DATTA API — Overview

Everything you do in the DATTA interface can also be done through the API: search, upload documents, trigger screenings, query the catalog, read panels. It is the path to integrating DATTA with your systems — an internal portal, an ingestion robot, a data pipeline or an external BI client.

This section concentrates all of the platform's API reference. The usage guides in the other sections describe features through the interface; whenever a capability also exists via API, they point here.

Base and format

• Base URL: the same address as the platform (e.g. https://datta.yourorg.gov.br). All paths start with /api/.
• Format: JSON (UTF-8) for requests and responses.
• Errors: error responses carry a JSON body with an error field holding a descriptive message in Portuguese. Always handle error (with a fallback to message).

Authentication

The API uses the same session mechanism as the interface: a JWT token obtained at login.

1. Authenticate with your DATTA credentials:

curl -X POST "$BASE/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"username": "seu.usuario", "password": "sua-senha"}'

1. The response carries the token. Send it on every subsequent call in the Authorization header:

curl "$BASE/api/catalog/datasets" \
  -H "Authorization: Bearer $TOKEN"

• Tokens expire; renew by logging in again. 401 errors with a session message indicate an expired token.
• User permissions apply to the API as well: a user without access to a feature in the interface receives 403 on the equivalent call.

CSRF protection on mutations

Calls that change state (create, edit, delete) require the X-Requested-With header:

curl -X DELETE "$BASE/api/exemplo/recurso/123" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Requested-With: XMLHttpRequest"

Without this header the platform blocks the mutation for safety.

Where to find each API

• Endpoint reference by area — search, chat, documents, screening, catalog, panels, connections and more, with examples.
• Knowledge export — export curated knowledge assets to external systems.

Good practices

• One token per integration: create a dedicated user for each integrated system (under Sistema›Usuários), with the least-privilege role that fits the case.
• Handle limits: costly operations (exports, batch executions) are rate-limited; respect 429 responses by waiting before retrying.
• Follow along in the interface: executions triggered via API show up under Execuções like any other — same audit trail, same CONCLUIDA (completed) and FALHOU (failed) statuses.