WAPI v1

The Web-App API powers the v2 SPA layer. It is additive — the legacy /api?Command=… surface stays exactly as it was. Both live in this build, both call the same internal query layer, both read from the same database. New integrations should target WAPI v1.

Authentication

WAPI accepts three auth modes:

Bearer token — Authorization: Bearer <token>. Tokens are rows in api_tokens with Active = 1.
HTTP Basic — Authorization: Basic base64(token:). Same tokens; password half is ignored.
JWT cookie — sentinel_auth, set by /sign-in. Used by the SPA layer.

Requests originating from the host itself bypass auth (same as the legacy /api surface) so the snapshot harness can run.

Response envelope

Every WAPI v1 response is JSON of the form:

{
  "data":   ...,
  "meta":   { "count": N, "elapsed_ms": M, "cursor": "..." },
  "errors": []
}

On failure, data is null and errors contains one entry of the form:

{ "code": "symbol", "message": "...", "field": "..." }

Stable error codes: unauthorized, forbidden, not_found, validation, rate_limited, internal. field is only present on validation errors.

Endpoints

Method · path	Purpose
`GET /wapi/v1/decoder`	DataType registry — units, colors, graphing flags.
`GET /wapi/v1/tags`	Tags. Filters: `ID`, `TagName[]`, `TagType[]`, `Collapsed`.
`GET /wapi/v1/limits/templates`	Preset limit profiles. Optional `Distinct` for type list.
`GET /wapi/v1/out-of-bounds`	Sensors with currently-out-of-range readings, plus stale-sensor timestamps.
`GET /wapi/v1/sensors`	List sensors. Filters: `TagName[]`, `TagType[]`, `TagID[]`, `Name[]`, `BatteryID[]`.
`GET /wapi/v1/sensors/{uuid}`	Single sensor detail (data unwrapped from list).
`GET /wapi/v1/sensors/{uuid}/readings`	Per-UUID readings. Forwards `Limit`, `Time[]`, `Count`, `Expanded`, `Interval`, `Type`, `Errors`, `BaseID`, `Status`, `Results`, `Tests`.
`GET /wapi/v1/virtual`	List virtual sensors.
`GET /wapi/v1/virtual/{uuid}`	Virtual sensor configuration.
`GET /wapi/v1/readings/aggregate`	Bucketed time-series: same data as `Command=Charts`. Forwards `UUID[]`, `Time[]`, `Tag*`, `Name[]`, `Status[]`, `Interval`.

Planned (not yet enabled)

GET /wapi/v1/readings/csv — chunked CSV stream, replacing v1's queryRangeRawCSV (Phase 5).
GET /wapi/v1/readings/stream — Server-Sent Events for live tile/table/map (Phase 4).
Briefs, power-tests, translog, batteries, saved views, me, audit (Phases 4–8).

Legacy `/api?Command=…` contract

Frozen — every URL/parameter combination v1 accepted continues to respond the same way. The current whitelist:

Command=Data2 — paginated readings (also supports Interval, Tests, BatteryID).
Command=Details — sensor metadata + tags + limits.
Command=Decoder — DataType registry.
Command=Tags — tag list (with Collapsed).
Command=LimitsTemplate — preset profiles (with Distinct).
Command=OutOfBounds — currently-out-of-range readings (v2 returns real data; v1 fataled to empty).
Command=Base — placeholder, returns [].
Command=Virtual — per-UUID virtual config.
Command=Charts — bucketed time-series (also supports Interval).

v2's implementation is parity-tested against v1's live output. See toolbox/wapi/snapshot.php.

Authentication

Response envelope

Endpoints

Planned (not yet enabled)

Legacy /api?Command=… contract

Legacy `/api?Command=…` contract