Contract families
- browser and native account sessions;
- display creation, claim, transfer, reset, and diagnostics;
- catalog search and installation lifecycle;
- app schemas, dynamic field handlers, and local-state previews;
- display ordering, brightness, schedules, scenes, and firmware policy;
- developer projects, immutable revisions, and submissions;
- OAuth discovery, token exchange, refresh, and revocation; and
- the remote MCP protected resource.
Authentication
Browser clients use secure sessions. Native and automation clients use scoped credentials or OAuth tokens appropriate to the resource. Device credentials are unique to a display and cannot be used as customer or developer tokens.Versioning
Public client, device, migration, sensor, schema, and policy contracts are versioned. Integrations should validate response shapes and handle explicit compatibility failures instead of guessing at new fields.The complete OpenAPI document will be embedded here when the public API surface is frozen for external use. Do not build production integrations against undocumented internal routes.