# Authentication Source: https://developer.dromo.io/api-reference/authentication Authenticate Dromo REST API requests with frontend or backend API keys and keep privileged credentials secure. ## Overview The Dromo API uses API keys to authenticate requests. You can view and manage your API keys in the [Dromo Dashboard](https://dashboard.dromo.io). **Keep your backend API keys secure!** * Never expose them in client-side code * Store them securely in environment variables ## Authentication Methods To send an authorized API call, include your backend API key in the `X-Dromo-License-Key` header. ```bash cURL theme={null} curl -H "X-Dromo-License-Key: YOUR_API_KEY" \ https://app.dromo.io/api/v1/schemas ``` ```javascript JavaScript theme={null} const response = await fetch('https://app.dromo.io/api/v1/schemas', { headers: { 'X-Dromo-License-Key': 'YOUR_API_KEY', 'Content-Type': 'application/json' } }); ``` # Create a new headless import Source: https://developer.dromo.io/api-reference/headless/create-a-new-headless-import /api-reference/openapi.json post /headless/imports/ Starts a headless import from an uploaded file or data payload using a saved or inline schema. # Delete headless import Source: https://developer.dromo.io/api-reference/headless/delete-headless-import /api-reference/openapi.json delete /headless/imports/{id}/ Permanently deletes a headless import identified by ID. # Get presigned download URL for headless import data Source: https://developer.dromo.io/api-reference/headless/get-presigned-download-url-for-headless-import-data /api-reference/openapi.json get /headless/imports/{id}/url/ Creates a temporary presigned URL for downloading the processed data from a successful headless import. # List headless imports Source: https://developer.dromo.io/api-reference/headless/list-headless-imports /api-reference/openapi.json get /headless/imports/ Returns a paginated list of headless imports for the authenticated Dromo organization. # Retrieve headless import Source: https://developer.dromo.io/api-reference/headless/retrieve-headless-import /api-reference/openapi.json get /headless/imports/{id}/ Returns the current status and available result or review information for a headless import by ID. # Create a new import schema Source: https://developer.dromo.io/api-reference/import-schemas/create-a-new-import-schema /api-reference/openapi.json post /schemas/ Creates a saved import schema with fields, settings, and optional hooks for reuse in Dromo imports. # Delete an import schema Source: https://developer.dromo.io/api-reference/import-schemas/delete-an-import-schema /api-reference/openapi.json delete /schemas/{id}/ Permanently deletes a saved import schema identified by ID. # Get all import schemas Source: https://developer.dromo.io/api-reference/import-schemas/get-all-import-schemas /api-reference/openapi.json get /schemas/ Returns all saved import schemas available to the authenticated Dromo organization. # Get an import schema Source: https://developer.dromo.io/api-reference/import-schemas/get-an-import-schema /api-reference/openapi.json get /schemas/{id}/ Returns one saved import schema by ID, including its fields, settings, and hooks. # Update an import schema Source: https://developer.dromo.io/api-reference/import-schemas/update-an-import-schema /api-reference/openapi.json put /schemas/{id}/ Replaces the fields, settings, and hooks of an existing saved import schema identified by ID. # Create a session Source: https://developer.dromo.io/api-reference/sessions/create-a-session /api-reference/sessions-openapi.json post /auth/ Creates a new partial-import session and mints the initial hydration token to pass to the widget. Requires your **backend** license key — never call this client-side. # Delete a session Source: https://developer.dromo.io/api-reference/sessions/delete-a-session /api-reference/sessions-openapi.json delete /{sessionId}/ Permanently deletes the session and its saved state. All hydration tokens for this session are immediately invalidated — subsequent widget calls with the old `hydrationId` return 403. Idempotent: returns `{"success": true}` even if the session was already deleted. # Resume a session (re-issue hydrationId) Source: https://developer.dromo.io/api-reference/sessions/resume-a-session-re-issue-hydrationid /api-reference/sessions-openapi.json post /{sessionId}/auth/ Issues a fresh `hydrationId` for an existing session. Call this server-side when the user returns after their previous token has expired. The new token must belong to the same org as the session. # Create SFTP connector Source: https://developer.dromo.io/api-reference/sftp-connectors/create-sftp-connector /api-reference/openapi.json post /headless/sftp/connectors/ Creates an automated SFTP connector that imports files using configured credentials and schema settings. # Delete SFTP connector Source: https://developer.dromo.io/api-reference/sftp-connectors/delete-sftp-connector /api-reference/openapi.json delete /headless/sftp/connectors/{id}/ Deletes an automated SFTP connector identified by ID. # List SFTP connectors Source: https://developer.dromo.io/api-reference/sftp-connectors/list-sftp-connectors /api-reference/openapi.json get /headless/sftp/connectors/ Returns the automated SFTP import connectors configured for the authenticated Dromo organization. # Retrieve SFTP connector Source: https://developer.dromo.io/api-reference/sftp-connectors/retrieve-sftp-connector /api-reference/openapi.json get /headless/sftp/connectors/{id}/ Returns one automated SFTP connector and its import configuration by ID. # Update SFTP connector Source: https://developer.dromo.io/api-reference/sftp-connectors/update-sftp-connector /api-reference/openapi.json put /headless/sftp/connectors/{id}/ Updates an existing automated SFTP connector identified by ID. # Create SFTP credentials Source: https://developer.dromo.io/api-reference/sftp-credentials/create-sftp-credentials /api-reference/openapi.json post /headless/sftp/credentials/ Creates an SFTP credential configuration for connecting Dromo to an SFTP server. # Delete SFTP credentials Source: https://developer.dromo.io/api-reference/sftp-credentials/delete-sftp-credentials /api-reference/openapi.json delete /headless/sftp/credentials/{id}/ Deletes an SFTP credential configuration identified by ID. # List SFTP credentials Source: https://developer.dromo.io/api-reference/sftp-credentials/list-sftp-credentials /api-reference/openapi.json get /headless/sftp/credentials/ Returns the SFTP credential configurations available to the authenticated Dromo organization. # Retrieve SFTP credentials Source: https://developer.dromo.io/api-reference/sftp-credentials/retrieve-sftp-credentials /api-reference/openapi.json get /headless/sftp/credentials/{id}/ Returns one SFTP credential configuration by ID without exposing secret credential values. # Test SFTP connection Source: https://developer.dromo.io/api-reference/sftp-credentials/test-sftp-connection /api-reference/openapi.json post /headless/sftp/credentials/{id}/test_connection/ Tests whether Dromo can connect to the SFTP server using the selected credential configuration. # Update SFTP credentials Source: https://developer.dromo.io/api-reference/sftp-credentials/update-sftp-credentials /api-reference/openapi.json put /headless/sftp/credentials/{id}/ Updates an existing SFTP credential configuration identified by ID. # Delete an upload permanently Source: https://developer.dromo.io/api-reference/uploads/delete-an-upload-permanently /api-reference/openapi.json post /upload/{id}/delete/ Permanently deletes a completed upload and its stored data from Dromo. # Get all uploads Source: https://developer.dromo.io/api-reference/uploads/get-all-uploads /api-reference/openapi.json get /uploads/ Lists completed Dromo uploads for the authenticated organization, optionally filtered by a start and end date. # Get presigned download URL for upload data Source: https://developer.dromo.io/api-reference/uploads/get-presigned-download-url-for-upload-data /api-reference/openapi.json get /upload/{id}/url/ Creates a temporary presigned URL for securely downloading the data from a completed upload. # Get upload metadata Source: https://developer.dromo.io/api-reference/uploads/get-upload-metadata /api-reference/openapi.json get /upload/{id}/metadata/ Returns metadata for a completed Dromo upload, including information about its schema, user, and results. # Changelog Source: https://developer.dromo.io/changelog Review Dromo product releases, new SDK and API capabilities, behavior changes, accessibility improvements, and bug fixes. ## Optional Bulk Fix Step * **`skipBulkFixStep`**: Set to `true` to always skip the Bulk Fix step, regardless of whether select, multi-select, or date values would normally cause it to appear. See [`skipBulkFixStep`](/reference/settings/settings#skipbulkfixstep) in the Settings reference for configuration details. ## Batch Row Hooks for Large Imports Large imports can now be transformed in bounded chunks during initialization, avoiding the need to pass the entire dataset to one bulk callback. * **`registerBatchRowHook()`**: Register a JavaScript SDK callback that receives one slice of rows and its one-based batch number * **`batchRowHooks`**: Supply the same initialization-only callbacks through the React prop or Angular input * **`batchRowHookBatchSize`**: Set the maximum rows per callback invocation with a positive integer; defaults to `2000` See the [Batch row hooks reference](/reference/hooks#batch-row-hooks) for callback signatures and examples. ## Dr.Dromo Enters Limited Beta Meet **Dr.Dromo**, Dromo's AI assistant for designing and refining import workflows. Describe the outcome you need in plain language, and Dr.Dromo can help turn it into a reviewable Dromo schema. During the beta, Dr.Dromo can: * Generate import schemas from natural-language prompts, sample files, or existing configurations * Update fields, validation rules, settings, and hooks directly in Schema Studio * Provide product and implementation guidance grounded in Dromo's developer documentation * Present every proposed change for review before it is applied Dr.Dromo is currently available to a limited group of customers while we gather feedback and expand its capabilities. To request early access, contact [Dromo Support](mailto:support@dromo.io) or start a conversation using the support chat in the dashboard. ## Session Hydration Security Sessions now support a short-lived signed **`hydrationId`** token as a more secure alternative to passing the raw `sessionId` UUID in API URLs. The `sessionId`-based approach remains supported — `hydrationId` is an opt-in improvement that limits the impact of a leaked credential by scoping access to a short-lived token. * **`hydrationId`**: A signed token returned on session create; pass it to the widget instead of the raw `sessionId` * **`expiresAt`**: Token expiration timestamp returned by the Sessions API; configure the lifetime with the `expires_in` request field * **`sessionId`**: Unchanged long-lived identifier — store it server-side to re-issue a fresh `hydrationId` whenever needed See the [Session Saving & Restoration Guide](/guides/saving-progress) for the full security model and endpoint reference. ## Error Navigator Style Overrides & Custom AI Transform Prompts * **`styleOverrides.errorNavigator`**: New style override object for the Error Navigator panel. Customize `errorColor`, `warningColor`, `accentColor`, `errorIconUrl`, and `warningIconUrl`. See the [Style Overrides reference](/reference/settings/style-overrides#param-error-navigator) for details. * **`reviewStep.transformDataPrompts`**: Pass a `string[]` of custom prompt suggestions to display in the AI Transform Data modal, replacing the default localized prompts. See [`transformDataPrompts`](/reference/settings/settings#param-transform-data-prompts). ## Inline Schema Imports for Headless API The [create headless import endpoint](/api-reference/headless/create-a-new-headless-import) now supports defining schemas inline at import time, without requiring a saved schema in the dashboard. * **`fields`**: Pass field definitions directly in the request body instead of a `schema_id` — useful for dynamically generated schemas * **`settings` and `hooks` overrides**: Provide `settings` or `hooks` alongside a `schema_id` to merge one-off overrides for a specific import without modifying the saved schema * **Documentation**: [Headless Quickstart — Inline Schema Imports](/getting-started/headless#inline-schema-imports) ## Error Navigator & onUserEvent Callback ### Error Navigator * **`reviewStep.enableNavigatingErrors`**: A new boolean setting (default `false`) adds an error navigation panel to the Review Step. When enabled, row headers with validation errors display a red circular info icon — clicking it opens the panel anchored to that row's first error. * **Navigator panel**: Slides in from the right of the table and lists all validation errors as cards (row number, column name, error message). A column dropdown filters the list; Prev/Next buttons and `Alt+↑` / `Alt+↓` keyboard shortcuts step through errors in order, scrolling the table to each cell. Clicking any card jumps directly to that cell. * **Inline fix actions**: The active error card exposes two actions: * **Clear** — removes the invalid value; for multi-select fields, removes only invalid tokens. * **Replace** — sets a new value; shows a valid-options dropdown for select/multi-select fields, free text for all others; for multi-select, appends the chosen value to existing valid ones. * **Stateful panel**: Closing the panel (X) resets state and the column filter. See [`reviewStep.enableNavigatingErrors`](/reference/settings/settings#param-enable-navigating-errors) in the Settings reference for full details. ### onUserEvent Callback * **`onUserEvent()`**: Register a callback on any `DromoUploader` instance to receive real-time notifications when the user interacts with tracked UI controls. Fires on every button click across all import steps — upload, header selection, column matching, value matching, and review. * **`BUTTON_CLICK` event**: The initial event type emitted, with a payload containing `buttonName` (the specific control clicked) and `step` (the active import step). Over 30 named button values are covered, from `UPLOAD_DATA` and `DOWNLOAD_TEMPLATE` to `FIND_AND_REPLACE_CONFIRM`, `TRANSFORM_DATA_CONFIRM`, and exit/alert modal actions. * **Safe by default**: Errors thrown inside the callback are caught and logged as a warning — they never crash the importer or interrupt the user's flow. See the [onUserEvent Reference](/reference/on-user-event) for the full event type definitions, payload shapes, and button name reference. ## Custom Steps ### New Features * **`registerCustomStep()`**: Inject your own UI into the Dromo import flow at any point — after `HEADER_SELECT`, `COLUMN_MATCH`, or `SELECT_MATCH`. * **Iframe mode**: Custom steps render a hosted `