Repository navigation
Technical API
Audience: developers and integration maintainers. Baseline reviewed: 2026-10-29.
plugin/API/router.php maps the API path into the request's APIName and dispatches GET to get.json.php, with POST/DELETE going to set.json.php. The entry points load application configuration, merge input and call the API plugin. Method implementations are in plugin/API/API.php.
The API plugin reference lists actual named methods and request references. OpenAPI generation/documentation is implemented through the plugin's Swagger files/attributes. Confirm the deployed rewrite/router configuration before using a pretty /api/... URL.
Several metadata methods are intentionally public. Other operations require an APISecret, a user identity, ownership/capabilities, a video password or another specific condition. Do not assume one authorization model applies to every method.
Bearer-token extraction can populate APISecret. The presence of a valid site API secret is distinct from a particular user's authenticated session and from permission to watch the requested content.
Bootstrap can authenticate user/pass requests through CustomizeUser::getStart() and User::loginFromRequest() before endpoint code runs. Therefore User::isLogged() alone does not establish that this request's supplied credentials were verified. The current code records verified request-credential login separately and allows API entry points to opt into switching an old cookie session to the requested account.
Treat endpoint URLs, parameter names and response shapes as compatibility contracts for mobile and third-party clients. Additive changes are different from renaming/removing existing fields.
Metadata fields and actual playable source URLs have different access implications. Public metadata support is deliberate in relevant methods. Follow the method's filtering and playback checks rather than imposing an unrelated browser-page contract.
Responses joining user data must follow the current API field-filtering behavior. A computed display name and a raw database user row are different data contracts.
Router preflight handling, actual-response CORS behavior, browser cookies, bearer tokens and request credentials are distinct mechanisms. Inspect the relevant layer when a client works in one environment and fails in another.
Video::getImageFromFilename() can remove Set-Cookie from a response. A listing response containing images therefore cannot be assumed to establish a new client session. Follow the authentication strategy used by the actual mobile/API client.
Record the method, route, HTTP verb, input encoding and safe response fields. Establish whether the failure is routing, disabled plugin, input conversion, credentials, ownership, business validation or serialization. For video operations, check metadata and actual playback separately. For writes, verify the persisted result and follow-up state.
Do not use a generated file inventory as a complete API schema. Use the actual method and its OpenAPI declaration, then test the supported client flow. Documentation generation did not exercise authenticated or cross-origin integration requests.
