Evercam API api-gateway.46.224.5.95.sslip.io

Authentication

One Evercam access token works on every API behind the gateway. Send it as a bearer token:

Authorization: Bearer <token>

Getting a token

Sign in with your Evercam account:

curl -X POST https://api-gateway.46.224.5.95.sslip.io/dash/v2/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username": "you@example.com", "password": "…"}'

The response contains token. Tokens expire; when a call answers 401 with "type": "https://api-gateway.46.224.5.95.sslip.io/problems/unauthorized", sign in again.

Building an app for other Evercam users? Use OAuth instead of their password: GET /dash/v2/oauth/authorize and POST /dash/v2/oauth/token.

Accepted credentials

Credential How to send it Accepted by
Access token Authorization: Bearer <token> every API
Access token in the URL ?authorization=<token> every API
API key pair X-API-ID + X-API-KEY headers (or api_id / api_key query parameters) Dash, Admin
AI service key x-api-key: <key> AI only

Use the header form whenever you can. The query form exists for clients that can't set headers, such as an <img src> pointing at a snapshot, but URLs end up in browser history and server logs. The gateway moves a query token into the Authorization header before calling the API, so it never reaches the upstream's URLs.

If a request carries more than one credential, the first in this order is used and the others are dropped: Authorization, API key pair, ?authorization=, x-api-key.

What each API requires

API Without credentials
Dash Allowed where the endpoint is public (e.g. public cameras); otherwise the API answers 401
Admin 401; with a non-admin account, 403
AI, Labs, Workflows, 360, BIM, Drone 401, except health checks and webhook receivers

Credentials are checked by the gateway before the request is forwarded. A bad or expired token always gets the gateway's 401 problem, whichever API it was sent to. Each API still applies its own permissions (for example, which projects you can see).

Common errors

  • api-key-not-supported: you sent an API key pair to an API that only takes access tokens. Sign in and send Authorization: Bearer <token>.
  • unauthorized: missing, invalid or expired credentials, or an Authorization scheme other than Bearer (e.g. Basic).
  • forbidden: valid credentials without access (the Admin API needs an Evercam administrator).
  • identity-unavailable: the gateway couldn't verify your credentials right now. Retry after the Retry-After delay.

Every error is described on the errors page.