Introduction

​

Quick Start

​

Integration Options

const response = await fetch('https://api2.rhombussystems.com/api/camera/getMinimalCameraStateList', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-auth-scheme': 'api-token',
    'x-auth-apikey': 'YOUR_API_KEY'
  },
  body: JSON.stringify({})
});

const data = await response.json();
console.log(`Found ${data.cameraStates.length} cameras`);

# Generate client libraries using OpenAPI Generator
openapi-generator-cli generate \
  -i https://api2.rhombussystems.com/api/openapi/public.json \
  -g python \
  -o ./rhombus-python-client

# Or use other generators: java, csharp, go, php, etc.

curl -X POST https://api2.rhombussystems.com/api/camera/getMinimalCameraStateList \
  -H "Content-Type: application/json" \
  -H "x-auth-scheme: api-token" \
  -H "x-auth-apikey: YOUR_API_KEY" \
  -d '{}'

​

What You Can Build

​

Authentication & Base URL

x-auth-scheme: api-token
x-auth-apikey: YOUR_API_KEY

​

API tokens vs federated tokens

• API token: the key above. It is long-lived, carries its role’s permissions, and is sent as x-auth-scheme: api-token + x-auth-apikey. Keep it on your server. It works against the Rhombus cloud API and cloud media, but devices on your local network never accept it.
• Federated token: a short-lived token you mint with your API token by calling POST /api/org/generateFederatedSessionToken. It inherits the minting key’s role (optionally limited to one device with deviceUUid), expires after durationSec, and is sent as x-auth-scheme: federated-token + x-auth-ft, as headers or as query parameters on media URLs. Use it anywhere you can’t safely put your API key: browsers, video players, and streaming directly from devices on your LAN.

​

Community & Support