1.5 KiB
1.5 KiB
Mobile companion API
Used by the Remora PWA. All calls take Authorization: Bearer <api key>.
| Call | What it does |
|---|---|
POST /api/v1/mobile/login {email, password, device} |
Returns {token, keyId, user}. The token is a new API key named Mobile: <device>; delete it under API keys to sign that phone out. No cookie is set. |
GET /api/v1/push/key |
The VAPID public key (base64url) for pushManager.subscribe. Created on first use, stored sealed in the database. |
POST /api/v1/push/subscriptions {endpoint, keys:{p256dh, auth}, topics, device} |
Registers or updates a device (matched by endpoint). The caller's personal topic is always added. |
GET /api/v1/push/subscriptions |
The caller's devices. |
DELETE /api/v1/push/subscriptions/{id} |
Removes one. |
POST /api/v1/push/test |
Sends a test push to the caller's devices and reports each result. |
POST /api/v1/alerts/{id}/escalate |
Runs the alert's next escalation step now. |
GET /api/v1/hammerhead/edges |
Read-only edges and online state from a linked Hammerhead ({configured, edges}). |
Push payload (JSON, encrypted with aes128gcm): id, topic, title, message, priority, tags, time, status, plus alert
(the alert id) on on-call alerts, so the app can offer Acknowledge, Snooze and Escalate. Messages are cut to 1200 characters.
A push service answering 404 or 410 removes the subscription.
SANDBAR_APP_DIR serves the app at /app/. SANDBAR_APP_ORIGIN lets an app hosted elsewhere call /api/v1/* (CORS).