Language: Deutsch · English

Architecture and API

How the app works: generic REST interpreter, endpoints used, technology stack and roadmap.

REFERENZ DEVELOPER UPDATED: JUL 2026 APPLIES TO NUCLOS APP 1.0

On this page

At its core the app is an interpreter of the generic Nuclos REST API. It contains no Nuclet-specific code; structure, layout and data come from the server at runtime.

Endpoints used

POST /rest                              Login (Cookie-Session, JSESSIONID)
POST /rest  (anonymous/anonymous)       Anonymer Login
GET  /rest/ssoAuthEndpoints             konfigurierte SSO-Dienste (Label, Icon, Farbe)
PUT  /rest/ssoAuthEndpoints/{id}        SSO-Flow starten -> Authorize-URL (PKCE)
POST /rest  (loginUri, serverUri)       SSO-Login abschliessen (Token-Tausch serverseitig)
GET  /rest/datalanguages                verfuegbare Datensprachen
PUT  /rest/datalanguage                 aktive Datensprache setzen
POST /rest/user/register                Selbstregistrierung
POST /rest/user/activate/{code}         Konto aktivieren
PUT  /rest/user/{user}/password         Passwort aendern
POST /rest/user/{user}/forgotPassword   Reset-E-Mail anfordern
POST /rest/user/{user}/passwordReset    Passwort per Code zuruecksetzen
GET  /rest/bos                          Entitaeten (Business Objects)
GET  /rest/boMetas/{id}                 Metadaten (Attribute, Typen, titlePattern)
GET  /rest/bos/{id}?offset=&chunkSize=  Datensaetze (mit Paging)
POST /rest/bos/{id}/query               Suche/Filter
     boGenerations                      Neuanlage (Objektgeneratoren)

Technology

Flutter (native rendering engine), Material 3.
dio + a persistent cookie jar (cookie_jar) – REST with a cookie session (like the Web Client's withCredentials); the session is kept on disk and survives an app restart.
flutter_riverpod – state management.
local_auth + flutter_secure_storage – biometrics & secure credential storage.
webview_flutter – in-app sign-in page for SSO; flutter_html – HTML messages from server commands.
fl_chart (charts), file_picker/image_picker (attachments/camera).

Session & commands

The session is persisted; when it expires the app attempts a silent re-login and only falls back to the login screen on failure. Server commands (message, navigation, session end) run after save/rule/status change.

Web & CORS

For the Web build, CORS is required on the server because of the cookie session. Not needed on iOS/Android.