> ## Documentation index > Fetch the complete documentation index at: https://developer.rhombus.com/llms.txt > Use it to discover all available pages before exploring further. # Authenticate third party camera > Authenticate a third party camera, effectively validating the credentials specified to be used for it. ```http POST https://api2.rhombussystems.com/api/relay/authenticateThirdPartyCamera ``` EU organizations send the same request to `https://api2.eu.rhombussystems.com`. ## Authentication and parameters - `x-auth-apikey` (header, required): Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). - `Authorization` (header): instead of an API key, an OAuth access token (`Bearer `) with the `write` scope. - `x-auth-scheme` (header, string, default: `api-token`): Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters. One of: `api-token`, `api`, `api-oauth-token`, `federated-token`, `partner-api-token`, `partner-api`, `partner-api-oauth-token`. - `x-auth-org` (header, string): Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`. ## Request body Content type: `application/json`. Request object for authenticating a third-party camera with RTSP URL. - `locationUuid` (string | null): base 64 (url-safe) uuid string - `password` (string | null): Password to access the RTSP URL. This field MUST be non-empty if trySavedCredentials is false - `rtspUrl` (string | null): The RTSP URL of the third-party camera. This RTSP URL should reference a stream that provides H.264 encoded video - `thirdPartyCameraMacAddress` (string | null): The MAC address of the third-party camera this request is operating on - `trySavedCredentials` (boolean | null): Whether the third-party credentials saved in the account should be used when trying to validate whether the provided RTSP URL is valid - `username` (string | null): Username to access the RTSP URL. This field MUST be non-empty if trySavedCredentials is false ## Response 200 OK. Content type: `application/json` - `error` (boolean | null) - `errorCode` (string | null): Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. - `errorMsg` (string | null) - `result` (object): The imported (discovered) third-party camera. This field is populated only if the RTSP URL specified in the import resulted in creation of a new discovery or an addition of a RTSP URL to an existing discovery. It is null, if the RTSP URL already existed or if the import was not successful. - `rtspUrlStatus` (string): Status of the RTSP URL validation One of: `UNKNOWN`, `NOT_REACHABLE`, `NOT_AUTHENTICATED`, `NOT_SUPPORTED`, `GOOD`. - `warningMsg` (string | null) ## Errors Also 400, 401, 403, 429, 500, 503 with the standard error body (`errorCode`, `errorMsg`): https://developer.rhombus.com/errors ## OpenAPI ````yaml openapi: 3.0.1 info: title: Rhombus API version: "1.0" servers: - description: Production Server url: https://api2.rhombussystems.com security: - ApiKeyAuth: [] paths: /api/relay/authenticateThirdPartyCamera: post: description: Authenticate a third party camera, effectively validating the credentials specified to be used for it. operationId: authenticateThirdPartyCamera parameters: - description: "Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters." example: api-token in: header name: x-auth-scheme required: false schema: default: api-token enum: - api-token - api - api-oauth-token - federated-token - partner-api-token - partner-api - partner-api-oauth-token type: string - description: "Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`." in: header name: x-auth-org required: false schema: format: RUUID maxLength: 22 minLength: 22 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/Relay_AuthenticateThirdPartyCameraWSRequest" responses: "200": content: application/json: schema: $ref: "#/components/schemas/Relay_AuthenticateThirdPartyCameraWSResponse" description: OK "400": $ref: "#/components/responses/BadRequest" "401": $ref: "#/components/responses/Unauthorized" "403": $ref: "#/components/responses/Forbidden" "429": $ref: "#/components/responses/TooManyRequests" "500": $ref: "#/components/responses/InternalServerError" "503": $ref: "#/components/responses/ServiceUnavailable" security: - ApiKeyAuth: [] - oauth2: - write summary: Authenticate third party camera tags: - Relay Webservice components: schemas: Relay_AuthenticateThirdPartyCameraWSRequest: description: Request object for authenticating a third-party camera with RTSP URL. properties: locationUuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string password: description: Password to access the RTSP URL. This field MUST be non-empty if trySavedCredentials is false example: password123 nullable: true type: string rtspUrl: description: The RTSP URL of the third-party camera. This RTSP URL should reference a stream that provides H.264 encoded video example: rtsp://192.168.1.100:554/stream1 nullable: true type: string thirdPartyCameraMacAddress: description: The MAC address of the third-party camera this request is operating on nullable: true type: string trySavedCredentials: description: Whether the third-party credentials saved in the account should be used when trying to validate whether the provided RTSP URL is valid example: false nullable: true type: boolean username: description: Username to access the RTSP URL. This field MUST be non-empty if trySavedCredentials is false example: admin nullable: true type: string type: object Relay_AuthenticateThirdPartyCameraWSResponse: description: Response object for authenticating a third-party camera with RTSP URL. properties: error: nullable: true type: boolean errorCode: description: Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. nullable: true type: string errorMsg: nullable: true type: string result: $ref: "#/components/schemas/DiscoveredThirdPartyCameraType" rtspUrlStatus: $ref: "#/components/schemas/UrlStatusEnum" warningMsg: nullable: true type: string type: object DiscoveredThirdPartyCameraType: description: The imported (discovered) third-party camera. This field is populated only if the RTSP URL specified in the import resulted in creation of a new discovery or an addition of a RTSP URL to an existing discovery. It is null, if the RTSP URL already existed or if the import was not successful. properties: codec: nullable: true type: string createdOn: format: date-time nullable: true type: string ipAddress: nullable: true type: string lastVisibleMs: additionalProperties: format: int64 nullable: true type: integer nullable: true type: object macAddress: nullable: true type: string manufacturer: nullable: true type: string model: nullable: true type: string name: nullable: true type: string onvifPassword: nullable: true type: string onvifProfileToken: nullable: true type: string onvifUsername: nullable: true type: string orgUuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string password: nullable: true type: string rtspEndpoints: items: $ref: "#/components/schemas/RtspEndpoint" nullable: true type: array uniqueItems: true updatedOn: format: date-time nullable: true type: string username: nullable: true type: string type: object RtspEndpoint: properties: audioSupported: nullable: true type: boolean lastRtspUrlStatus: $ref: "#/components/schemas/UrlStatusEnum" lensRole: $ref: "#/components/schemas/LensRoleEnum" onvifProfileToken: nullable: true type: string rtspUrl: nullable: true type: string source: $ref: "#/components/schemas/RtspEndpointSourceEnum" uuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string type: object UrlStatusEnum: description: Status of the RTSP URL validation enum: - UNKNOWN - NOT_REACHABLE - NOT_AUTHENTICATED - NOT_SUPPORTED - GOOD type: string LensRoleEnum: enum: - VISIBLE - THERMAL type: string RtspEndpointSourceEnum: enum: - USER - ONVIF type: string securitySchemes: ApiKeyAuth: description: Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). in: header name: x-auth-apikey type: apiKey oauth2: description: 'OAuth 2.0 authorization code flow with PKCE (`S256`). Send the access token as `Authorization: Bearer `. Each operation lists the scopes it requires; a token without them is refused 403 with `WWW-Authenticate: Bearer error="insufficient_scope"`.' flows: authorizationCode: authorizationUrl: https://console.rhombus.com/oauth/authorize refreshUrl: https://auth-web.rhombussystems.com/oauth/token scopes: physical: Unlock doors and elevators, lockdown, alarms, speakers and robots read: View cameras, footage and settings write: Change settings and data tokenUrl: https://auth-web.rhombussystems.com/oauth/token type: oauth2 ````