Content API overview

The Content API is the file content plane for the Boomi MFT (Automated File Transfer) platform. It handles the movement of file bytes, including single-shot and chunked (resumable) uploads, streamed, and presigned-URL downloads, and listing the files staged against a flow endpoint. Configuration of flows, endpoints, and credentials is managed by the MFT Management API.

Prerequisites

To use the Content API, you need an MFT account, a flow with at least one flow endpoint for uploads or downloads, and credentials that carry the privilege the operation requires. Every request goes to your account's regional host. For more information, refer to Base URL.

Authentication

The Content API accepts three types of credentials. Any one of them satisfies every non-anonymous operation:

• API key (ApiKey header): An API key is the usual choice for programmatic access. Create the key in the MFT portal, scope it to the Content API, and send its value in the ApiKey request header.
• OAuth 2.0 client credentials: Request a token from /oauth/token on the same regional host, then send it as Authorization: Bearer <token>. The MFT connector uses this method to authenticate.
• Session bearer token: The MFT portal sign-in endpoint issues a JSON Web Token (JWT), which you send as Authorization: Bearer <token>.

Required privileges

Authentication alone does not grant access. The credential must also carry the privilege that the operation requires. Uploading requires the File Upload privilege. Downloading, generating a presigned URL, and listing files require the File Download privilege. Each operation's documentation states its required privilege. Every request is also scoped to the caller's tenant, so a credential can only reach flow endpoints that its own account owns.

Redeeming a presigned download URL is the one exception. The token carries its own authorization, so the request needs no credential.

Base URL

Every request targets your account's regional host, using this pattern:

https://{region}-api.mft.boomi.com

Replace {region} with the region your MFT account is provisioned in:

Region	Value
United States (default)	us
Europe	eu
United Kingdom	uk
Australia	au

Request and response format

Most operations exchange JSON. Send the request body as application/json and expect the response in application/json, following the schema that each operation defines.

The upload operations, single-file and chunked, are the exception. They take a two-part multipart/form-data body: a JSON metadata part followed by a binary file part.

Download operations return the file as an application/octet-stream stream. They support HTTP range requests, returning 206 Partial Content for a requested byte range and 200 OK for the full file.