Skip to content

HTTP API

Everything the dashboard does, it does through this API, so anything you can click you can also automate.

Control endpoints live under /api/v1. Media and player routes sit at the root, because players request them directly.

TierHow to authenticate
NoneNothing required. Playback and read-only endpoints, open like HLS itself.
Session or tokenA session cookie from POST /api/v1/auth/login, or an API token. An app-scoped token reaches only its own application.
Publish keyA stream publish key, checked by the handler. Used by WHIP ingest, which encoders reach without an API token.
Terminal window
# Sign in and keep the session cookie
curl -c jar -X POST http://localhost:9001/api/v1/auth/login \
-H 'content-type: application/json' \
-d '{"username":"admin","password":"..."}'
# Then use it
curl -b jar http://localhost:9001/api/v1/apps

81 endpoints in total. This page is generated from the server’s route table, so it lists what the build actually serves.

MethodPathAuthDescription
POST/api/v1/auth/loginNoneSign in with a username and password. On success sets a session cookie; the body carries the user’s role and permissions.
POST/api/v1/auth/logoutNoneDestroy the current session and clear the cookie.
GET/api/v1/auth/meNoneDescribe the caller: username, role, and which applications they may reach. Returns 401 when not signed in.
POST/api/v1/auth/passwordNoneChange the signed-in user’s own password. Required before anything else on a fresh install, where the initial admin password is marked as must-change.
MethodPathAuthDescription
GET/api/v1/appsNoneList applications. An application is a namespace for streams, VOD, ads, and keys.
POST/api/v1/appsSession or tokenCreate an application. Requires the global token; an app-scoped token cannot create applications.
DELETE/api/v1/apps/{app}Session or tokenDelete an application and everything namespaced under it.
PUT/api/v1/apps/{app}Session or tokenUpdate an application’s settings. Send only the sections you mean to change: recording, abr, scte35 (ad breaks from SCTE-35 markers), vast (ads per viewer from an ad server), overrides, and the rest. A section that is sent replaces that section as a whole.
MethodPathAuthDescription
GET/api/v1/apps/{app}/streamsNoneList live streams in one application.
POST/api/v1/apps/{app}/streamsSession or tokenCreate a stream entry ahead of a publisher connecting.
POST/api/v1/apps/{app}/streams/from-urlSession or tokenPull a remote URL and republish it as a local stream.
POST/api/v1/apps/{app}/streams/from-vodSession or tokenStart a stream whose source is a VOD asset rather than a live publisher.
DELETE/api/v1/apps/{app}/streams/{id}Session or tokenRemove a stream. A publisher still connected will be disconnected.
POST/api/v1/apps/{app}/streams/{id}/ad-breakSession or tokenSplice an ad break into a live stream. The break is inserted into the media timeline and signalled with a discontinuity, so it cannot be blocked client-side.
GET/api/v1/apps/{app}/streams/{id}/now-playingSession or tokenWhat a playout channel is playing right now, its position, what comes next, and whether an ad is on air.
POST/api/v1/apps/{app}/streams/{id}/overlaySession or tokenShow or hide an overlay on a live stream. Every rendition is switched together, and a rendition that refuses is reported: an advertisement shown to part of the audience is worse than one shown to none. The overlay must already be attached to the stream.
DELETE/api/v1/apps/{app}/streams/{id}/recordSession or tokenStop recording.
POST/api/v1/apps/{app}/streams/{id}/recordSession or tokenStart recording a live stream to disk.
POST/api/v1/apps/{app}/streams/{id}/skipSession or tokenSkip to the next item in the running playlist.
GET/api/v1/apps/{app}/streams/{id}/statsNonePer-stream statistics: codecs, bitrate, viewer counts, and how long since the last frame arrived.
POST/api/v1/apps/{app}/streams/{id}/whepNoneWHEP playback. POST an SDP offer to receive the live stream over WebRTC, typically with sub-second latency.
GET/api/v1/streamsNoneList live streams across every application.
MethodPathAuthDescription
GET/api/v1/ingestNoneWhere publishers connect: the RTMP port, and the SRT port, latency and whether a passphrase is required (never the passphrase itself). srt is null when SRT ingest is switched off. Public, like the ports; the dashboard builds its RTMP and SRT addresses from it.
DELETE/api/v1/whip/{app}/{name}Publish keyEnd a WHIP publish session.
POST/api/v1/whip/{app}/{name}Publish keyWHIP ingest. Publish from a browser or any WHIP client by POSTing an SDP offer. Authenticated by a stream publish key, not by an API token.
MethodPathAuthDescription
DELETE/api/v1/apps/{app}/vod/{name}Session or tokenDelete a VOD asset and its conditioned copies.
POST/api/v1/apps/{app}/vod/{name}Session or tokenUpload a VOD asset. Large bodies are accepted; the server conditions the file afterwards so it can be played out cleanly.
GET/live/{app}/{stream}/s/{session}/{file}NoneA viewer’s own copy of the stream’s playlist, reached by the redirect from playlist.m3u8. Each request keeps the viewer counted. Its segments point back at the shared files, so a CDN caches them once for everyone.
GET/live/{app}/{stream}/s/{session}/{rendition}/{file}NoneOne rendition of a viewer’s own playlist, reached through their multivariant playlist.
GET/live/{app}/{stream}/{file}NoneHLS playlist and segments. Request playlist.m3u8 to start playback: with [hls] sessions on, the player is redirected once to a playlist address of its own, which is how HLS viewers are counted. Segments are always the shared files.
GET/live/{app}/{stream}/{rendition}/{file}NoneOne rendition’s HLS playlist and segments. Players reach these through the multivariant playlist rather than directly.
GET/vod/{app}/{*path}NoneServe a VOD asset’s files directly.
GET/watch/{app}/{stream}NoneBuilt-in player page for a stream. Public and unauthenticated, intended to be shared with viewers.
MethodPathAuthDescription
GET/api/v1/apps/{app}/vodNoneList VOD assets and whether each is conditioned and ready to play.
POST/api/v1/apps/{app}/vod-prepare-allSession or tokenCondition every unprepared VOD asset in the application.
MethodPathAuthDescription
GET/api/v1/apps/{app}/playlistsNoneList playlists.
POST/api/v1/apps/{app}/playlistsSession or tokenCreate or replace a playlist: its items, whether it repeats, and which ads play between items.
DELETE/api/v1/apps/{app}/playlists/{name}Session or tokenDelete a playlist. Does not delete the VOD assets it referenced.
POST/api/v1/apps/{app}/playlists/{name}/go-liveSession or tokenStart a continuous channel from a playlist. Items play in order on one unbroken timeline.
GET/api/v1/apps/{app}/playlists/{name}/preflightSession or tokenCheck a playlist before going live: missing items, unconditioned assets, and anything else that would interrupt playout.
MethodPathAuthDescription
GET/api/v1/apps/{app}/adsNoneList ad assets and whether each is conditioned.
DELETE/api/v1/apps/{app}/ads/{name}Session or tokenDelete an ad asset.
POST/api/v1/apps/{app}/ads/{name}Session or tokenUpload an ad asset.
GET/api/v1/apps/{app}/overlaysNoneList overlay graphics and whether each one’s asset is still on disk. An overlay whose file has gone is listed rather than hidden, because streams may still reference it and an operator needs to see why their banner stopped appearing.
DELETE/api/v1/apps/{app}/overlays/{name}Session or tokenDelete an overlay and its asset. Streams still naming it log a warning when they next go live rather than failing to start.
POST/api/v1/apps/{app}/overlays/{name}Session or tokenUpload an overlay’s asset and define it. Send a PNG as image/png or a WebM with alpha as video/webm; without an alpha channel an overlay is an opaque rectangle over the picture. Position and size are query parameters, as percentages of the frame, so one definition is correct on every rendition.
MethodPathAuthDescription
GET/api/v1/apps/{app}/recordingsNoneList recordings on disk.
DELETE/api/v1/apps/{app}/recordings/{file}Session or tokenDelete a recording.
GET/api/v1/apps/{app}/recordings/{file}NoneDownload a recording.
MethodPathAuthDescription
GET/api/v1/apps/{app}/restreamSession or tokenList restream targets.
POST/api/v1/apps/{app}/restreamSession or tokenCreate or update a restream target, such as another RTMP endpoint.
DELETE/api/v1/apps/{app}/restream/{name}Session or tokenDelete a restream target.
POST/api/v1/apps/{app}/restream/{name}/startSession or tokenStart forwarding to a target.
POST/api/v1/apps/{app}/restream/{name}/stopSession or tokenStop forwarding to a target.
MethodPathAuthDescription
POST/api/v1/apps/{app}/app-key/regenerateSession or tokenReplace the application-scoped API token.
GET/api/v1/apps/{app}/stream-keysSession or tokenList publish keys for the application.
POST/api/v1/apps/{app}/stream-keysSession or tokenCreate a publish key. Give one key per encoder so a single leak can be revoked alone.
DELETE/api/v1/apps/{app}/stream-keys/{name}Session or tokenRevoke a publish key immediately.
POST/api/v1/apps/{app}/stream-keys/{name}/regenerateSession or tokenReplace a publish key’s secret, keeping its name.
MethodPathAuthDescription
GET/api/v1/usersSession or tokenList accounts. Administrators only.
POST/api/v1/usersSession or tokenCreate an account with a role. Administrators only.
DELETE/api/v1/users/{username}Session or tokenDelete an account. Existing sessions for it stop working.
PUT/api/v1/users/{username}Session or tokenUpdate an account’s role or which applications it may reach.
MethodPathAuthDescription
GET/api/v1/licenseSession or tokenCurrent licence: tier, expiry, days remaining, and whether it is in its grace period.
POST/api/v1/licenseSession or tokenInstall a signed licence file. Verified offline against the public key built into the binary.
POST/api/v1/license/activateSession or tokenInstall a licence by its ID, the lic_… line in the licence email: the server fetches it from the licence service ([license].renew_url) and verifies its signature before writing it, then applies it at once. Body {"license_id": "lic_…"}. 404 for an unknown ID, 409 when this server is set not to contact the service, 502 when the service cannot be reached.
MethodPathAuthDescription
GET/api/v1/settingsSession or tokenRead the running configuration.
PUT/api/v1/settingsSession or tokenWrite configuration to disk. Changes take effect on restart, and the response says so rather than pretending otherwise.
MethodPathAuthDescription
GET/api/v1/crashesSession or tokenList captured crash reports.
DELETE/api/v1/crashes/{file}Session or tokenDismiss a crash report.
GET/api/v1/crashes/{file}Session or tokenRead one crash report, including its panic message and backtrace.
GET/api/v1/diagnosticsSession or tokenDownload a diagnostics bundle describing the installation. Attach this to a support request.
GET/api/v1/logsSession or tokenRecent log events from the in-memory ring buffer.
GET/healthNoneLiveness and a summary: version, commit, uptime, live stream count, and error and warning counts. Unauthenticated, so it can back a load balancer or container healthcheck.
MethodPathAuthDescription
POST/api/v1/onvif/discoverSession or tokenDiscover ONVIF cameras on the local network.
POST/api/v1/onvif/stream-uriSession or tokenResolve an ONVIF camera’s RTSP stream URI so it can be pulled as a source.
MethodPathAuthDescription
GET/NoneThe dashboard. A single-page interface over this same API.
MethodPathAuthDescription
GET/ads/hls/{creative}/{variant}/{file}NoneA segment of an ad from an ad server, in one rendition. Listed in viewers’ own playlists during a break; the same file for every viewer who gets that ad, so a CDN may cache it.
GET/api/v1/apps/{app}/stream-settingsSession or tokenEvery stream in an application that has settings of its own: an adaptive bitrate ladder, the overlays it carries, or both. Streams that follow their application entirely are not listed.
PUT/api/v1/apps/{app}/stream-settings/{name}Session or tokenGive one stream its own adaptive bitrate ladder, or the set of overlays it carries. Send only the field you mean to change: an omitted field is left as it is, while an explicit null for abr hands the stream back to its application’s ladder. Both take effect the next time the stream goes live. Administrators only, because both spend server CPU.
GET/api/v1/systemSession or tokenHow the machine is doing: CPU (overall and Jadarit’s own share), memory, free space on the data disk, network in and out, load, temperature and clock speed where the hardware reports them, with the last three minutes of samples. Updated every 2 seconds.