Everything the dashboard does, it does through this API, so anything you can
click you can also automate.
Control endpoints live under /api/v1. Media and player routes sit at the root,
because players request them directly.
Tier How to authenticate None Nothing required. Playback and read-only endpoints, open like HLS itself. Session or token A session cookie from POST /api/v1/auth/login, or an API token. An app-scoped token reaches only its own application. Publish key A stream publish key, checked by the handler. Used by WHIP ingest, which encoders reach without an API token.
# Sign in and keep the session cookie
curl -c jar -X POST http://localhost:9001/api/v1/auth/login \
-H ' content-type: application/json ' \
-d ' {"username":"admin","password":"..."} '
curl -b jar http://localhost:9001/api/v1/apps
68 endpoints in total. This page is generated from the server’s route
table, so it lists what the build actually serves.
Method Path Auth Description POST/api/v1/auth/loginNone Sign in with a username and password. On success sets a session cookie; the body carries the user’s role and permissions. POST/api/v1/auth/logoutNone Destroy the current session and clear the cookie. GET/api/v1/auth/meNone Describe the caller: username, role, and which applications they may reach. Returns 401 when not signed in. POST/api/v1/auth/passwordNone Change the signed-in user’s own password. Required before anything else on a fresh install, where the initial admin password is marked as must-change.
Method Path Auth Description GET/api/v1/appsNone List applications. An application is a namespace for streams, VOD, ads, and keys. POST/api/v1/appsSession or token Create an application. Requires the global token; an app-scoped token cannot create applications. DELETE/api/v1/apps/{app}Session or token Delete an application and everything namespaced under it. PUT/api/v1/apps/{app}Session or token Update an application’s settings.
Method Path Auth Description GET/api/v1/apps/{app}/streamsNone List live streams in one application. POST/api/v1/apps/{app}/streamsSession or token Create a stream entry ahead of a publisher connecting. POST/api/v1/apps/{app}/streams/from-urlSession or token Pull a remote URL and republish it as a local stream. POST/api/v1/apps/{app}/streams/from-vodSession or token Start a stream whose source is a VOD asset rather than a live publisher. DELETE/api/v1/apps/{app}/streams/{id}Session or token Remove a stream. A publisher still connected will be disconnected. POST/api/v1/apps/{app}/streams/{id}/ad-breakSession or token Splice an ad break into a live stream. The break is inserted into the media timeline and signalled with a discontinuity, so it cannot be blocked client-side. GET/api/v1/apps/{app}/streams/{id}/now-playingSession or token What a playout channel is playing right now, its position, what comes next, and whether an ad is on air. DELETE/api/v1/apps/{app}/streams/{id}/recordSession or token Stop recording. POST/api/v1/apps/{app}/streams/{id}/recordSession or token Start recording a live stream to disk. POST/api/v1/apps/{app}/streams/{id}/skipSession or token Skip to the next item in the running playlist. GET/api/v1/apps/{app}/streams/{id}/statsNone Per-stream statistics: codecs, bitrate, viewer counts, and how long since the last frame arrived. POST/api/v1/apps/{app}/streams/{id}/whepNone WHEP playback. POST an SDP offer to receive the live stream over WebRTC, typically with sub-second latency. GET/api/v1/streamsNone List live streams across every application.
Method Path Auth Description DELETE/api/v1/whip/{app}/{name}Publish key End a WHIP publish session. POST/api/v1/whip/{app}/{name}Publish key WHIP ingest. Publish from a browser or any WHIP client by POSTing an SDP offer. Authenticated by a stream publish key, not by an API token.
Method Path Auth Description DELETE/api/v1/apps/{app}/vod/{name}Session or token Delete a VOD asset and its conditioned copies. POST/api/v1/apps/{app}/vod/{name}Session or token Upload a VOD asset. Large bodies are accepted; the server conditions the file afterwards so it can be played out cleanly. GET/live/{app}/{stream}/{file}None HLS playlist and segments. Request playlist.m3u8 to start playback. GET/vod/{app}/{*path}None Serve a VOD asset’s files directly. GET/watch/{app}/{stream}None Built-in player page for a stream. Public and unauthenticated, intended to be shared with viewers.
Method Path Auth Description GET/api/v1/apps/{app}/vodNone List VOD assets and whether each is conditioned and ready to play. POST/api/v1/apps/{app}/vod-prepare-allSession or token Condition every unprepared VOD asset in the application.
Method Path Auth Description GET/api/v1/apps/{app}/playlistsNone List playlists. POST/api/v1/apps/{app}/playlistsSession or token Create or replace a playlist: its items, whether it repeats, and which ads play between items. DELETE/api/v1/apps/{app}/playlists/{name}Session or token Delete a playlist. Does not delete the VOD assets it referenced. POST/api/v1/apps/{app}/playlists/{name}/go-liveSession or token Start a continuous channel from a playlist. Items play in order on one unbroken timeline. GET/api/v1/apps/{app}/playlists/{name}/preflightSession or token Check a playlist before going live: missing items, unconditioned assets, and anything else that would interrupt playout.
Method Path Auth Description GET/api/v1/apps/{app}/adsNone List ad assets and whether each is conditioned. DELETE/api/v1/apps/{app}/ads/{name}Session or token Delete an ad asset. POST/api/v1/apps/{app}/ads/{name}Session or token Upload an ad asset.
Method Path Auth Description GET/api/v1/apps/{app}/recordingsNone List recordings on disk. DELETE/api/v1/apps/{app}/recordings/{file}Session or token Delete a recording. GET/api/v1/apps/{app}/recordings/{file}None Download a recording.
Method Path Auth Description GET/api/v1/apps/{app}/restreamSession or token List restream targets. POST/api/v1/apps/{app}/restreamSession or token Create or update a restream target, such as another RTMP endpoint. DELETE/api/v1/apps/{app}/restream/{name}Session or token Delete a restream target. POST/api/v1/apps/{app}/restream/{name}/startSession or token Start forwarding to a target. POST/api/v1/apps/{app}/restream/{name}/stopSession or token Stop forwarding to a target.
Method Path Auth Description POST/api/v1/apps/{app}/app-key/regenerateSession or token Replace the application-scoped API token. GET/api/v1/apps/{app}/stream-keysSession or token List publish keys for the application. POST/api/v1/apps/{app}/stream-keysSession or token Create a publish key. Give one key per encoder so a single leak can be revoked alone. DELETE/api/v1/apps/{app}/stream-keys/{name}Session or token Revoke a publish key immediately. POST/api/v1/apps/{app}/stream-keys/{name}/regenerateSession or token Replace a publish key’s secret, keeping its name.
Method Path Auth Description GET/api/v1/usersSession or token List accounts. Administrators only. POST/api/v1/usersSession or token Create an account with a role. Administrators only. DELETE/api/v1/users/{username}Session or token Delete an account. Existing sessions for it stop working. PUT/api/v1/users/{username}Session or token Update an account’s role or which applications it may reach.
Method Path Auth Description GET/api/v1/licenseSession or token Current licence: tier, expiry, days remaining, and whether it is in its grace period. POST/api/v1/licenseSession or token Install a signed licence file. Verified offline against the public key built into the binary.
Method Path Auth Description GET/api/v1/settingsSession or token Read the running configuration. PUT/api/v1/settingsSession or token Write configuration to disk. Changes take effect on restart, and the response says so rather than pretending otherwise.
Method Path Auth Description GET/api/v1/crashesSession or token List captured crash reports. DELETE/api/v1/crashes/{file}Session or token Dismiss a crash report. GET/api/v1/crashes/{file}Session or token Read one crash report, including its panic message and backtrace. GET/api/v1/diagnosticsSession or token Download a diagnostics bundle describing the installation. Attach this to a support request. GET/api/v1/logsSession or token Recent log events from the in-memory ring buffer. GET/healthNone Liveness and a summary: version, commit, uptime, live stream count, and error and warning counts. Unauthenticated, so it can back a load balancer or container healthcheck.
Method Path Auth Description POST/api/v1/onvif/discoverSession or token Discover ONVIF cameras on the local network. POST/api/v1/onvif/stream-uriSession or token Resolve an ONVIF camera’s RTSP stream URI so it can be pulled as a source.
Method Path Auth Description GET/None The dashboard. A single-page interface over this same API.
