JWT ApiAccess

Creates a new MqttToken as a super admin

GET/api/base/api_token/create_mqtt_jwt

Query parameters

`allowedPath`requiredstring	allowed path
`validSeconds`number	number of seconds in the future. 31536000

Responses

200Creates a new MqttToken as a super adminSession

Show fields (15)

idinteger
Primary key of the session. Internal ID.
sessionidstring
ID of the session.
selectedcustomerCustomerProfile
Customer profile selected in the session.
Show fields (6)
- idinteger
  Primary key of the customer profile. Internal ID.
- slackchannelstring
  Slack channel of the customer profile.
- displaynamestring
  Name shown for the customer profile.
- deletedboolean
  Whether the customer profile is deleted.
- createdstring (date-time)
  Point in time the entity was created.
- updatedstring (date-time)
  Point in time the entity was last updated.
startstring (date-time)
Point in time the session started.
refreshed_startstring (date-time)
Point in time the session was last refreshed.
ipstring
IP address of the client.
validboolean
Whether the session is valid.
is_api_keyboolean
Whether the session was created with an API key.
is_dgboolean
Whether the session is for the DG (member organization) context.
missing2faboolean
Whether two-factor authentication is still missing.
start_in_vpnboolean
Whether the session started in a VPN.
auth_by_credentialsboolean
Whether the session was authenticated with user name and password.
auth_by_googleboolean
Whether the session was authenticated with Google.
auth_by_microsoftboolean
Whether the session was authenticated with Microsoft.
auth_by_cloudflareboolean
Whether the session was authenticated with Cloudflare Access.

Request

curl --request GET \
  --url 'https://your-instance.iw-erp.de/api/base/api_token/create_mqtt_jwt?allowedPath=string' \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/base/api_token/create_mqtt_jwt?allowedPath=string', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/base/api_token/create_mqtt_jwt?allowedPath=string"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/base/api_token/create_mqtt_jwt?allowedPath=string', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/base/api_token/create_mqtt_jwt?allowedPath=string"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/base/api_token/create_mqtt_jwt?allowedPath=string")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/base/api_token/create_mqtt_jwt?allowedPath=string"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/api_access_token_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await ApiAccessTokenController.createMqttJwtAction();
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "sessionid": "string",
  "selectedcustomer": {
    "id": 42,
    "slackchannel": "string",
    "displayname": "string",
    "deleted": true,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  },
  "start": "2026-10-15T09:30:00+02:00",
  "refreshed_start": "2026-10-15T09:30:00+02:00",
  "ip": "string",
  "valid": true,
  "is_api_key": true,
  "is_dg": true,
  "missing2fa": true
}

Creates a new JWT Login Token

GET/api/base/api_token/create_jwt

Query parameters

`scopes`string	comma seperated list of scopes
`allowedPath`string	allowed path
`allowedMethod`string	allowed path
`validSeconds`number	number of seconds in the future. 86400
`maxUserAccessType`number	max user access type to add to jwt. 2 = write, 1 = edit, 0 = read
`extraShort`string	replace the algorithm part of the jwt with the default value to save 32 chars. true / false

Responses

200Creates a new JWT Login TokenSession

Show fields (15)

idinteger
Primary key of the session. Internal ID.
sessionidstring
ID of the session.
selectedcustomerCustomerProfile
Customer profile selected in the session.
Show fields (6)
- idinteger
  Primary key of the customer profile. Internal ID.
- slackchannelstring
  Slack channel of the customer profile.
- displaynamestring
  Name shown for the customer profile.
- deletedboolean
  Whether the customer profile is deleted.
- createdstring (date-time)
  Point in time the entity was created.
- updatedstring (date-time)
  Point in time the entity was last updated.
startstring (date-time)
Point in time the session started.
refreshed_startstring (date-time)
Point in time the session was last refreshed.
ipstring
IP address of the client.
validboolean
Whether the session is valid.
is_api_keyboolean
Whether the session was created with an API key.
is_dgboolean
Whether the session is for the DG (member organization) context.
missing2faboolean
Whether two-factor authentication is still missing.
start_in_vpnboolean
Whether the session started in a VPN.
auth_by_credentialsboolean
Whether the session was authenticated with user name and password.
auth_by_googleboolean
Whether the session was authenticated with Google.
auth_by_microsoftboolean
Whether the session was authenticated with Microsoft.
auth_by_cloudflareboolean
Whether the session was authenticated with Cloudflare Access.

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/base/api_token/create_jwt \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/base/api_token/create_jwt', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/base/api_token/create_jwt"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/base/api_token/create_jwt', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/base/api_token/create_jwt"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/base/api_token/create_jwt")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/base/api_token/create_jwt"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/api_access_token_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await ApiAccessTokenController.createJwtAction();
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "sessionid": "string",
  "selectedcustomer": {
    "id": 42,
    "slackchannel": "string",
    "displayname": "string",
    "deleted": true,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  },
  "start": "2026-10-15T09:30:00+02:00",
  "refreshed_start": "2026-10-15T09:30:00+02:00",
  "ip": "string",
  "valid": true,
  "is_api_key": true,
  "is_dg": true,
  "missing2fa": true
}

Returns a single ApiAccessToken entry.

GET/api/base/api_access_token/{id}

Path parameters

idrequiredstring

Responses

200Return single ApiAccessTokenApiAccessToken

Show fields (18)

idinteger
Primary key of the API access token. Internal ID.
allow_super_adminboolean
Token may use super admin rights. Only set when a super admin creates the token and requests allowSuperAdmin=true.
allow_adminboolean
Token may use admin rights.
allow_userboolean
Token may use regular user rights.
is_dgboolean
Session flag copied from the session that created the token.
tokenstring
Short access token. Returned when the token is created.
allowed_pathstring
Path the token may call. Restricts the token to API routes that start with this path.
allowed_methodsstring
HTTP methods the token may use, for example GET or POST.
rwe_scopestring
Read, write and edit scopes the token may use.
r_scopestring
Read scopes the token may use.
e_scopestring
Edit scopes the token may use.
w_scopestring
Write scopes the token may use.
scopesobject
List of scopes the token may use.
token_versionstring
Version of the token format. Used to invalidate old tokens.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.
namestring
Name of the entity.
deletedboolean
This property is used to mark an entity as deleted / archived

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/base/api_access_token/42 \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/base/api_access_token/42', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/base/api_access_token/42"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/base/api_access_token/42', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/base/api_access_token/42"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/base/api_access_token/42")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/base/api_access_token/42"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/api_access_token_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await ApiAccessTokenController.get('42');
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "name": "Beispiel",
  "allow_super_admin": true,
  "allow_admin": true,
  "allow_user": true,
  "is_dg": true,
  "token": "string",
  "allowed_path": "string",
  "allowed_methods": "string",
  "rwe_scope": "string"
}

Deletes a single ApiAccessToken entry.

DELETE/api/base/api_access_token/{id}

Path parameters

idrequiredstring

Responses

200Delete single ApiAccessTokenApiAccessToken

Show fields (18)

idinteger
Primary key of the API access token. Internal ID.
allow_super_adminboolean
Token may use super admin rights. Only set when a super admin creates the token and requests allowSuperAdmin=true.
allow_adminboolean
Token may use admin rights.
allow_userboolean
Token may use regular user rights.
is_dgboolean
Session flag copied from the session that created the token.
tokenstring
Short access token. Returned when the token is created.
allowed_pathstring
Path the token may call. Restricts the token to API routes that start with this path.
allowed_methodsstring
HTTP methods the token may use, for example GET or POST.
rwe_scopestring
Read, write and edit scopes the token may use.
r_scopestring
Read scopes the token may use.
e_scopestring
Edit scopes the token may use.
w_scopestring
Write scopes the token may use.
scopesobject
List of scopes the token may use.
token_versionstring
Version of the token format. Used to invalidate old tokens.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.
namestring
Name of the entity.
deletedboolean
This property is used to mark an entity as deleted / archived

Request

curl --request DELETE \
  --url https://your-instance.iw-erp.de/api/base/api_access_token/42 \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'DELETE', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/base/api_access_token/42', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/base/api_access_token/42"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.delete(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('DELETE', 'https://your-instance.iw-erp.de/api/base/api_access_token/42', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Delete,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/base/api_access_token/42"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/base/api_access_token/42")
  .delete(null)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/base/api_access_token/42"

	req, _ := http.NewRequest("DELETE", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/api_access_token_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await ApiAccessTokenController.delete('42');
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "name": "Beispiel",
  "allow_super_admin": true,
  "allow_admin": true,
  "allow_user": true,
  "is_dg": true,
  "token": "string",
  "allowed_path": "string",
  "allowed_methods": "string",
  "rwe_scope": "string"
}

Returns a list of own ApiAccessToken

GET/api/base/api_access_token

Query parameters

`searchString`string	text to search for in the list
`orderFieldName`string	name of the order field
`orderFieldSort`string	sorting modeAllowed: `DESCASC`
`page`integer	page of the list
`pageSize`integer	number of entries for each page
`withMaxPageNumber`string	returns the number of pages available as a header if this is set

Responses

200Returns a list of own ApiAccessTokenarray<ApiAccessToken>

Show fields (18)

idinteger
Primary key of the API access token. Internal ID.
allow_super_adminboolean
Token may use super admin rights. Only set when a super admin creates the token and requests allowSuperAdmin=true.
allow_adminboolean
Token may use admin rights.
allow_userboolean
Token may use regular user rights.
is_dgboolean
Session flag copied from the session that created the token.
tokenstring
Short access token. Returned when the token is created.
allowed_pathstring
Path the token may call. Restricts the token to API routes that start with this path.
allowed_methodsstring
HTTP methods the token may use, for example GET or POST.
rwe_scopestring
Read, write and edit scopes the token may use.
r_scopestring
Read scopes the token may use.
e_scopestring
Edit scopes the token may use.
w_scopestring
Write scopes the token may use.
scopesobject
List of scopes the token may use.
token_versionstring
Version of the token format. Used to invalidate old tokens.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.
namestring
Name of the entity.
deletedboolean
This property is used to mark an entity as deleted / archived

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/base/api_access_token \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/base/api_access_token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/base/api_access_token"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/base/api_access_token', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/base/api_access_token"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/base/api_access_token")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/base/api_access_token"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/api_access_token_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await ApiAccessTokenController.getAll();
if (result.success) {
  print(result.data);
}

Response 200 application/json

[
  {
    "id": 42,
    "name": "Beispiel",
    "allow_super_admin": true,
    "allow_admin": true,
    "allow_user": true,
    "is_dg": true,
    "token": "string",
    "allowed_path": "string",
    "allowed_methods": "string",
    "rwe_scope": "string"
  }
]

Test if the api access token is valid. Use mode=info to get token details, user info, and available scopes.

GET/api/base/api_access_token_test

Query parameters

modestring Set to 'info' to return token details, user info, and available scopes

Responses

200Returns true if the api access token is validSuccess

Show fields (3)

successboolean
messagestring
error_codesarray<integer>

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/base/api_access_token_test \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/base/api_access_token_test', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/base/api_access_token_test"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/base/api_access_token_test', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/base/api_access_token_test"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/base/api_access_token_test")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/base/api_access_token_test"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/api_access_token_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await ApiAccessTokenController.testApiToken();
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "success": true,
  "message": "string",
  "error_codes": [
    1
  ]
}

All MCP tools and API routes (PATCH/POST of api_patch/api_post) a filter can allow (for the management UI). alwaysAllowed tools are never filtered. Texts follow ?lang= / Accept-Language.

GET/api/opendata/mcp_access_filter_catalog

Responses

200tools: [{name, title, description, readOnly, alwaysAllowed}], api_routes: [{route, method, path, entity, summary}]

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_access_filter_catalog \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_access_filter_catalog', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter_catalog"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/opendata/mcp_access_filter_catalog', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter_catalog"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter_catalog")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter_catalog"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/mcp_access_filter_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await McpAccessFilterController.getCatalog();
if (result.success) {
  print(result.data);
}

Returns the MCP tool filters of the own API access tokens (filter with ?apiAccessToken=<id>)

GET/api/opendata/mcp_access_filter

Query parameters

`searchString`string	text to search for in the list
`orderFieldName`string	name of the order field
`orderFieldSort`string	sorting modeAllowed: `DESCASC`
`page`integer	page of the list
`pageSize`integer	number of entries for each page
`withMaxPageNumber`string	returns the number of pages available as a header if this is set

Responses

200Returns the MCP tool filters of the own API access tokensarray<McpAccessFilter>

Show fields (4)

api_access_tokeninteger
idinteger
Primary key of the access filter. Internal ID.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_access_filter \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_access_filter', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/opendata/mcp_access_filter', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/mcp_access_filter_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await McpAccessFilterController.getAll();
if (result.success) {
  print(result.data);
}

Response 200 application/json

[
  {
    "id": 42,
    "api_access_token": 1,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  }
]

Adds the MCP tool filter of an own API access token (one filter per token).

POST/api/opendata/mcp_access_filter

allowed_tools / allowed_api_routes: lists of names from the catalog, null = no limit.

Request body application/json

dataMcpAccessFilter
Show fields (4)
- api_access_tokeninteger
- idinteger
  Primary key of the access filter. Internal ID.
- createdstring (date-time)
  Point in time the entity was created.
- updatedstring (date-time)
  Point in time the entity was last updated.

Responses

200Adds the MCP tool filter of an API access tokenMcpAccessFilter

Show fields (4)

api_access_tokeninteger
idinteger
Primary key of the access filter. Internal ID.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request POST \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_access_filter \
  --header 'content-type: application/json' \
  --header 'x-iw-jwt-token: <TOKEN>' \
  --data '
{
  "data": {
    "id": 42,
    "api_access_token": 1,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  }
}
'

const options = {
  method: 'POST',
  headers: {'x-iw-jwt-token': '<TOKEN>', 'content-type': 'application/json'},
  body: JSON.stringify({
    data: {
      id: 42,
      api_access_token: 1,
      created: '2026-10-15T09:30:00+02:00',
      updated: '2026-10-15T09:30:00+02:00'
    }
  })
};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_access_filter', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter"

payload = { "data": {
    "id": 42,
    "api_access_token": 1,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  } }
headers = {
  "x-iw-jwt-token": "<TOKEN>",
  "content-type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://your-instance.iw-erp.de/api/opendata/mcp_access_filter', [
  'body' => '{"data":{"id":42,"api_access_token":1,"created":"2026-10-15T09:30:00+02:00","updated":"2026-10-15T09:30:00+02:00"}}',
  'headers' => [
    'content-type' => 'application/json',
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Post,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
  Content = new StringContent("{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}")
  {
    Headers =
    {
      ContentType = new MediaTypeHeaderValue("application/json")
    }
  }
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}");
Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter")
  .post(body)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .addHeader("content-type", "application/json")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter"

	payload := strings.NewReader("{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")
	req.Header.Add("content-type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/mcp_access_filter_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';
import 'package:iw_erp_api/model/mcp_access_filter.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await McpAccessFilterController.post(McpAccessFilter.fromJson({
  "id": 42,
  "api_access_token": 1,
  "created": "2026-10-15T09:30:00+02:00",
  "updated": "2026-10-15T09:30:00+02:00"
}));
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "api_access_token": 1,
  "created": "2026-10-15T09:30:00+02:00",
  "updated": "2026-10-15T09:30:00+02:00"
}

Returns a single MCP tool filter of an own API access token

GET/api/opendata/mcp_access_filter/{identifier}

Path parameters

identifierrequiredstring

Responses

200Returns a single MCP tool filterMcpAccessFilter

Show fields (4)

api_access_tokeninteger
idinteger
Primary key of the access filter. Internal ID.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42 \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/mcp_access_filter_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await McpAccessFilterController.get('42');
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "api_access_token": 1,
  "created": "2026-10-15T09:30:00+02:00",
  "updated": "2026-10-15T09:30:00+02:00"
}

Changes the MCP tool filter of an own API access token (PATCH: only the fields sent)

PUT/api/opendata/mcp_access_filter/{identifier}

Path parameters

identifierrequiredstring

Request body application/json

dataMcpAccessFilter
Show fields (4)
- api_access_tokeninteger
- idinteger
  Primary key of the access filter. Internal ID.
- createdstring (date-time)
  Point in time the entity was created.
- updatedstring (date-time)
  Point in time the entity was last updated.

Responses

200Changes the MCP tool filter of an API access tokenMcpAccessFilter

Show fields (4)

api_access_tokeninteger
idinteger
Primary key of the access filter. Internal ID.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request PUT \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42 \
  --header 'content-type: application/json' \
  --header 'x-iw-jwt-token: <TOKEN>' \
  --data '
{
  "data": {
    "id": 42,
    "api_access_token": 1,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  }
}
'

const options = {
  method: 'PUT',
  headers: {'x-iw-jwt-token': '<TOKEN>', 'content-type': 'application/json'},
  body: JSON.stringify({
    data: {
      id: 42,
      api_access_token: 1,
      created: '2026-10-15T09:30:00+02:00',
      updated: '2026-10-15T09:30:00+02:00'
    }
  })
};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"

payload = { "data": {
    "id": 42,
    "api_access_token": 1,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  } }
headers = {
  "x-iw-jwt-token": "<TOKEN>",
  "content-type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PUT', 'https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42', [
  'body' => '{"data":{"id":42,"api_access_token":1,"created":"2026-10-15T09:30:00+02:00","updated":"2026-10-15T09:30:00+02:00"}}',
  'headers' => [
    'content-type' => 'application/json',
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Put,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
  Content = new StringContent("{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}")
  {
    Headers =
    {
      ContentType = new MediaTypeHeaderValue("application/json")
    }
  }
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}");
Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42")
  .put(body)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .addHeader("content-type", "application/json")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"

	payload := strings.NewReader("{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")
	req.Header.Add("content-type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/mcp_access_filter_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';
import 'package:iw_erp_api/model/mcp_access_filter.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await McpAccessFilterController.put(McpAccessFilter.fromJson({
  "id": 42,
  "api_access_token": 1,
  "created": "2026-10-15T09:30:00+02:00",
  "updated": "2026-10-15T09:30:00+02:00"
}));
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "api_access_token": 1,
  "created": "2026-10-15T09:30:00+02:00",
  "updated": "2026-10-15T09:30:00+02:00"
}

Changes the MCP tool filter of an own API access token (PATCH: only the fields sent)

PATCH/api/opendata/mcp_access_filter/{identifier}

Path parameters

identifierrequiredstring

Request body application/json

dataMcpAccessFilter
Show fields (4)
- api_access_tokeninteger
- idinteger
  Primary key of the access filter. Internal ID.
- createdstring (date-time)
  Point in time the entity was created.
- updatedstring (date-time)
  Point in time the entity was last updated.

Responses

200Changes the MCP tool filter of an API access tokenMcpAccessFilter

Show fields (4)

api_access_tokeninteger
idinteger
Primary key of the access filter. Internal ID.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request PATCH \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42 \
  --header 'content-type: application/json' \
  --header 'x-iw-jwt-token: <TOKEN>' \
  --data '
{
  "data": {
    "id": 42,
    "api_access_token": 1,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  }
}
'

const options = {
  method: 'PATCH',
  headers: {'x-iw-jwt-token': '<TOKEN>', 'content-type': 'application/json'},
  body: JSON.stringify({
    data: {
      id: 42,
      api_access_token: 1,
      created: '2026-10-15T09:30:00+02:00',
      updated: '2026-10-15T09:30:00+02:00'
    }
  })
};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"

payload = { "data": {
    "id": 42,
    "api_access_token": 1,
    "created": "2026-10-15T09:30:00+02:00",
    "updated": "2026-10-15T09:30:00+02:00"
  } }
headers = {
  "x-iw-jwt-token": "<TOKEN>",
  "content-type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42', [
  'body' => '{"data":{"id":42,"api_access_token":1,"created":"2026-10-15T09:30:00+02:00","updated":"2026-10-15T09:30:00+02:00"}}',
  'headers' => [
    'content-type' => 'application/json',
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Patch,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
  Content = new StringContent("{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}")
  {
    Headers =
    {
      ContentType = new MediaTypeHeaderValue("application/json")
    }
  }
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}");
Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42")
  .patch(body)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .addHeader("content-type", "application/json")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"

	payload := strings.NewReader("{\"data\":{\"id\":42,\"api_access_token\":1,\"created\":\"2026-10-15T09:30:00+02:00\",\"updated\":\"2026-10-15T09:30:00+02:00\"}}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")
	req.Header.Add("content-type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with package:http (no controller in the iw_erp_api package)

import 'dart:convert';
import 'package:http/http.dart' as http;

final response = await http.patch(
  Uri.parse('https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42'),
  headers: {'x-iw-jwt-token': '<TOKEN>', 'content-type': 'application/json'},
  body: jsonEncode({
    "data": {
      "id": 42,
      "api_access_token": 1,
      "created": "2026-10-15T09:30:00+02:00",
      "updated": "2026-10-15T09:30:00+02:00"
    }
  }),
);
print(response.body);

Response 200 application/json

{
  "id": 42,
  "api_access_token": 1,
  "created": "2026-10-15T09:30:00+02:00",
  "updated": "2026-10-15T09:30:00+02:00"
}

Removes the MCP tool filter of an own API access token (the token may then use all tools again)

DELETE/api/opendata/mcp_access_filter/{identifier}

Path parameters

identifierrequiredstring

Responses

200Removes the MCP tool filter of an API access tokenMcpAccessFilter

Show fields (4)

api_access_tokeninteger
idinteger
Primary key of the access filter. Internal ID.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request DELETE \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42 \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'DELETE', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.delete(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('DELETE', 'https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Delete,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42")
  .delete(null)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_access_filter/42"

	req, _ := http.NewRequest("DELETE", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/mcp_access_filter_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await McpAccessFilterController.delete('42');
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "api_access_token": 1,
  "created": "2026-10-15T09:30:00+02:00",
  "updated": "2026-10-15T09:30:00+02:00"
}

Returns the visible approval requests, newest first (?status=pending,failed&actionType=&page=&pageSize=).

GET/api/opendata/mcp_approval_request

Response headers X-IW-MAX-RESULTS / X-IW-MAX-PAGES carry the totals.

Query parameters

`searchString`string	text to search for in the list
`orderFieldName`string	name of the order field
`orderFieldSort`string	sorting modeAllowed: `DESCASC`
`page`integer	page of the list
`pageSize`integer	number of entries for each page
`withMaxPageNumber`string	returns the number of pages available as a header if this is set

Responses

200Returns the visible approval requests of AI agentsarray<McpApprovalRequest>

Show fields (20)

idinteger
Primary key of the approval request. Internal ID.
statusstring
Status of the request: pending, approved, executed, failed, rejected, cancelled or expired.
action_typestring
Action type from the static MCP approval action map.
titlestring
Short summary written by the server, not by the agent.
reasonstring
Justification given by the agent. Untrusted text. Show it as plain text only.
target_classstring
Short class name of the main record, e.g. crm_person.
target_idinteger
ID of the main record.
requested_by_user_idinteger
ID of the user who requested the action.
requested_bystring
Name of the user who requested the action.
requested_auth_typestring
How the requester logged in.
requested_clientstring
Client that made the request.
expires_atstring (date-time)
Point in time after which the request expires.
decided_by_user_idinteger
ID of the user who approved or rejected the request.
decided_bystring
Name of the user who approved or rejected the request.
decided_atstring (date-time)
Point in time of the decision.
decision_commentstring
Comment given with the decision.
executed_atstring (date-time)
Point in time the action was executed.
error_messagestring
Error message if the execution failed.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_approval_request \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_approval_request', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/opendata/mcp_approval_request', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/mcp_approval_request_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await McpApprovalRequestController.getAll();
if (result.success) {
  print(result.data);
}

Response 200 application/json

[
  {
    "id": 42,
    "title": "Beispiel",
    "decision_comment": "Text",
    "status": "string",
    "action_type": "string",
    "reason": "string",
    "target_class": "string",
    "target_id": 42,
    "requested_by_user_id": 42,
    "requested_by": "string"
  }
]

Returns one approval request with preview, payload, decision and result

GET/api/opendata/mcp_approval_request/{identifier}

Path parameters

identifierrequiredstring

Responses

200Returns one approval requestMcpApprovalRequest

Show fields (20)

idinteger
Primary key of the approval request. Internal ID.
statusstring
Status of the request: pending, approved, executed, failed, rejected, cancelled or expired.
action_typestring
Action type from the static MCP approval action map.
titlestring
Short summary written by the server, not by the agent.
reasonstring
Justification given by the agent. Untrusted text. Show it as plain text only.
target_classstring
Short class name of the main record, e.g. crm_person.
target_idinteger
ID of the main record.
requested_by_user_idinteger
ID of the user who requested the action.
requested_bystring
Name of the user who requested the action.
requested_auth_typestring
How the requester logged in.
requested_clientstring
Client that made the request.
expires_atstring (date-time)
Point in time after which the request expires.
decided_by_user_idinteger
ID of the user who approved or rejected the request.
decided_bystring
Name of the user who approved or rejected the request.
decided_atstring (date-time)
Point in time of the decision.
decision_commentstring
Comment given with the decision.
executed_atstring (date-time)
Point in time the action was executed.
error_messagestring
Error message if the execution failed.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42 \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with the iw_erp_api package

import 'package:iw_erp_api/clients/mcp_approval_request_controller.dart';
import 'package:iw_erp_api/logic/iw_api_state.dart';

IwApiState().host = 'your-instance.iw-erp.de';
IwApiState().currentJwtApiToken = '<TOKEN>';

final result = await McpApprovalRequestController.get('42');
if (result.success) {
  print(result.data);
}

Response 200 application/json

{
  "id": 42,
  "title": "Beispiel",
  "decision_comment": "Text",
  "status": "string",
  "action_type": "string",
  "reason": "string",
  "target_class": "string",
  "target_id": 42,
  "requested_by_user_id": 42,
  "requested_by": "string"
}

Approves the request and runs the action with the caller's rights. Only for people logged in to the ERP (x-session-token header). Body: {"comment": "..."} (optional). The response is the request with status executed (result) or failed (error_message); a failed action saved nothing.

POST/api/opendata/mcp_approval_request/{identifier}/approve

Path parameters

identifierrequiredstring

Responses

200Approves and runs an approval requestMcpApprovalRequest

Show fields (20)

idinteger
Primary key of the approval request. Internal ID.
statusstring
Status of the request: pending, approved, executed, failed, rejected, cancelled or expired.
action_typestring
Action type from the static MCP approval action map.
titlestring
Short summary written by the server, not by the agent.
reasonstring
Justification given by the agent. Untrusted text. Show it as plain text only.
target_classstring
Short class name of the main record, e.g. crm_person.
target_idinteger
ID of the main record.
requested_by_user_idinteger
ID of the user who requested the action.
requested_bystring
Name of the user who requested the action.
requested_auth_typestring
How the requester logged in.
requested_clientstring
Client that made the request.
expires_atstring (date-time)
Point in time after which the request expires.
decided_by_user_idinteger
ID of the user who approved or rejected the request.
decided_bystring
Name of the user who approved or rejected the request.
decided_atstring (date-time)
Point in time of the decision.
decision_commentstring
Comment given with the decision.
executed_atstring (date-time)
Point in time the action was executed.
error_messagestring
Error message if the execution failed.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request POST \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/approve \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'POST', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/approve', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/approve"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.post(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/approve', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Post,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/approve"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/approve")
  .post(null)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/approve"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with package:http (no controller in the iw_erp_api package)

import 'package:http/http.dart' as http;

final response = await http.post(
  Uri.parse('https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/approve'),
  headers: {'x-iw-jwt-token': '<TOKEN>'},
);
print(response.body);

Response 200 application/json

{
  "id": 42,
  "title": "Beispiel",
  "decision_comment": "Text",
  "status": "string",
  "action_type": "string",
  "reason": "string",
  "target_class": "string",
  "target_id": 42,
  "requested_by_user_id": 42,
  "requested_by": "string"
}

Rejects the request; nothing runs. Only for people logged in to the ERP (x-session-token header).

POST/api/opendata/mcp_approval_request/{identifier}/reject

Body: {"comment": "..."} (optional, the agent sees it).

Path parameters

identifierrequiredstring

Responses

200Rejects an approval requestMcpApprovalRequest

Show fields (20)

idinteger
Primary key of the approval request. Internal ID.
statusstring
Status of the request: pending, approved, executed, failed, rejected, cancelled or expired.
action_typestring
Action type from the static MCP approval action map.
titlestring
Short summary written by the server, not by the agent.
reasonstring
Justification given by the agent. Untrusted text. Show it as plain text only.
target_classstring
Short class name of the main record, e.g. crm_person.
target_idinteger
ID of the main record.
requested_by_user_idinteger
ID of the user who requested the action.
requested_bystring
Name of the user who requested the action.
requested_auth_typestring
How the requester logged in.
requested_clientstring
Client that made the request.
expires_atstring (date-time)
Point in time after which the request expires.
decided_by_user_idinteger
ID of the user who approved or rejected the request.
decided_bystring
Name of the user who approved or rejected the request.
decided_atstring (date-time)
Point in time of the decision.
decision_commentstring
Comment given with the decision.
executed_atstring (date-time)
Point in time the action was executed.
error_messagestring
Error message if the execution failed.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request POST \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/reject \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'POST', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/reject', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/reject"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.post(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/reject', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Post,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/reject"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/reject")
  .post(null)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/reject"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with package:http (no controller in the iw_erp_api package)

import 'package:http/http.dart' as http;

final response = await http.post(
  Uri.parse('https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/reject'),
  headers: {'x-iw-jwt-token': '<TOKEN>'},
);
print(response.body);

Response 200 application/json

{
  "id": 42,
  "title": "Beispiel",
  "decision_comment": "Text",
  "status": "string",
  "action_type": "string",
  "reason": "string",
  "target_class": "string",
  "target_id": 42,
  "requested_by_user_id": 42,
  "requested_by": "string"
}

Withdraws a pending request; only the login (user) that proposed it.

POST/api/opendata/mcp_approval_request/{identifier}/cancel

Path parameters

identifierrequiredstring

Responses

200Withdraws an own pending approval requestMcpApprovalRequest

Show fields (20)

idinteger
Primary key of the approval request. Internal ID.
statusstring
Status of the request: pending, approved, executed, failed, rejected, cancelled or expired.
action_typestring
Action type from the static MCP approval action map.
titlestring
Short summary written by the server, not by the agent.
reasonstring
Justification given by the agent. Untrusted text. Show it as plain text only.
target_classstring
Short class name of the main record, e.g. crm_person.
target_idinteger
ID of the main record.
requested_by_user_idinteger
ID of the user who requested the action.
requested_bystring
Name of the user who requested the action.
requested_auth_typestring
How the requester logged in.
requested_clientstring
Client that made the request.
expires_atstring (date-time)
Point in time after which the request expires.
decided_by_user_idinteger
ID of the user who approved or rejected the request.
decided_bystring
Name of the user who approved or rejected the request.
decided_atstring (date-time)
Point in time of the decision.
decision_commentstring
Comment given with the decision.
executed_atstring (date-time)
Point in time the action was executed.
error_messagestring
Error message if the execution failed.
createdstring (date-time)
Point in time the entity was created.
updatedstring (date-time)
Point in time the entity was last updated.

Request

curl --request POST \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/cancel \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'POST', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/cancel', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/cancel"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.post(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/cancel', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Post,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/cancel"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/cancel")
  .post(null)
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/cancel"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with package:http (no controller in the iw_erp_api package)

import 'package:http/http.dart' as http;

final response = await http.post(
  Uri.parse('https://your-instance.iw-erp.de/api/opendata/mcp_approval_request/42/cancel'),
  headers: {'x-iw-jwt-token': '<TOKEN>'},
);
print(response.body);

Response 200 application/json

{
  "id": 42,
  "title": "Beispiel",
  "decision_comment": "Text",
  "status": "string",
  "action_type": "string",
  "reason": "string",
  "target_class": "string",
  "target_id": 42,
  "requested_by_user_id": 42,
  "requested_by": "string"
}

Returns the MCP tool calls, newest first (?toolName=&userId=&outcome=ok|error|denied&approvalRequest=&from=&to=&page=&pageSize=).

GET/api/opendata/mcp_tool_call_log

Response headers X-IW-MAX-RESULTS / X-IW-MAX-PAGES carry the totals.

Query parameters

`searchString`string	text to search for in the list
`orderFieldName`string	name of the order field
`orderFieldSort`string	sorting modeAllowed: `DESCASC`
`page`integer	page of the list
`pageSize`integer	number of entries for each page
`withMaxPageNumber`string	returns the number of pages available as a header if this is set

Responses

200Returns the audit trail of the MCP serverarray<McpToolCallLog>

Show fields (15)

idinteger
Primary key of the log entry. Internal ID.
createdstring (date-time)
Point in time of the tool call.
tool_namestring
Name of the called MCP tool.
outcomestring
Outcome of the call: ok, error or denied.
writingboolean
Whether the tool can change data, i.e. it is not read-only. Null for unknown tools.
user_idinteger
ID of the calling user.
user_stringstring
Display name of the calling user.
auth_typestring
How the caller logged in: anonymous, public, session, api_token, oauth or sso_durable.
api_access_token_idinteger
ID of the API access token used for the call.
oauth_clientstring
Identifier of the OAuth client used for the call.
client_namestring
Name of the client used for the call.
client_ipstring
IP address of the caller.
error_messagestring
Error message if the call failed.
duration_msinteger
Duration of the call in milliseconds.
approval_request_idinteger
ID of the approval request created by the call, if any.

Request

curl --request GET \
  --url https://your-instance.iw-erp.de/api/opendata/mcp_tool_call_log \
  --header 'x-iw-jwt-token: <TOKEN>'

const options = {method: 'GET', headers: {'x-iw-jwt-token': '<TOKEN>'}};

fetch('https://your-instance.iw-erp.de/api/opendata/mcp_tool_call_log', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://your-instance.iw-erp.de/api/opendata/mcp_tool_call_log"

headers = {"x-iw-jwt-token": "<TOKEN>"}

response = requests.get(url, headers=headers)

print(response.text)

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://your-instance.iw-erp.de/api/opendata/mcp_tool_call_log', [
  'headers' => [
    'x-iw-jwt-token' => '<TOKEN>',
  ],
]);

echo $response->getBody();

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
  Method = HttpMethod.Get,
  RequestUri = new Uri("https://your-instance.iw-erp.de/api/opendata/mcp_tool_call_log"),
  Headers =
  {
    { "x-iw-jwt-token", "<TOKEN>" },
  },
};
using (var response = await client.SendAsync(request))
{
  response.EnsureSuccessStatusCode();
  var body = await response.Content.ReadAsStringAsync();
  Console.WriteLine(body);
}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://your-instance.iw-erp.de/api/opendata/mcp_tool_call_log")
  .get()
  .addHeader("x-iw-jwt-token", "<TOKEN>")
  .build();

Response response = client.newCall(request).execute();

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://your-instance.iw-erp.de/api/opendata/mcp_tool_call_log"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-iw-jwt-token", "<TOKEN>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

Dart with package:http (no controller in the iw_erp_api package)

import 'package:http/http.dart' as http;

final response = await http.get(
  Uri.parse('https://your-instance.iw-erp.de/api/opendata/mcp_tool_call_log'),
  headers: {'x-iw-jwt-token': '<TOKEN>'},
);
print(response.body);

Response 200 application/json

[
  {
    "id": 42,
    "tool_name": "Beispiel",
    "client_name": "Beispiel",
    "created": "2026-10-15T09:30:00+02:00",
    "outcome": "string",
    "writing": true,
    "user_id": 42,
    "user_string": "string",
    "auth_type": "string",
    "api_access_token_id": 42
  }
]