What the API covers
- Browser and native account sessions.
- Display enrollment, credential replacement, removal, and bounded health reports; physical reset is a separate device operation.
- Complete catalog listing and the app installation lifecycle; clients filter the catalog locally.
- Immutable app schemas, supported static fields, and reviewed user/publisher credential routes.
- App order, brightness, schedules, scenes, and firmware policy.
- Developer projects, immutable revisions, and review submissions.
- Platform OAuth discovery, token exchange, refresh, and revocation; this is not general app-provider OAuth.
- The remote MCP protected resource.
Use the right credential
Browser clients use secure sessions. Native and automation clients use scoped credentials or OAuth tokens appropriate to the resource. Device credentials are unique to one display and cannot act as customer or developer tokens.Handle versions explicitly
Implemented client, device, schema, and policy contracts are versioned. Integrations should validate response shapes and handle explicit compatibility failures instead of guessing how a changed response works. Dynamic schema-handler jobs, hosted unsaved-configuration previews, legacy Tidbyt-token app imports, and room-sensor claim/reading APIs are not implemented in the current Cloud. Developer previews are rendered locally and uploaded.The complete OpenAPI document is not public yet. Do not build a production
integration against undocumented routes.