Skip to content
NovaVMS Manual

Developer docs

These docs are for engineers integrating third-party systems with NovaVMS. If you want to consume camera, event, and alert data programmatically, or push configuration from an external source, you are in the right place.

The platform exposes three integration surfaces, all stable since v1.0:

  • REST API — JSON over HTTPS at https://novavms.novalien.com/api/v1. The authoritative spec is the OpenAPI document rendered at /developer/api/.
  • Webhooks — outbound HTTPS POSTs, HMAC-SHA256 signed, for alert, event, camera_status, and gateway_status notifications.
  • SDKs — TypeScript (@novavms/sdk, Node/Deno/Bun/browser) and Python (novavms, 3.10+). Both wrap the REST surface and share identical method names.

Everything that is safe to do in the admin UI is also safe to do over the API. The only UI-exclusive flows are device-pairing handshakes (cameras, gateways) that require physical access.

Where to start

Core setup

  • API keys — create, list, rotate, revoke. Prefix conventions (sk_live_ vs sk_test_) and quota.
  • Webhook setup — register a URL, read the sample payload, handle retries.
  • Signature verification — HMAC-SHA256 in Node.js and Python with timing-safe compare.
  • Rate limits — 1000 req/min default, X-RateLimit-* headers, 429 with Retry-After.

Reference

  • OpenAPI spec — the machine-readable source of truth. Import it into Postman, Insomnia, or generate your own client.
  • REST endpoint reference — method + path + params + errors, with curl / TypeScript / Python for each endpoint. Organised by resource (auth, cameras, events, alerts, users, gateways).
  • Webhook event types — one row per event type.

Versioning

The API version is v1 and lives in the URL. Breaking changes ship as v2; non-breaking additions happen in place and are noted inline with a since v1.x tag. Every code example on this site states the minimum version it requires.