Trace IFS Cloud API requests with browser tools and Postman

Explore this learning path

Documentation-based guide draft · Reviewed against sources on 2026-09-27 · Not executed in an IFS environment. IFS references use 26R1 unless stated otherwise. Confirm available APIs, components, and permissions in your installed release.

Use this procedure when an IFS screen works but an integration fails, or when you need to discover the request behind a button. You will capture one read-only request, replay it, and compare the results without exposing a user’s token.

Before you start

Use a development environment, a user with the intended business permissions, Chrome or Edge, and a private Postman workspace. Choose one record you are allowed to inspect. Record its business key and the visible field you want to retrieve. Browser captures can contain credentials and business data; keep them local.

1. Capture only the action you need

1. Sign in to IFS and navigate to the target page.
2. Press F12, select Network, and select the Fetch/XHR filter.
3. Clear the existing request list. Leave Preserve log off unless the action navigates away.
4. Refresh the record or open its details once. Start with a read, not Save or Release.
5. Filter the request list by .svc or a distinctive part of the page name. Select the request whose response contains the chosen business key.

In Headers, record the Request URL, method, status, and content type. In Response, confirm the selected fields belong to the intended record. An unrelated background lookup is not the page’s main query.

2. Write down the actual API contract

Split the URL into environment host, projection ending in .svc, entity set or operation, and query options. Open API Explorer and find that projection. Check whether the operation is intended for integration and whether it is a read, action, or function.

Record the exact capitalization of entity and property names. Keep $select, $filter, and key syntax separate from the base URL. For a POST, additionally record the JSON payload and whether an ETag or another concurrency value is required. Do not replay a write until you understand its effect.

3. Recreate a read in Postman

1. Create a private collection named IFS request diagnosis and a GET request.
2. Paste the captured URL. Reduce $top to 1 where the entity collection supports it.
3. Remove browser cookies and captured Authorization values. Obtain a token for the intended integration identity using authentication.
4. In Authorization, select Bearer Token and reference a local secret variable named ifs_access_token.
5. Set Accept to application/json, send the request, and inspect the status and body.

Expected result: HTTP 200 and the expected record or an intentionally empty result under that user’s business scope. A successful administrator request is not evidence that the integration user is configured correctly.

4. Compare one difference at a time

Observation	Next check
Browser succeeds; Postman returns 401	Token expiry, issuer, audience, and the environment receiving it
Browser succeeds; integration identity returns 403	Projection/operation grants and business access for that identity
404	Copied host, projection spelling, operation route, and installed component
400	URL encoding, property types, query syntax, or JSON payload
200 with no rows	Filter and company/site access; remove one filter in a read-only test
Browser request is inside $batch	Inspect its individual request/response parts; the outer status alone is insufficient

For slow requests, compare Timing, response size, selected fields, and number of requests. Repeat the same read three times to distinguish a consistent delay from a one-off cold request. Do not infer database time from total network duration.

5. Produce a shareable reproduction

Create a fresh request with a fictional business key, environment placeholder, and no cookies or tokens. Remove response personal data. If a HAR is required, inspect its headers, query strings, request bodies, and responses before sharing; a file with an innocuous name can still contain credentials.

Record UTC time, method, sanitized route, status, and any server-provided request identifier. Use monitoring to join that identifier to server-side evidence. Delete local captures when diagnosis is complete and clear the temporary token variable.

For browser tooling details, see Chrome DevTools Network reference.

Sources and scope

• IFS integration decision guide

Older IFS Applications examples are historical context, not evidence of Cloud compatibility. No third-party code, screenshots, or downloadable workflows are reproduced.