File Label Express API
Production API · Version 1

File Label Express API

Authenticate an integration, submit one or more label records, let the user review the rendered labels, and produce a print-ready PDF.

API https://filelabel.co/api/
Preview https://filelabel.co/preview

Start here

Direct answers for integration planning

The API is session-oriented. An API key creates a temporary token, submitted records are stored in that token's session, and the preview page renders those records with the selected project's label template.

1

How does authentication work?

Send a JSON POST body containing action: "auth" and apiKey. Send the returned token on protected calls with Authorization: Bearer ….

2

Which HTTP methods are used?

Every API action uses POST with an application/json body. The interactive preview is a browser page opened with GET. No PUT request is needed.

3

What is the minimum workflow?

With a known project ID: authenticate, submit labelData, then open /preview. The preview's Save File button renders and downloads the PDF.

4

What data format is accepted?

labelData accepts a JSON object containing a data array. Each array item is one label record. Raw CSV is not accepted directly.

5

Can one request contain multiple labels?

Yes. Send multiple objects in the JSON data array. Each object normally produces one label in the resulting batch.

6

Does the API physically print?

No. File Label Express creates a print-ready preview/PDF. A user, desktop application, print service, or printer-management system initiates the physical print.

Core integration

The minimum label workflow

If the integration already knows its assigned project ID, only two API calls are required before sending the user to preview.

1. AuthenticatePOST auth
2. Submit recordsPOST labelData
3. Open previewGET /preview
4. Save PDFUser action
5. PrintOutside the API
  1. Authenticate with the user's API key. Read the temporary token from output.user.token.
  2. Submit the complete batch with labelData. Send the token in the bearer header. The JSON body contains the optional application name and an array with one object per label.
  3. Navigate the user's browser to the preview URL. Open the handoff URL with the authorized project ID and token. File Label Express exchanges it for a secure session cookie, redirects to a clean URL, and renders the batch.
  4. The user reviews the labels and chooses Save File. The preview creates the PDF and starts its download. The integration does not call downloadPDF immediately after labelData.
Important: labelData does not create a PDF. Calling downloadPDF immediately afterward returns “No PDF data found.” A PDF exists only after rendered HTML has been passed through saveGeneratedSource, which the normal preview page handles when the user clicks Save File.

Optional project discovery

If the project ID is not stored by the integrating application, call getProjects after authentication. The application may then call getProjectMeta to discover the exact field names required by the chosen label project.

Protocol

Requests and responses

Request encoding

All API actions are sent as JSON POST requests:

Required HTTP headers
Content-Type: application/json
Accept: application/json
Authorization: Bearer TEMPORARY_TOKEN

The request body must be a JSON object. Put the operation name in action, then add its operation-specific properties. Omit the Authorization header from the initial auth call.

Authentication parameters

CredentialWhere it is sentUsed for
apiKeyJSON request propertyThe initial auth request only.
tokenAuthorization: Bearer …Subsequent protected API calls.
tokenInitial preview handoff URLExchanged for a secure session cookie and removed by redirect.

HTTP method matrix

OperationMethodResponseToken
authPOSTJSONNo
getSessionPOSTJSONBearer header
getProjectsPOSTJSONBearer header
getProjectMetaPOSTJSONBearer header
labelData / submitLabelsPOSTJSONBearer header
/previewGETHTML pagePreview URL
saveGeneratedSourcePOSTJSONBearer header
downloadPDFPOSTapplication/pdfBearer header
sampleDataPOSTJSONBearer header
getFilingSystemPOSTJSONNot required for public catalog data
convertXLS / convertXLSXPOSTJSON containing base64 CSVBearer header
API v1 uses one JSON endpoint. Send every API action to https://filelabel.co/api/ with POST and select the operation with the JSON action property. The preview is a separate interactive browser route.
Browser-based cross-origin requests trigger a CORS preflight because they use JSON and the Authorization header. The calling origin plus the Content-Type and Authorization headers must be permitted by the API's CORS configuration. Server-to-server requests are not subject to browser CORS enforcement.

JSON envelope

Most API responses use an error/output envelope:

Successful JSON response
{
  "error": [],
  "output": { }
}

An empty error array/object indicates success. Some application errors are returned with HTTP 200, so integrations must inspect the response body instead of relying only on the HTTP status.

Payloads

Label data format and batching

The label batch is an ordered array of objects. Each object's keys must match the field names configured for the selected project.

Supported

  • JSON objects with a data array
  • One label object per array position
  • Multiple label objects in one request
  • Text and numeric-looking string values
  • Project-specific quantity fields when configured

Not accepted directly

  • Raw CSV passed to labelData
  • XLS/XLSX passed directly to labelData
  • A JSON string placed inside data instead of a JSON array
  • Arbitrary field names not present in the project

JSON representation

Send a JSON object at the request root. The data member contains one object per label:

application/json
{
  "action": "labelData",
  "app": "Records System",
  "data": [
    {
      "last_name": "Morgan",
      "first_name": "Alex",
      "dob": "1985-04-12"
    },
    {
      "last_name": "Rivera",
      "first_name": "Jamie",
      "dob": "1977-11-03"
    }
  ]
}
Batching is supported. The example above produces a two-record batch. The project's template determines how many labels fit on each PDF page. If a project defines a quantity field, one record may intentionally be duplicated by that quantity.

A new labelData call replaces the prior active remote batch for the same token/session. Submit the complete intended batch each time.

Quick start

Complete cURL example

This example uses a known project ID and submits two labels. Replace the placeholder credentials, project, and fields with values assigned to the user.

1. Authenticate

Shell
curl --request POST 'https://filelabel.co/api/' \
  --header 'Content-Type: application/json' \
  --data '{
    "action": "auth",
    "apiKey": "YOUR_API_KEY"
  }'
Response
{
  "error": [],
  "output": {
    "user": {
      "userId": "USER_ID",
      "logged_in": true,
      "token": "TEMPORARY_TOKEN"
    }
  }
}

2. Submit a two-label batch

Shell
curl --request POST 'https://filelabel.co/api/' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer TEMPORARY_TOKEN' \
  --data '{
    "action": "labelData",
    "app": "Records System",
    "data": [
      {
        "last_name": "Morgan",
        "first_name": "Alex",
        "dob": "1985-04-12"
      },
      {
        "last_name": "Rivera",
        "first_name": "Jamie",
        "dob": "1977-11-03"
      }
    ]
  }'

3. Open the preview

Browser URL
https://filelabel.co/preview?project=PROJECT_ID&token=TEMPORARY_TOKEN

File Label Express validates the token, stores the session in a secure HTTP-only cookie, and redirects to /preview?project=PROJECT_ID. The user then reviews the batch and selects Save File. Printing the resulting PDF is handled by the user's PDF viewer, desktop software, or print-management process.

Equivalent PHP request construction

PHP
<?php
function flxPost(array $parameters, ?string $token = null): array
{
    $handle = curl_init('https://filelabel.co/api/');
    $json = json_encode($parameters, JSON_THROW_ON_ERROR);
    $headers = [
        'Content-Type: application/json',
        'Accept: application/json',
    ];

    if ($token !== null) {
        $headers[] = 'Authorization: Bearer '.$token;
    }

    curl_setopt_array($handle, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $json,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CONNECTTIMEOUT => 10,
        CURLOPT_TIMEOUT => 30,
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_SSL_VERIFYHOST => 2,
        CURLOPT_HTTPHEADER => $headers,
    ]);

    $body = curl_exec($handle);
    if ($body === false) {
        throw new RuntimeException(curl_error($handle));
    }

    $status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
    curl_close($handle);

    if ($status < 200 || $status >= 300) {
        throw new RuntimeException('File Label Express returned HTTP '.$status.'.');
    }

    return json_decode($body, true, 512, JSON_THROW_ON_ERROR);
}

$auth = flxPost([
    'action' => 'auth',
    'apiKey' => getenv('FILELABEL_API_KEY'),
]);

if (!empty($auth['error'])) {
    throw new RuntimeException('File Label Express authentication failed.');
}

$token = $auth['output']['user']['token'];

$result = flxPost([
    'action' => 'labelData',
    'app'    => 'Records System',
    'data'   => [
        [
            'last_name'  => 'Morgan',
            'first_name' => 'Alex',
            'dob'        => '1985-04-12',
        ],
        [
            'last_name'  => 'Rivera',
            'first_name' => 'Jamie',
            'dob'        => '1977-11-03',
        ],
    ],
], $token);

$previewUrl = 'https://filelabel.co/preview?'.http_build_query([
    'project' => 'PROJECT_ID',
    'token'   => $token,
]);

// Redirect the user's browser or return this URL to the client application.
header('Location: '.$previewUrl);

Server-side integration

Reusable PHP client class

This updated client sends JSON request bodies, authenticates protected calls with the bearer header, validates TLS certificates, reports transport and API errors, and keeps the temporary token separate from the permanent API key.

Recommended: keep this class and the API key on the application server. The browser should receive only the one-time preview handoff URL after the server has authenticated and submitted the label batch.
Filelabel_API.php
<?php

declare(strict_types=1);

final class Filelabel_API
{
    private const API_URL = 'https://filelabel.co/api/';
    private const PREVIEW_URL = 'https://filelabel.co/preview';

    private string $apiKey;
    private ?string $token;
    private int $timeout;

    public bool $loggedIn = false;

    public function __construct(
        string $apiKey,
        ?string $token = null,
        int $timeout = 30
    ) {
        $apiKey = trim($apiKey);

        if ($apiKey === '') {
            throw new InvalidArgumentException('An API key is required.');
        }

        $this->apiKey = $apiKey;
        $this->token = $token ?: null;
        $this->timeout = max(1, $timeout);
    }

    /** Authenticate the API key and retain the returned temporary token. */
    public function auth(): array
    {
        $output = $this->requestJson([
            'action' => 'auth',
            'apiKey' => $this->apiKey,
        ], false);

        $token = $output['user']['token'] ?? null;

        if (!is_string($token) || $token === '') {
            throw new RuntimeException(
                'Authentication did not return a token.'
            );
        }

        $this->token = $token;
        $this->loggedIn = true;

        return $output['user'];
    }

    /** Check a previously saved token without exposing the API key. */
    public function checkSession(): bool
    {
        if ($this->token === null) {
            return false;
        }

        try {
            $session = $this->getSession();
            $this->loggedIn = !empty($session['logged_in']);
        } catch (RuntimeException $exception) {
            $this->loggedIn = false;
        }

        return $this->loggedIn;
    }

    public function getSession(): array
    {
        $output = $this->requestJson([
            'action' => 'getSession',
        ]);

        if (!isset($output['session']) || !is_array($output['session'])) {
            throw new RuntimeException('No session was returned.');
        }

        return $output['session'];
    }

    public function getProjects(): array
    {
        $output = $this->requestJson([
            'action' => 'getProjects',
        ]);

        return isset($output['projects']) && is_array($output['projects'])
            ? $output['projects']
            : [];
    }

    public function getProjectMeta(string $projectId): array
    {
        return $this->requestJson([
            'action' => 'getProjectMeta',
            'project' => $projectId,
        ]);
    }

    /** Submit one JSON object per label. */
    public function labelData(array $records, ?string $app = null): array
    {
        if ($records === []) {
            throw new InvalidArgumentException(
                'At least one label record is required.'
            );
        }

        foreach ($records as $record) {
            if (!is_array($record)) {
                throw new InvalidArgumentException(
                    'Every label record must be an array.'
                );
            }
        }

        $payload = [
            'action' => 'labelData',
            'data' => array_values($records),
        ];

        if ($app !== null && $app !== '') {
            $payload['app'] = $app;
        }

        return $this->requestJson($payload);
    }

    public function previewUrl(string $projectId, int $offset = 0): string
    {
        return self::PREVIEW_URL.'?'.http_build_query(
            [
                'project' => $projectId,
                'offset' => max(0, $offset),
                'token' => $this->requireToken(),
            ],
            '',
            '&',
            PHP_QUERY_RFC3986
        );
    }

    /** Download a PDF already generated by the preview flow. */
    public function downloadPDF(): string
    {
        [$status, $contentType, $body] = $this->sendJson([
            'action' => 'downloadPDF',
        ], 'application/pdf', true);

        if ($status < 200 || $status >= 300) {
            throw new RuntimeException(
                'File Label Express returned HTTP '.$status.'.'
            );
        }

        if (stripos($contentType, 'application/json') !== false) {
            $this->decodeResponse($body);
        }

        if (strncmp($body, '%PDF', 4) !== 0) {
            throw new RuntimeException(
                'File Label Express did not return a PDF.'
            );
        }

        return $body;
    }

    public function getToken(): ?string
    {
        return $this->token;
    }

    private function requestJson(
        array $payload,
        bool $authorized = true
    ): array
    {
        [$status, $contentType, $body] = $this->sendJson(
            $payload,
            'application/json',
            $authorized
        );

        if ($status < 200 || $status >= 300) {
            throw new RuntimeException(
                'File Label Express returned HTTP '.$status.'.'
            );
        }

        return $this->decodeResponse($body);
    }

    private function sendJson(
        array $payload,
        string $accept = 'application/json',
        bool $authorized = true
    ): array {
        try {
            $json = json_encode(
                $payload,
                JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR
            );
        } catch (JsonException $exception) {
            throw new InvalidArgumentException(
                'The request could not be encoded as JSON.',
                0,
                $exception
            );
        }

        $curl = curl_init(self::API_URL);

        if ($curl === false) {
            throw new RuntimeException('Unable to initialize cURL.');
        }

        $headers = [
            'Content-Type: application/json',
            'Accept: '.$accept,
        ];

        if ($authorized) {
            $headers[] = 'Authorization: Bearer '.$this->requireToken();
        }

        curl_setopt_array($curl, [
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => $json,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_CONNECTTIMEOUT => 10,
            CURLOPT_TIMEOUT => $this->timeout,
            CURLOPT_SSL_VERIFYPEER => true,
            CURLOPT_SSL_VERIFYHOST => 2,
            CURLOPT_ENCODING => '',
            CURLOPT_USERAGENT => 'Filelabel_API/1.0',
            CURLOPT_HTTPHEADER => $headers,
        ]);

        $body = curl_exec($curl);
        $status = (int) curl_getinfo($curl, CURLINFO_HTTP_CODE);
        $contentType = (string) curl_getinfo($curl, CURLINFO_CONTENT_TYPE);

        if ($body === false) {
            $message = curl_error($curl);
            curl_close($curl);
            throw new RuntimeException('File Label Express: '.$message);
        }

        curl_close($curl);

        return [$status, $contentType, $body];
    }

    private function decodeResponse(string $body): array
    {
        try {
            $response = json_decode(
                $body,
                true,
                512,
                JSON_THROW_ON_ERROR
            );
        } catch (JsonException $exception) {
            throw new RuntimeException(
                'File Label Express returned invalid JSON.',
                0,
                $exception
            );
        }

        if (!is_array($response)) {
            throw new RuntimeException(
                'File Label Express returned an invalid response.'
            );
        }

        if ($this->hasError($response['error'] ?? null)) {
            throw new RuntimeException(
                'File Label Express: '.
                $this->formatError($response['error'])
            );
        }

        $output = $response['output'] ?? [];

        return is_array($output) ? $output : ['value' => $output];
    }

    private function requireToken(): string
    {
        if ($this->token === null || $this->token === '') {
            throw new LogicException(
                'Authenticate before calling this operation.'
            );
        }

        return $this->token;
    }

    private function hasError($error): bool
    {
        if ($error === null || $error === false || $error === '') {
            return false;
        }

        return !is_array($error) || $error !== [];
    }

    private function formatError($error): string
    {
        if (is_string($error)) {
            return $error;
        }

        $encoded = json_encode($error, JSON_UNESCAPED_SLASHES);

        return $encoded !== false ? $encoded : 'Unknown API error.';
    }
}

Using the class

PHP
session_start();
require_once 'Filelabel_API.php';

$filelabel = new Filelabel_API(
    getenv('FILELABEL_API_KEY'),
    $_SESSION['filelabel_token'] ?? null
);

if (!$filelabel->checkSession()) {
    $filelabel->auth();
    $_SESSION['filelabel_token'] = $filelabel->getToken();
}

$projects = $filelabel->getProjects();
$projectIds = array_keys((array) $projects);

if (!$projectIds) {
    throw new RuntimeException('No label projects are assigned.');
}

$projectId = $projectIds[0];

$filelabel->labelData([
    [
        'last_name'  => 'Morgan',
        'first_name' => 'Alex',
        'dob'        => '1985-04-12',
    ],
    [
        'last_name'  => 'Rivera',
        'first_name' => 'Jamie',
        'dob'        => '1977-11-03',
    ],
], 'Records System');

header('Location: '.$filelabel->previewUrl($projectId));
exit;

The example stores the temporary token in the integrating application's PHP session. The constructor performs no network request. The application validates a saved token with checkSession() and calls auth() only when a new token is required.

Reference

Endpoint reference

All API actions use the same base endpoint. The action parameter selects the operation.

POST

auth

Authenticates a user's API key and starts a temporary File Label Express session.

Authentication: API keyReturns: JSONRequest: JSON
ParameterTypeRequiredDescription
actionstringYesMust be auth.
apiKeystringYesThe API key assigned to the File Label Express user.
Request
POST https://filelabel.co/api/
Content-Type: application/json

{
  "action": "auth",
  "apiKey": "YOUR_API_KEY"
}

On success, store output.user.token temporarily and use it for the remainder of the label workflow. Do not expect the token in an HTTP response header.

POST

getSession

Returns the session associated with a token. It can be used to confirm that the token is still logged in and to recover session details such as assigned projects.

Authentication: Bearer tokenReturns: JSONSession validation
ParameterTypeRequiredDescription
actionstringYesMust be getSession.
Request
POST https://filelabel.co/api/
Content-Type: application/json
Authorization: Bearer TEMPORARY_TOKEN

{
  "action": "getSession"
}
Representative response
{
  "error": [],
  "output": {
    "session": {
      "logged_in": true,
      "userId": "USER_ID",
      "projects": { }
    }
  }
}

Validate output.session.logged_in. Do not treat the mere presence of a session object as proof that authentication is active.

POST

getProjects

Returns the label projects assigned to the authenticated user.

Authentication: Bearer tokenReturns: JSONOptional when project ID is known
Request
POST https://filelabel.co/api/
Content-Type: application/json
Authorization: Bearer TEMPORARY_TOKEN

{
  "action": "getProjects"
}

The projects are returned under output.projects, keyed by project ID. Store the selected project ID; it is needed for metadata, preview, and PDF creation.

POST

getProjectMeta

Returns configuration for one project, including its accepted field names and print-template information.

Authentication: Bearer tokenReturns: JSON
ParameterTypeRequiredDescription
actionstringYesMust be getProjectMeta.
projectstringYesAn assigned File Label Express project ID.
Request
POST https://filelabel.co/api/
Content-Type: application/json
Authorization: Bearer TEMPORARY_TOKEN

{
  "action": "getProjectMeta",
  "project": "PROJECT_ID"
}
Representative response
{
  "error": [],
  "output": {
    "name": "Example Project",
    "fields": ["last_name", "first_name", "dob"],
    "printTemplate": "FLX-6-L.css",
    "printTemplateInfo": {
      "labelsPer": "6",
      "pageWidth": "11.0in",
      "pageHeight": "8.75in"
    }
  }
}
POST

labelData

Replaces the active session batch with the submitted label records. submitLabels is a compatibility alias for the same operation.

Authentication: Bearer tokenReturns: JSONSupports batching
ParameterTypeRequiredDescription
actionstringYeslabelData or submitLabels.
dataarray<object>YesOne or more label records. Keys must match the project fields.
appstringNoHuman-readable name of the integrating application.
Two-record request
POST https://filelabel.co/api/
Content-Type: application/json
Authorization: Bearer TEMPORARY_TOKEN

{
  "action": "labelData",
  "app": "Records System",
  "data": [
    {
      "last_name": "Morgan",
      "first_name": "Alex"
    },
    {
      "last_name": "Rivera",
      "first_name": "Jamie"
    }
  ]
}

The response's output contains the session's stored batch. Server-generated keys may replace the numeric request indexes; integrations should not treat those generated keys as durable record IDs.

GET

/preview

Displays the submitted records using the selected project's live label design and print template.

Authentication: tokenReturns: HTMLBrowser navigation
ParameterTypeRequiredDescription
projectstringYesThe assigned project whose template will render the batch.
tokenstringYesThe same temporary token used to submit the batch.
offsetintegerNoLeaves blank label positions before the first rendered label.
Browser URL
https://filelabel.co/preview?project=PROJECT_ID&token=TEMPORARY_TOKEN

This is a one-time handoff URL. File Label Express validates the token, sets a secure HTTP-only session cookie, and redirects to the same preview without the token. The user then reviews the labels and selects Save File.

POST

saveGeneratedSource

Advanced endpoint that converts a complete, already-rendered HTML document into a PDF stored in the current session.

Authentication: Bearer tokenReturns: JSONAdvanced use
This endpoint does not accept raw label records and does not apply a project template by itself. The standard preview page builds the required HTML and calls this operation automatically. External callers should use it only if they intentionally reproduce the complete rendered label document.
ParameterTypeRequiredDescription
actionstringYesMust be saveGeneratedSource.
projectstringYesAn assigned project ID.
htmlstringYesA complete rendered HTML document stored as a JSON string.
countintegerNoNumber of valid labels, used for the project counter and audit.
JSON request
POST https://filelabel.co/api/
Content-Type: application/json
Authorization: Bearer TEMPORARY_TOKEN

{
  "action": "saveGeneratedSource",
  "project": "PROJECT_ID",
  "html": "<!doctype html>...</html>",
  "count": 12
}

A successful response contains output.pdf = "PDF created successfully.". The PDF bytes are then available once through downloadPDF. Identical repeated generation requests may be rate-limited briefly.

POST

downloadPDF

Downloads the PDF currently stored in the authenticated session.

Authentication: Bearer tokenReturns: application/pdfOne-time session output
Direct client download
curl --request POST 'https://filelabel.co/api/' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/pdf' \
  --header 'Authorization: Bearer TEMPORARY_TOKEN' \
  --data '{
    "action": "downloadPDF"
  }' \
  --output labels.pdf

The browser preview normally initiates this download automatically after PDF creation. The downloaded PDF is named labels.pdf. Once delivered, the session copy is removed, so a second download requires regenerating it.

POST

sampleData

Generates ten example records using the fields and form configuration of a project.

Authentication: Bearer tokenReturns: JSON arrayDevelopment utility
Request
POST https://filelabel.co/api/
Content-Type: application/json
Authorization: Bearer TEMPORARY_TOKEN

{
  "action": "sampleData",
  "project": "PROJECT_ID"
}

This action returns the sample array directly rather than consistently wrapping it in output. Use it for testing and field discovery, not as production label data.

POST

getFilingSystem

Returns projects grouped by supported filing-system family, or projects for one named family.

Authentication: public catalogReturns: JSON
ParameterTypeRequiredDescription
actionstringYesMust be getFilingSystem.
namestringNoOptional family such as gbs, barkley, tab, smead, tabbies, or datafile.
Request
POST https://filelabel.co/api/
Content-Type: application/json

{
  "action": "getFilingSystem",
  "name": "gbs"
}
POST

convertXLS / convertXLSX

Converts the first worksheet of an Excel file into CSV data. These utilities do not submit the resulting rows as labels.

Authentication: Bearer tokenReturns: base64 CSV in JSONRequest: JSON
ParameterTypeRequiredDescription
actionstringYesconvertXLS for older Excel files or convertXLSX for modern workbooks.
datastringYesBase64-encoded workbook bytes stored as a JSON string.
Request
POST https://filelabel.co/api/
Content-Type: application/json
Authorization: Bearer TEMPORARY_TOKEN

{
  "action": "convertXLSX",
  "data": "BASE64_ENCODED_WORKBOOK"
}
Response
{
  "error": [],
  "output": {
    "data": "BASE64_ENCODED_CSV"
  }
}

After conversion, the integrating application must decode and parse the CSV, map its columns to the chosen project's fields, and submit the resulting array through labelData.

Reliability

Error handling

Always check both the HTTP result and the response body's error field. API v1 may report an application error in a successful HTTP response.

Invalid API key
{
  "error": {
    "apiKey": "The API key is incorrect."
  },
  "output": []
}
Error conditionMeaningRecommended action
Missing/incorrect API keyAuthentication did not succeed.Verify the assigned key. Do not retry rapidly.
No session or authentication tokenThe token is missing, expired, or invalid.Authenticate again and restart the active batch.
Permission deniedThe user does not have access to the requested project.Use a project from getProjects or request assignment.
No PDF data foundNo PDF was created in this session, or it was already downloaded.Use preview/Save File or call saveGeneratedSource before downloading.
Rate limit reachedThe same PDF-generation request was repeated too quickly.Wait before retrying; do not immediately loop.
Invalid actionThe named action is not available.Check spelling and use an action documented on this page.

Security

Security and operational guidance

  • Call the API only over HTTPS.
  • Keep the API key in server-side configuration. Do not embed it in public browser JavaScript, mobile application bundles, logs, or URLs.
  • Treat the returned token as temporary session data, not as a permanent credential.
  • Do not log the initial preview handoff URL because it briefly includes the token. File Label Express redirects to a clean URL after establishing the session cookie.
  • Reauthenticate when a token is rejected rather than assuming it will remain valid indefinitely.
  • Validate the project against getProjects instead of accepting arbitrary project IDs from end users.
  • Use reasonable batch sizes. Large batches and HTML-to-PDF conversion are limited by server memory and execution time.
  • Server-to-server API calls are recommended. Browser-based integrations require an approved cross-origin configuration.
  • Avoid automatic retries for PDF creation unless the previous request clearly failed and a delay has elapsed.
Never send the API key in the preview URL. The preview URL receives the temporary token only. The API key is used solely in the POST body of the initial auth call.

Clarifications

Frequently asked questions

Can we call auth once and save the token permanently?
No. Reuse the token for the active workflow, but treat it as temporary. If the server reports that the session/token is invalid, authenticate again and resubmit the active label batch.
Do we send the token in a header?
Yes. Protected API calls use Authorization: Bearer TEMPORARY_TOKEN. Only the initial interactive preview handoff carries the token in its URL; File Label Express exchanges it for a secure HTTP-only cookie and immediately redirects to a clean URL.
What request format should we send?
Send a JSON object with Content-Type: application/json. Put the action, application name, and data array in that object, and send the token in the bearer header.
Can we send CSV?
Not directly to labelData. Parse the CSV in your application, map the columns to the project's fields, and submit an array of objects. The spreadsheet conversion endpoints can convert XLS/XLSX into base64-encoded CSV, but they do not submit labels automatically.
Can we create several labels in one PDF?
Yes. Send several objects in one labelData request. The preview combines the complete batch and the project's print template controls labels per page and page breaks.
Can we call downloadPDF immediately after labelData?
No. labelData stores records; it does not render them. Use the preview page and its Save File button. Advanced clients must first create the complete rendered document with saveGeneratedSource.
How do we know which fields to send?
Call getProjectMeta and inspect output.fields and any returned form definition. Field names are project-specific and should be preserved exactly.
Does File Label Express send the job directly to a printer?
No. It produces the rendered labels and a print-ready PDF. Physical print initiation belongs to the user's PDF viewer, the integrating application, or a separate print-management service.