FileMaker OData

CWP Snippets includes an fmOData class that hides OData authentication, URL encoding, field-name quoting, WordPress HTTP requests, and response decoding. It is separate from fmCWP because OData uses tables and primary keys while the FileMaker Data API uses layouts and record IDs.

Connect

The constructor follows the familiar fmCWP pattern. The third argument is a table occurrence rather than a layout.

$fm = new fmOData(
    FM_HOST_DEMO,
    FM_DATABASE_DEMO,
    'Contacts',
    FM_USER_DEMO,
    FM_PASSWORD_DEMO,
    FM_OPTIONS_DEMO
);

Get records

$result = $fm->getRecords([
    'limit' => 10,
    'offset' => 0,
    'count' => true,
    'sort' => [
        ['field' => 'Last Name', 'order' => 'asc'],
    ],
]);

$response = $fm->getResponse($result);
$error = $fm->isError($result);

fmOData automatically encloses field names containing spaces in the double quotes required by FileMaker OData.

Select only the fields you need

The select parameter is optional. Without it, OData returns every readable field included in the response. Define an explicit list of the fields the page actually needs whenever possible:

$params = [
    'select' => [
        'PrimaryKey',
        'First Name',
        'Last Name',
        'Company',
    ],
];

$result = $fm->getRecords($params);

The same parameter can be passed to getRecord(), findRecords(), and getRelatedRecords(). Include the primary key when the page needs it for links, editing, deleting, or related-record requests. fmOData converts the array to OData's $select option and handles field names containing spaces.

Selecting fields is an important data-minimization measure. It reduces the data exposed to PHP, debugging output, logs, caches, and the rendered page if one of those layers is mishandled. Treat the list as an allowlist defined by the developer rather than accepting field names directly from a visitor's request.

select does not replace FileMaker security. The FileMaker privilege set remains the authorization boundary and should restrict fields the OData account must never read. select limits this particular response; it does not prevent the same account from requesting another readable field.

When using the lower-level request() method, use OData's native $select option instead:

$result = $fm->request('GET', 'Contacts', [
    '$select' => 'PrimaryKey,Company',
]);

Find records

$result = $fm->findRecords([
    'query' => [
        [
            'field' => 'Last Name',
            'operator' => 'contains',
            'value' => 'Cates',
        ],
    ],
    'sort' => [
        ['field' => 'Last Name', 'order' => 'asc'],
    ],
    'limit' => 10,
]);

Supported structured operators are eq, ne, gt, ge, lt, le, contains, startswith, and endswith. Multiple criteria use and by default; specify 'combine' => 'or' to use or.

Create, edit, and delete

$result = $fm->createRecord([
    'First Name' => 'Ada',
    'Last Name' => 'Lovelace',
]);

$result = $fm->editRecord($primaryKey, [
    'Company' => 'Example Company',
]);

$result = $fm->deleteRecord($primaryKey);

OData operations use the table primary key declared in $metadata. They do not use the FileMaker Data API recordId unless the table falls back to ROWID.

Discovery, scripts, relationships, and containers

$fm->getDatabaseNames();
$fm->getTableNames();
$fm->getMetadata();
$fm->getRelatedRecords($primaryKey, 'Addresses');
$fm->runScript('Log request', 'parameter');
$fm->getContainerData($primaryKey, 'Photo');
$fm->uploadFileToContainer($primaryKey, 'Photo', 1, $filePath);

getContainerURL() returns the direct OData /$value URL, but a visitor's browser must authenticate to FileMaker Server to display that URL directly. getContainerData() retrieves the bytes on the WordPress server instead.

For an ordinary browser image without base64 or exposed FileMaker credentials, build a temporary signed URL to the CWP Snippets image proxy:

$imageURL = fmcwp_odata_url(
    'Contacts',
    $primaryKey,
    'Photo',
    1,
    'demo'
);

echo '<img src="' . esc_url($imageURL) . '" alt="Contact">';

The final argument selects the live or demo FileMaker connection stored in CWP Snippets. The browser receives only a signed WordPress URL. WordPress adds the FileMaker authorization header server-side, verifies the returned bytes are a supported image, and streams the binary response.

Advanced requests

Developers who already know OData can use the lower-level escape hatch:

$result = $fm->request('GET', 'Contacts', [
    '$filter' => "Company eq 'RGC Data LLC'",
]);

Use the structured methods where possible so field quoting, values, paging, and error handling remain consistent.