API
Updated: 10/25/2026
Basics 6 pages
- Base URL, /v1, and stabilityWhere the base URL comes from, why almost every route carries /v1, which paths lie outside it, and what x-stability promises per operation.
- Authentication: keys and sessionsBearer header, key prefixes, permission scope, expiry and rotation of a key, and when a session makes more sense than a key.
- The error formatThe error body with code, message, and traceId, the RFC 9457 form, and the rule by which a code becomes the HTTP status.
- Concurrent changes: ETag and If-MatchRead a versioned resource, send the version back as If-Match, and resolve a 409 conflict cleanly.
- Throttling and rate-limit headersWhich routes have a limit of their own, which rate limit is attached to a key, what the four headers mean, and how a client reacts to 429.
- Paging: limit, cursor, items, nextCursorCursor paging on all lists, the limits 50/200 and 25/100, the four routes with page, and how the CLI follows all pages with --all.
Access methods and resources 5 pages
- Delegated access with OAuth 2.1Your application runs at other customers’ sites: register, have users consent with PKCE, exchange the oat_ token, renew, revoke.
- Provisioning with SCIM 2.0A directory service should create accounts, suspend them, and set roles: token sct_, endpoints under /scim/v2, mapping, and errors.
- The MCP service for AI assistantsAn assistant should work with your inventory: address, authentication, tool list, confirmation requirement, limits, and errors.
- LocationsMirror a branch structure: fields of a location, its routes, assigning a display, and analytics by location.
- Web displaysCreate a display with no device behind it: routes, connection URL, the two states, deletion, and the limits compared with a device.
Error codes 7 pages
- Error codes: possible on any routeThe platform-wide codes for authentication, permissions, validation, conflicts, throttling, payload, HTTP, events, caching, jobs, and resources.
- Error codes: accounts and sessionsThe codes of the areas Identity and Sessions: user accounts, keys, invitations, sign-in, second factor, sessions.
- Error codes: organization, access, joiningThe codes of the areas Tenancy, Access, Onboarding, and Cloud-Connections: master data, domain, roles, grants, registration, storage connections.
- Error codes: billingThe codes of the area Billing: package, licenses, add-ons, payment method, invoices, and why 402 appears here.
- Error codes: media, scenes, programs, appsThe codes of the areas Media-Library, Composition, Scheduling, App-Catalog, Marketplace, App-Runtime, and Advertising.
- Error codes: devices, playback, notifications, operationsThe codes of the areas Fleet, Playback, Realtime, Notifications, Analytics, Audit, and Ops-Console, the latter only on operator routes.
- Error codes: server errors (5xx)The 119 codes to which a client cannot react in a domain-specific way: invariants, startup, database, downstream services. Retry or report.
Guide to the reference 3 pages
- Read the referenceFind an operation at /api/reference, read off permission, security scheme, example, and stability, and download the specification.
- The areas of the referenceThe 19 tags of the specification in their 7 groups with one sentence of purpose each, and why the operator surface is not part of it.
- Generate your own client from the specificationThere is currently no published client. Here is how you generate your own from openapi.json and map the conventions of the API into it.