HTTP API

HTTP API

The front end reaches the autopilot and the database through SvelteKit server routes under /api. Every route except /api/auth/* requires a valid session (see the authentication section of Architecture).

MAVLink POST /api/mavlink/{type}

Commands and parameters are passed as request headers. {type} selects the operation.

Type	Headers	Behavior
heartbeat	none	Opens the link on the first call, then polls status. Returns buffered log lines as JSON, or 503 when none are available.
send_command	command, params (comma-separated), useArduPilotMega, useCmdLong	Sends a MAVLink command. 400 when command is missing.
clear_mission	none	Clears all mission items on the autopilot.
load_mission	actions (JSON map of index to mission item)	Uploads the mission, pacing items by 250 ms. 400 when actions is missing.
set_position_local	x, y, z	Commands a local-frame position (ArduPilot). 400 on non-numeric input.
request_params	none	Requests the full parameter set from the autopilot.
write_param	id, value, type	Writes one parameter. id is null-padded to 16 characters per the MAVLink parameter protocol. 400 on non-numeric value or type.

Errors return 500 with the error stack in the body.

Missions POST /api/mission/{type}

Saved missions live in the SQLite mission table. Parameters are passed as headers.

Type	Headers	Behavior
save	title, actions	Inserts a mission row.
load	title	Marks the mission loaded.
unload	none	Clears the loaded flag on every mission.
checkExists	title	Returns matching rows, or {} when none.
update	title, actions	Replaces a mission's waypoints.
list	none	Returns all missions.
delete	title	Deletes a mission.

Airspace GET /api/airspace

Returns airspace zones for a bounding box, used by the map overlay and the pre-flight safety checks.

• Query: bbox=minLon,minLat,maxLon,maxLat.
• Response: { "zones": AirspaceZone[], "source": "openaip" | "faa" | "none", "configured": boolean }.
• Each AirspaceZone is { name, restricted, polygon }, where polygon is GeoJSON-style ring coordinates and restricted marks a hard no-fly zone.

The route reads OPENAIP_API_KEY on the server and queries OpenAIP worldwide when it is set. When the key is absent or OpenAIP returns nothing, it queries the FAA's keyless public airspace layers (US). With no bounding box or neither provider reachable it returns an empty zones list so planning still works. See Configuration.

Map data GET /api/{hazards,buildings,traffic,map-config}

Overlay and basemap data for the maps; the area endpoints take bbox=minLon,minLat,maxLon,maxLat and sit behind a short in-memory TTL cache keyed by rounded box.

• GET /api/hazards?bbox= returns LAANC ceiling grid cells and Digital Obstacle File points from the FAA's keyless layers.
• GET /api/buildings?bbox= returns building footprints with heights from OpenStreetMap Overpass.
• GET /api/traffic?bbox= returns nearby aircraft from keyless community ADS-B feeds (adsb.lol, then adsb.fi).
• GET /api/map-config returns the resolved basemap tile URLs, attributions, and the MapTiler key when one is configured.

Auth POST /api/auth/{action}

Action	Body / state	Behavior
login	username, password	Verifies the account, creates a session, sets the session cookie. 400 on bad credentials.
register	username, password	Creates the first account and a session. Returns 403 once any account exists.
logout	session cookie	Invalidates the session.
checkAdmin	none	Reports whether an account exists yet.