Usage and troubleshooting

Requests and authentication

Use HTTPS for credential and token requests. Keep passwords and tokens out of URLs, source control, and application logs. Send access tokens in Authorization: Bearer ACCESS_TOKEN. A token from Account Manager is not documented as interchangeable with an AI Command Center token.

Examples use cURL in a POSIX shell. On Windows, run them in a compatible shell or adapt quoting and line continuation to your shell. Replace the example origin, account credentials, and resource IDs before running them.

Use the exact parameter names shown in each endpoint table. URL-encode query values, especially spaces and domain-account backslashes. Send JSON request bodies with Content-Type: application/json.

Resource identifiers and data

• Use processId from Get Process Definition when creating an instance or starting a job.
• Use processInstanceId from Create Process Instance to retrieve tasks or access runtime data.
• A workflowInstanceId identifies a workflow within a process execution. Workflow Data updates use it; Agent Data updates do not.
• Use task IDs returned by task-list operations and job IDs returned by Start Job.
• Account Manager’s AppZ GUID differs from its numeric intelliAppzId. A subscription number such as IBIS20250131000029 differs from its numeric database ID.

Response examples illustrate shapes and representative values; they are not exhaustive schemas. Arrays are shortened to one item, and contact and credential values are synthetic. An empty array in an example does not establish all empty-result behavior.

Preserve JSON types, including the distinction between null, an empty string, and an empty array. Some fields, such as job input and output, contain strings with serialized data. Interpret them according to the process definition. Timestamps in the existing examples mix explicit UTC suffixes and values without timezone offsets; confirm the service timezone before converting values without offsets.

Handling failures

Inspect the HTTP status and response content type before parsing the body. Retain a sanitized error response and any request identifier supplied by the service when reporting a failure. Never log authorization headers or passwords.

The following are general HTTP handling suggestions. They do not assert that every endpoint returns every listed status.

Status	Suggested action
400	Check parameter names, types, required values, and resource identifiers.
401	Check the service origin and token. Renew authentication using the service’s documented flow.
403	Check account roles, tenant membership, and resource access.
404	Check that the resource exists and belongs to the accessible account or tenant.
429	If a retry interval is supplied, honor it. Confirm the service’s actual rate policy.
5xx	Record the sanitized failure and contact the administrator if it persists.

Do not automatically repeat a state-changing request after a timeout: a job, user, process instance, or task change may already have been accepted. Idempotency guarantees are not established by this reference. Check resource state before deciding whether to retry.

Lists and asynchronous jobs

List pages show the response shapes currently documented, including arrays and objects containing data and totalCount. Pagination parameters, ordering guarantees, maximum result sizes, and filtering case sensitivity are not established here. Confirm these before relying on complete collection retrieval.

Use Start Job’s returned jobId to inspect progress through Get Job Status. The reference currently illustrates Completed; it does not define the full set of running, successful, or failed states. Confirm terminal states, polling intervals, waiting behavior, and timeout units with the API owner before implementing unattended job monitoring.

Compatibility and reference limitations

Verify endpoint availability against your installed AI Command Center version or the hosted Account Manager service. This reference does not yet define a supported-version matrix, deprecation policy, or rate-limit policy.

Before production integration, confirm any endpoint-specific details not supplied by its page: required fields and defaults, validation limits, enum mappings, permissions, response nullability, error body schemas, and token renewal rules. These gaps require verification against the implementation or a supported API specification; illustrative examples alone do not establish those contracts.