> ## Documentation index > Fetch the complete documentation index at: https://developer.rhombus.com/llms.txt > Use it to discover all available pages before exploring further. # List partner portal assets > List the Partner Portal collateral the authenticated partner organization is entitled to view. ```http POST https://api2.rhombussystems.com/api/partnerportal/listAssets ``` EU organizations send the same request to `https://api2.eu.rhombussystems.com`. ## Authentication and parameters - `x-auth-apikey` (header, required): Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). - `Authorization` (header): instead of an API key, an OAuth access token (`Bearer `) with the `read` scope. - `x-auth-scheme` (header, string, default: `partner-api-token`): Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters. One of: `api-token`, `api`, `api-oauth-token`, `federated-token`, `partner-api-token`, `partner-api`, `partner-api-oauth-token`. ## Request body Content type: `application/json`. Request object for listing the Partner Portal collateral the authenticated partner organization is entitled to view. This request intentionally carries no fields: in particular there is no organization field, because the partner organization is always resolved from the authenticated principal and is never read from the request body. Adding an org field here would let a caller re-scope the entitlement lookup to an organization they choose. No fields: send `{}`. ## Response 200 OK. Content type: `application/json` - `assets` (array | null): List of Partner Portal assets the authenticated partner organization is entitled to view. Empty, never null, when the partner is entitled to nothing or the request failed. - `error` (boolean | null) - `errorCode` (string | null): Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. - `errorMsg` (string | null) - `warningMsg` (string | null) ## Errors Also 400, 401, 403, 429, 500, 503 with the standard error body (`errorCode`, `errorMsg`): https://developer.rhombus.com/errors ## OpenAPI ````yaml openapi: 3.0.1 info: title: Rhombus API version: "1.0" servers: - description: Production Server url: https://api2.rhombussystems.com security: - ApiKeyAuth: [] paths: /api/partnerportal/listAssets: post: description: List the Partner Portal collateral the authenticated partner organization is entitled to view. operationId: listAssets parameters: - description: "Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters." example: partner-api-token in: header name: x-auth-scheme required: false schema: default: partner-api-token enum: - api-token - api - api-oauth-token - federated-token - partner-api-token - partner-api - partner-api-oauth-token type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/Partnerportal_ListPartnerPortalAssetsWSRequest" responses: "200": content: application/json: schema: $ref: "#/components/schemas/Partnerportal_ListPartnerPortalAssetsWSResponse" description: OK "400": $ref: "#/components/responses/BadRequest" "401": $ref: "#/components/responses/Unauthorized" "403": $ref: "#/components/responses/Forbidden" "429": $ref: "#/components/responses/TooManyRequests" "500": $ref: "#/components/responses/InternalServerError" "503": $ref: "#/components/responses/ServiceUnavailable" security: - ApiKeyAuth: [] - oauth2: - read summary: List partner portal assets tags: - Partner Portal Webservice components: schemas: Partnerportal_ListPartnerPortalAssetsWSRequest: description: "Request object for listing the Partner Portal collateral the authenticated partner organization is entitled to view. This request intentionally carries no fields: in particular there is no organization field, because the partner organization is always resolved from the authenticated principal and is never read from the request body. Adding an org field here would let a caller re-scope the entitlement lookup to an organization they choose." type: object Partnerportal_ListPartnerPortalAssetsWSResponse: description: Response object containing the Partner Portal collateral the authenticated partner organization is entitled to view. properties: assets: description: List of Partner Portal assets the authenticated partner organization is entitled to view. Empty, never null, when the partner is entitled to nothing or the request failed. items: $ref: "#/components/schemas/Partnerportal_PartnerPortalAssetWebType" nullable: true type: array error: nullable: true type: boolean errorCode: description: Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. nullable: true type: string errorMsg: nullable: true type: string warningMsg: nullable: true type: string type: object Partnerportal_PartnerPortalAssetWebType: description: A single piece of Partner Portal collateral, projected down to the fields a partner may see. properties: createdAtMillis: description: Epoch milliseconds at which the asset was created format: int64 nullable: true type: integer currentVersionSeq: description: Sequence number of the version currently published, or null if no version has been published yet format: int32 nullable: true type: integer description: description: Description of the asset nullable: true type: string tags: description: Taxonomy tags carried by the asset, as tag names (for example PDF, HEALTHCARE) items: description: Taxonomy tags carried by the asset, as tag names (for example PDF, HEALTHCARE) nullable: true type: string nullable: true type: array uniqueItems: true title: description: Title of the asset nullable: true type: string updatedAtMillis: description: Epoch milliseconds at which the asset was last updated format: int64 nullable: true type: integer uuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string type: object securitySchemes: ApiKeyAuth: description: Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). in: header name: x-auth-apikey type: apiKey oauth2: description: 'OAuth 2.0 authorization code flow with PKCE (`S256`). Send the access token as `Authorization: Bearer `. Each operation lists the scopes it requires; a token without them is refused 403 with `WWW-Authenticate: Bearer error="insufficient_scope"`.' flows: authorizationCode: authorizationUrl: https://console.rhombus.com/oauth/authorize refreshUrl: https://auth-web.rhombussystems.com/oauth/token scopes: physical: Unlock doors and elevators, lockdown, alarms, speakers and robots read: View cameras, footage and settings write: Change settings and data tokenUrl: https://auth-web.rhombussystems.com/oauth/token type: oauth2 ````