Server API¶
The server's HTTP API, described as OpenAPI (Swagger 2.0) files, one per service. This index tells you which folder holds what and how a call is authenticated; the files themselves are the reference.
| Section | Contents |
|---|---|
| Public API | What a signed-in user can do: browse, play, collect, request. |
| Admin API | Server administration: configuration, transcoding, backups, metadata, users. |
| Plugin API | Plugin management, webhooks, and the preferences a plugin's interface keeps per user. |
Every .swagger.json file imports into any OpenAPI tool (Swagger UI, Postman,
Insomnia). The HTTP routes are generated from the gRPC definitions in
proto/evey/v1/, so a method name in a file is the gRPC method behind it.
Authentication¶
Three kinds of credential reach the API, all in the Authorization header:
| Credential | Who | How |
|---|---|---|
| Session token | A person signed in through an app | Bearer <token>, obtained by signing in and renewed by the app. |
| API key | A script, on behalf of the administrator who created it | Bearer evey_... (the Bearer prefix is optional). Scoped, revocable: Webhooks and API keys. |
| Plugin token | A plugin's interface, through the host page | Minted for five minutes for one plugin and one user, carrying only the public and prefs scopes the plugin was granted; every other method refuses it. The frame never holds it: the host page proxies the calls. |
A plugin token can never reach an administration method, whatever its scopes (ADR-0003, ADR-0012).
Regeneration¶
For contributors: the files are regenerated from the protobuf definitions.