HTTP API

The front end reaches the autopilot and the database through SvelteKit server routes under /api. Every route except /api/auth/* requires a valid session (see the authentication section of Architecture).

MAVLink POST /api/mavlink/{type}

Commands and parameters are passed as request headers. {type} selects the operation.

Type	Headers	Behavior
reconnect	none	Forces the server to re-dial the autopilot link.
heartbeat	none	Opens the link on the first call, then polls status. Returns buffered log lines as JSON, or 503 when none are available.
send_command	command, params (comma-separated), useArduPilotMega, useCmdLong	Sends a MAVLink command. 400 when command is missing.
manual_control	x, y, z, r, buttons	Streams one gamepad frame as MANUAL_CONTROL.
clear_mission	none	Clears all mission items on the autopilot.
load_mission	actions (JSON map of index to mission item)	Uploads the mission, pacing items by 250 ms. 400 when actions is missing.
set_origin	lat, lon, alt	Sets the global origin and home to a manual point so a vehicle with no GPS holds a local position (SET_GPS_GLOBAL_ORIGIN + DO_SET_HOME). 400 on non-numeric input.
set_position_local	x, y, z	Commands a local-frame position (ArduPilot). 400 on non-numeric input.
set_depth	depth	Commands a submarine's depth-hold target as meters below the surface (ArduSub, SET_POSITION_TARGET_GLOBAL_INT with lat/lon masked). 400 on non-numeric depth.
request_params	none	Requests the full parameter set from the autopilot.
write_param	id, value, type	Writes one parameter. id is null-padded to 16 characters per the MAVLink parameter protocol. 400 on non-numeric value or type.

Errors return 500 with the error stack in the body.

GET /api/mavlink/stream is a server-sent-events feed that pushes each parsed telemetry line as it arrives, so the marker and HUD update in real time rather than on the heartbeat poll.

Missions POST /api/mission/{type}

Saved missions live in the SQLite mission table. Parameters are passed as headers.

Type	Headers	Behavior
save	title, actions	Inserts a mission row.
load	title	Marks the mission loaded.
unload	none	Clears the loaded flag on every mission.
checkExists	title	Returns matching rows, or {} when none.
update	title, actions	Replaces a mission's waypoints.
list	none	Returns all missions.
delete	title	Deletes a mission.

Airspace GET /api/airspace

Returns airspace zones for a bounding box, used by the map overlay and the pre-flight safety checks.

• Query: bbox=minLon,minLat,maxLon,maxLat.
• Response: { "zones": AirspaceZone[], "source": "openaip" | "faa" | "none", "configured": boolean }.
• Each AirspaceZone is { name, restricted, polygon }, where polygon is GeoJSON-style ring coordinates and restricted marks a hard no-fly zone.

The route reads OPENAIP_API_KEY on the server and queries OpenAIP worldwide when it is set. When the key is absent or OpenAIP returns nothing, it queries the FAA's keyless public airspace layers (US). With no bounding box or neither provider reachable it returns an empty zones list so planning still works. See Configuration.

Map data GET /api/{hazards,buildings,traffic,map-config}

Overlay and basemap data for the maps; the area endpoints take bbox=minLon,minLat,maxLon,maxLat and sit behind a short in-memory TTL cache keyed by rounded box.

• GET /api/hazards?bbox= returns LAANC ceiling grid cells and Digital Obstacle File points from the FAA's keyless layers.
• GET /api/buildings?bbox= returns building footprints with heights from OpenStreetMap Overpass.
• GET /api/traffic?bbox= returns nearby aircraft from keyless community ADS-B feeds (adsb.lol, then adsb.fi).
• GET /api/map-config returns the resolved basemap tile URLs, attributions, and the MapTiler key when one is configured.

NOTAMs GET /api/notams

GET /api/notams?lat=&lon= returns { state, notams } for the vehicle position. The position resolves to a US state through the keyless Census geocoder, and the active FAA temporary flight restrictions for that state come from the keyless TFR list. Each notice is enriched from its detail record with ceiling, effective, and facility, and carries a link to the FAA source. The list, the state lookup, and each detail record sit behind the TTL cache.

Flight controller GET /api/msp/{type}, POST /api/msp/reboot-bootloader

MultiWii Serial Protocol access to a connected Betaflight or INAV board, opt-in through MSP_SERIAL_PATH. See Firmware.

• GET /api/msp/status returns { configured }.
• GET /api/msp/detect returns { variant, firmware, version, apiVersion }, or 503 with { error } when no board answers.
• GET /api/msp/telemetry returns { attitude, gps, analog, altitude }.
• POST /api/msp/reboot-bootloader drops the board into DFU mode.

Firmware GET /api/firmware/{betaflight,inav,ardupilot,px4}, POST /api/firmware/flash

Firmware catalogs and flashing. See Firmware.

• GET /api/firmware/betaflight returns { targets, releases } from build.betaflight.com.
• GET /api/firmware/inav returns recent INAV releases with their per-target hex list.
• GET /api/firmware/ardupilot returns the latest stable board list per vehicle type from the ArduPilot manifest.
• GET /api/firmware/px4 returns recent PX4 releases with their per-board .px4 list.
• POST /api/firmware/flash takes one of { source: "inav", tag, target }, { source: "betaflight", release, target }, { source: "hex", hex } (DFU), or { source: "ardupilot" | "px4", url } (serial bootloader), and returns { success, output }.

AI PID tuning POST /api/ai/pid-tune

Takes { model, pids, vibration, attitude }: the connected autopilot string, the current PID gains, and the latest vibration and attitude telemetry. Builds a prompt and calls the OpenAI-compatible endpoint configured in Integrations (key, base URL, and model), then returns { summary, recommendations } where each recommendation is { param_id, current, suggested, reason }. Returns 400 when no key is configured or no gains are supplied, and 502 when the provider is unreachable or its reply cannot be parsed. See Configuration.

Auth POST /api/auth/{action}

Action	Body / state	Behavior
login	username, password	Verifies the account, creates a session, sets the session cookie. 400 on bad credentials.
register	username, password	Creates the first account and a session. Returns 403 once any account exists.
logout	session cookie	Invalidates the session.
checkAdmin	none	Reports whether an account exists yet.