Information
- License: AGPL-3.0-only
- OpenAPI version:
3.1.0
Overview
Tilecast API 0.10.0
Section titled “Tilecast API 0.10.0”Management authentication accepts either an enrolled dashboard session cookie or a bearer user grant (an OAuth access token or a personal access token), and both produce the same user principal with the live role and screen scope. Grants additionally carry a scope ceiling of read, write, or admin (admin implies write implies read): reads take read, mutations take write, and user, token, grant, backup, and security administration take admin. CSRF is cookie-only: unsafe browser requests require X-CSRF-Token, bearer requests never send it. Browser security ceremonies (MFA, passkeys, logout, OAuth approval) stay session-only.
Operations
Section titled “ Operations ”GET
/healthzGET
/install.shGET
/readyzGET
/api/v1/demoPOST
/api/v1/usersDELETE
/api/v1/users/{id}PATCH
/api/v1/users/{id}POST
/api/v1/rolesDELETE
/api/v1/roles/{key}PATCH
/api/v1/roles/{key}PATCH
/api/v1/screens/{id}DELETE
/api/v1/fonts/{id}DELETE
/api/v1/locations/{id}POST
/api/v1/uploadsDELETE
/api/v1/uploads/{id}PATCH
/api/v1/uploads/{id}DELETE
/api/v1/assets/{id}PATCH
/api/v1/assets/{id}DELETE
/api/v1/playlists/{id}DELETE
/api/v1/schedules/{id}POST
/api/v1/widgetsPATCH
/api/v1/widgets/{id}POST
/api/v1/layoutsDELETE
/api/v1/layouts/{id}PATCH
/api/v1/layouts/{id}DELETE
/api/v1/campaigns/{id}PATCH
/api/v1/settingsPOST
/api/v1/formsAuthentication
Section titled “ Authentication ”browserPlayerSession
Section titled “browserPlayerSession”Independent Secure HttpOnly SameSite Strict Browser Player session. The cookie name has the prefix _Host-tilecast_player followed by the slot UUID. HTTP requests select the slot with X-Tilecast-Player-Slot. The WebSocket uses the non-secret browserSlot query parameter. Does not authorize Studio or native platform administration.
Security scheme type: apiKey
Cookie parameter name: __Host-tilecast_player
deviceBearer
Section titled “deviceBearer”Security scheme type: http
Bearer format: Tilecast device credential
userBearer
Section titled “userBearer”Security scheme type: http
Bearer format: Tilecast user grant (tca_ OAuth access token or tcp_ personal access token)
sessionCookie
Section titled “sessionCookie”Enrolled dashboard session cookie
Security scheme type: apiKey
Cookie parameter name: tilecast_session