POST /auth/register
Content-Type: application/json
{"email": "user@example.com", "password": "min8chars"}Response: {"user_id": "usr_xxx", "token": "jwt..."}
POST /auth/login
Content-Type: application/json
{"email": "user@example.com", "password": "min8chars"}Response: {"token": "jwt...", "user_id": "usr_xxx", "role": "admin|user"}
POST /auth/forgot-password
POST /auth/reset-password
PUT /auth/password (Authenticated)GET /sys/statusResponse: {"initialized": true, "platform_name": "...", "allow_register": true}
POST /sys/setup
Content-Type: application/json
{"platform_name": "My IoT", "admin_email": "admin@example.com", "admin_password": "..."}Used only once to initialize the first admin.
(Require Admin Role - Authorization: Bearer JWT)
POST /admin/users
GET /admin/users
GET /admin/users/{user_id}
PUT /admin/users/{user_id}
DELETE /admin/users/{user_id}
POST /admin/users/{username}/reset-passwordGET /admin/dev
POST /admin/dev
GET /admin/dev/{device_id}
PUT /admin/dev/{device_id}
DELETE /admin/dev/{device_id}POST /admin/dev/{device_id}/rotate-key
POST /admin/dev/{device_id}/revoke-keyGET /admin/config
PUT /admin/config
PUT /admin/config/retention
PUT /admin/config/rate-limit
PUT /admin/config/alertsGET /admin/logs
DELETE /admin/logs
GET /admin/mqtt/stats
GET /admin/mqtt/clients(User Context - Authorization: Bearer JWT)
POST /dev/register
Content-Type: application/json
{
"device_uid": "mac_addr_or_id",
"device_name": "Living Room Sensor"
}GET /dev
Authorization: Bearer {jwt_token}POST /dev
Content-Type: application/json
{"name": "New Device", "type": "sensor"}GET /dev/{device_id}DELETE /dev/{device_id}(Hybrid Auth - Supports JWT (User) or API Key (Device))
POST /dev/{device_id}/data
Authorization: Bearer {api_key}
Content-Type: application/json
{"temperature": 25.5, "humidity": 60}Response: {"status": "ok", "commands_pending": 0}
For constrained devices (e.g., Simple Arduino/ESP8266 without JSON lib):
GET /dev/{device_id}/data?temp=25.5&humidity=60&battery=90
Authorization: Bearer {api_key}Note: Some client libraries may append the key as a query param if header auth is not supported, but Header is preferred.
GET /dev/{device_id}/dataGET /dev/{device_id}/data/history?last=1h
GET /dev/{device_id}/data/history?start=1766439614000&stop=1h&int=1m| Param | Description | Example |
|---|---|---|
start |
Unix timestamp (ms) | 1766439614000 |
stop |
Duration | 1h, 15m |
last |
Quick range from now | 24h, 7d |
int |
Aggregation interval | 1m, 1h, 1d |
POST /dev/{device_id}/cmd
Authorization: Bearer {jwt_token}
Content-Type: application/json
{"action": "reboot", "params": {"delay": 5}}GET /dev/{device_id}/cmdGET /dev/{device_id}/cmd/pending
Authorization: Bearer {api_key}Response: {"commands": [{"id": "...", "action": "...", "params": {...}}]}
POST /dev/{device_id}/cmd/{command_id}/ack
Authorization: Bearer {api_key}
Content-Type: application/json
{"status": "success", "result": {"executed": true}}POST /dev/register
Authorization: Bearer {jwt_token}POST /prov/activate
Content-Type: application/json
{"device_uid": "..."}(No Auth Required)
POST /pub/{device_id}
Content-Type: application/jsonGET /pub/{device_id}GET /sys/timeResponse: {"unix": 1700000000, "iso": "2024-..."}
GET /health
GET /ready