For developers

These docs are for engineers integrating third-party systems with NovaVMS. If you want to consume camera, event, and alert data programmatically, or push configuration from an external source, you are in the right place.

The platform exposes three integration surfaces, all stable since v1.0:

REST API — JSON over HTTPS at https://novavms.novalien.com/api/v1. The authoritative spec is the OpenAPI document rendered at /developer/api/.
Webhooks — outbound HTTPS POSTs, HMAC-SHA256 signed, for alert, event, camera_status, and gateway_status notifications.
SDKs — TypeScript (@novavms/sdk, Node/Deno/Bun/browser) and Python (novavms, 3.10+). Both wrap the REST surface and share identical method names.

Everything that is safe to do in the admin UI is also safe to do over the API. The only UI-exclusive flows are device-pairing handshakes (cameras, gateways) that require physical access.

Start with this flow

Core setup

API keys — create, list, rotate, revoke. Prefix conventions (sk_live_ vs sk_test_) and quota.
Webhook setup — register a URL, read the sample payload, handle retries.
Signature verification — HMAC-SHA256 in Node.js and Python with timing-safe compare.
Rate limits — 1000 req/min default, X-RateLimit-* headers, 429 with Retry-After.

Reference

OpenAPI spec — the machine-readable source of truth. Import it into Postman, Insomnia, or generate your own client.
Auth endpoints
Camera endpoints
Event endpoints
Alert endpoints
User endpoints
Gateway endpoints
Webhook event types — one row per event type.

If something is broken

Versioning

The API version is v1 and lives in the URL. Breaking changes ship as v2; non-breaking additions happen in place and are noted inline with a since v1.x tag. Every code example on this site states the minimum version it requires.