Once you have it, store it securely (treat it like a password).

​
2. Exchange Refresh Token for Access Token

Call POST /SytecaACB/get_access_token with the Refresh Token in the JSON body. The response includes the Access Token and its expires_in lifetime (in seconds).

​
3. Use the Access Token on subsequent calls

The authentication mechanism differs between old and new endpoints:
​
string
(New endpoints only) The Access Token returned by get_access_token. Format: pass the raw token value as the header value.
When the Access Token expires (default: 600 seconds — see Authorization token lifetime), call get_access_token again with the same Refresh Token to get a new one. Refresh Tokens themselves only expire if the user’s external-app toggle is disabled.

​
Status codes

​
Rate limiting

Different endpoint groups have different rate limits. Exceeding the limit returns HTTP 429 Too Many Requests with a Retry-After header indicating when to retry.
Rate limits are evaluated per Access Token, which is per Refresh Token, which is per Management Tool user. Multiple parallel automation consumers sharing one user account share the same rate budget.

​
Endpoints

​
Old endpoints (pre-v1.3, still supported)

​
Folder endpoints

​
Secret endpoints

​
Bulk action

​
User Management and Admin Password Rotation

User Management endpoints (9) and Admin Password Rotation endpoints (2) — covered in Phase 2 of this batch, navigation links to come.

Overview

What the ACB API is and when to use it.

Data models

Schemas shared across request and response bodies.

Set up user account

Configure a user with the Refresh Token.

CLI reference

SytecaACBConsole.exe — command-line wrapper.