HTTP API Documentation

Scope and authentication

This page describes the REST API of the LAN service embedded in the current Admin/Player apps and cxserver. Use the address shown on that service page, for example http://192.168.1.10:9393. Do not append these paths to a documentation URL or an MCP endpoint; cloud services may use different login and upload APIs.

Protected requests accept Authorization: ApiKey <LAN API Key> or Authorization: Bearer <LAN login token>. X-Authorization is also accepted. The key or token must belong to this LAN service and the account must have permission for the target entity.

Read-only connection check (POSIX shell; replace the address and set your own key):

export LAN_ORIGIN="http://192.168.1.10:9393"
# Set MHT_API_KEY privately in your local environment.
curl --fail-with-body "$LAN_ORIGIN/api/user" \
  -H "Authorization: ApiKey $MHT_API_KEY"

A successful response is a user JSON object. HTTP 401 indicates missing or invalid credentials; 403 indicates insufficient permission. Other error bodies may include errCode and errMsg. Check the HTTP status and operation-specific response; an HTTP connection alone does not verify account access.

For an Agent integration, use the MCP guide, which also explains direct file uploads.

Table of Contents

• Authentication APIs
• Device Management
• Media Resource Management
• Program Management
• Entity Query
• Relation Management
• File Upload
• Other APIs

---

Authentication APIs

User Login

The current LAN login accepts passwordHash (the MD5-derived client login secret), not the plaintext password field. Prefer a dedicated API Key for scripts.

• Method: POST
• Path: /api/nauth/login
• Parameters:

  {
    "username": "admin",
    "passwordHash": "MD5 login secret derived from the password"
  }

• Success Response:

  {
    "token": "JWT token"
  }

• Failure Response: 401 Unauthorized

Change Password

• Method: POST
• Path: /api/user/setPwd
• Parameters:

  {
    "oldPwd": "old password",
    "newPwd": "new password"
  }

• Success Response: 200 OK
• Failure Response: 401 Unauthorized

Get User Info

• Method: GET
• Path: /api/user
• Response:

  {
    "id": "user ID",
    "email": "user@localhost",
    "authority": "TENANT_ADMIN",
    "tenantId": "tenant ID",
    "customerId": "customer ID"
  }

---

Device Management

Create Device

• Method: POST
• Path: /api/device
• Parameters: Device JSON object
• Response: Created device object

Delete Device

• Method: DELETE
• Path: /api/device/{device ID}
• Response: 200 OK

Get Device by Credential

• Method: GET
• Path: /api/device/cre/{device credential}
• Response: Device object

Batch Get Devices

• Method: GET
• Path: /api/device/ids
• Parameters: ids=id1,id2,id3
• Response: Device list

Device RPC Call

• Method: POST
• Path: /api/device/rpc/{device ID}
• Parameters: RPC command object
• Response: RPC response object

Get Device Attributes

• Method: GET
• Path: /api/device/attributes
• Parameters:
  • deviceId: Device ID
  • scope: Attribute scope (default: CLIENT_SCOPE)
  • keys: Attribute keys (comma separated)
• Response: Attribute key-value pairs

---

Media Resource Management

Batch Get Media Resources

• Method: GET
• Path: /api/mhoss/ids
• Parameters: ids=id1,id2,id3
• Response: MHOss list (includes LAN access URLs)

Get Unused Media Resources

• Method: GET
• Path: /api/mhoss/notUsed
• Parameters:
  • startTime: Start timestamp
  • endTime: End timestamp
  • page: Page number
  • pageSize: Items per page
  • textSearch: Search text
• Response: Paginated MHOss list (includes LAN access URLs)

Delete Media Resources

• Method: DELETE
• Path: /api/mhoss/ids
• Parameters: ids=id1,id2,id3
• Response: Delete result

Create/Update Media Resource

• Method: POST
• Path: /api/mhoss
• Parameters: MHOss object
• Response: Created/updated MHOss object

---

Program Management

Get Program Details

• Method: GET
• Path: /api/nauth/mhcast/{program ID}
• Response: MHCast object (media resources include LAN URLs)

Delete Program

• Method: DELETE
• Path: /api/mhcast/{program ID}
• Response: 200 OK

Create/Update Program

• Method: POST
• Path: /api/mhcast
• Parameters: MHCast object
• Response: Created/updated MHCast object

Notify Program Change

• Method: GET
• Path: /api/mhcast/notify/{program ID}
• Response: Notification result

Get Program Relation List

• Method: GET
• Path: /api/mhcast/castRelations
• Parameters: deviceId=device ID
• Response: Program relation list

---

Entity Query

Query Entities

• Method: POST
• Path: /api/entitiesQuery/find
• Parameters: EntityDataQuery object
• Response: Paginated entity data result

---

Relation Management

Create Relation

• Method: POST
• Path: /api/relation
• Parameters: EntityRelation object
• Response: Created relation object

Batch Create Relations

• Method: POST
• Path: /api/relation/list
• Parameters: List of relation objects
• Response: 200 OK

Delete Relation

• Method: DELETE
• Path: /api/relation
• Parameters: EntityRelation object
• Response: 200 OK

Batch Delete Relations

• Method: DELETE
• Path: /api/relation/ids
• Parameters:

  {
    "direction": "FROM|TO",
    "relationType": "relation type",
    "relationTypeGroup": "relation group",
    "entityIdList": ["entity ID1", "entity ID2"]
  }

• Response: Number of deleted relations

Query Relation List

• Method: GET
• Path: /api/relations
• Parameters:
  • Option 1: fromId=source ID&fromType=source type
  • Option 2: toId=target ID&toType=target type
• Response: Relation list

---

File Upload

Current LAN services use upload sessions rather than the legacy /upload form endpoint:

Method	Path	Purpose
POST	/api/objectUpload/init	Select storage and create a direct or multipart upload session
POST	/api/objectUpload/part	Obtain a part upload URL for a multipart session
POST	/api/objectUpload/complete	Complete the upload session
POST	/api/objectUpload/abort	Abort an unfinished session

Use the exact URL and headers returned by initialization to upload the bytes; do not construct an object-storage URL or add the API Key to it. The LOCAL provider can return /upload/object/... on the LAN service, while other providers can return object-storage URLs.

Finishing the upload does not by itself create an MHOss media record. Create the media entity with /api/mhoss using the completed upload result. For Agent workflows, MCP provides initialization, direct upload and media-library completion steps. The session payload and part sizes must follow the running service response.

---

Other APIs

Get Current Timestamp

• Method: GET
• Path: /api/nauth/realts
• Response: Current timestamp string

Device Hello Check

• Method: GET
• Path: /api/nauth/hello
• Parameters:
  • deviceCre: Device credential (optional)
  • port: Port number (optional)
• Response:

  {
    "update": "whether LAN address updated",
    "deviceCre": "server device credential (if not provided in request)"
  }

Generate Dynamic Device Code (DDC)

• Method: POST
• Path: /api/nauth/getDdc
• Response:

  {
    "ddc": "dynamic device code",
    "expireInMin": 10,
    "checkInSec": 5
  }

Check DDC Status

• Method: GET
• Path: /api/nauth/checkDdc
• Parameters: ddc=dynamic device code
• Response:

  {
    "verifiedTs": "verification timestamp (0 means not verified)"
  }

Input DDC Verification Code

• Method: POST
• Path: /api/device/inputDdc
• Parameters:
  • Query: ddc=dynamic device code
  • Body: Verification code string or JSON {"code": "verification code"}
• Response: Verification result