API Regions (US & EU)

One organization, one region

Rhombus operates two independent production regions: US and EU. Your organization — its users, devices, API keys, and data — lives in exactly one of them. The region determines which hostnames your integration connects to; everything else is identical, including endpoint paths, authentication headers, request and response formats, and rate limits.

Regional endpoints

The pattern is consistent across the platform: the EU hostname inserts .eu. after the subdomain — api2.rhombussystems.com becomes api2.eu.rhombussystems.com.

Which region is your organization in?

Check the address bar when you're signed in to the Rhombus Console:

• console.rhombussystems.com — your organization is in the US region.
• console.eu.rhombussystems.com — your organization is in the EU region (the sign-in page is also badged EU).

Generate API keys in your own region's console under Settings → Integrations & Developer Resources → API Tokens. For example, EU organizations use console.eu.rhombussystems.com/settings/integrations/api-tokens. Partner accounts use Settings → API Management.

Call the API in your region

Set the base URL once and every code sample in these docs works for either region — the paths, headers, and payloads never change.

# US organizations
BASE_URL="https://api2.rhombussystems.com"
# EU organizations
# BASE_URL="https://api2.eu.rhombussystems.com"

curl -X POST "$BASE_URL/api/org/getOrgV2" \
  -H "x-auth-scheme: api-token" \
  -H "x-auth-apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

import requests

# US: "https://api2.rhombussystems.com"
# EU: "https://api2.eu.rhombussystems.com"
BASE_URL = "https://api2.rhombussystems.com"

response = requests.post(
    f"{BASE_URL}/api/org/getOrgV2",
    headers={
        "x-auth-scheme": "api-token",
        "x-auth-apikey": "YOUR_API_KEY",
        "Content-Type": "application/json",
    },
    json={},
)
response.raise_for_status()
org = response.json()["org"]
print(org["uuid"], org["name"])

// US: "https://api2.rhombussystems.com"
// EU: "https://api2.eu.rhombussystems.com"
const BASE_URL = "https://api2.rhombussystems.com";

const response = await fetch(`${BASE_URL}/api/org/getOrgV2`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-auth-scheme": "api-token",
    "x-auth-apikey": "YOUR_API_KEY",
  },
  body: JSON.stringify({}),
});

const { org } = await response.json();
console.log(org.uuid, org.name);

A successful call returns 200 OK with your organization's details in org (for example org.uuid and org.name). A 401 Unauthorized with errorCode INVALID_CREDENTIAL and a msg of Could not find ApiKey[sha256:…] usually means the key and the base URL belong to different regions. See Troubleshooting.

Generated SDKs

Each region serves the OpenAPI spec at the same path (/api/openapi/public.json). The spec's servers entry currently lists only the US base URL, so when you generate a client for an EU organization, override the base URL explicitly:

openapi-generator-cli generate \
  -i https://api2.eu.rhombussystems.com/api/openapi/public.json \
  -g python \
  -o ./rhombus-python-client

# Then point the generated client at the EU host, e.g.:
# configuration.host = "https://api2.eu.rhombussystems.com"

Rhombus CLI

The Rhombus CLI has built-in region support. rhombus login --region eu signs in to the EU region and saves the region on the profile; without --region, rhombus login uses the profile's region. rhombus configure asks which region your organization is in at the Region (us/eu) prompt and derives the endpoint URL from your answer. Every command then uses the matching regional hosts, including the sign-in and token hosts and, for rhombus monitor, the EU WebSocket host.

You can also point any single command — or your whole environment — at the EU endpoint directly:

# Per command
rhombus camera get-minimal-camera-state-list \
  --endpoint-url https://api2.eu.rhombussystems.com

# Per shell session
export RHOMBUS_ENDPOINT_URL=https://api2.eu.rhombussystems.com
rhombus camera get-minimal-camera-state-list

OAuth and WebSocket connections

Regional hostnames apply to every part of the platform, not just the REST API:

• Sign in with Rhombus (OAuth) — the three hosts in the OAuth flow (console, auth-web, api2) all switch to their .eu. counterparts for EU organizations. OAuth applications are region-bound just like API keys: register, authorize, and exchange tokens all in the same region.
• WebSocket real-time events — EU organizations connect to wss://ws.eu.rhombussystems.com:8443/websocket. Authentication and the STOMP protocol are identical.

Data residency

Organizations provisioned in the EU region are hosted in the European Union: their API traffic, video storage, and cloud processing stay in-region.

Troubleshooting

401 Could not find ApiKey — but the key is correct

A request with a key from the other region fails with 401 Unauthorized:

{
  "msg": "Could not find ApiKey[sha256:xxxxxxxx]",
  "error": true,
  "errorCode": "INVALID_CREDENTIAL",
  "errorMsg": "The supplied credential is malformed or not recognized.",
  "status": 401,
  "timestamp": 1791158465584,
  "txid": "yJ2kQw8LTaO1xX4hVd7mPA"
}

This response is identical whether the key was deleted or simply belongs to the other region — there is no region hint in the error. If you're confident the key is correct, check which console it was generated in (console. vs console.eu.) and make sure your base URL matches. A msg of Invalid api key (same errorCode) means something else: the value isn't a well-formed key (copy-paste damage or whitespace). Quote the txid (also in the x-rhombus-txid response header) if you contact support.

Federated tokens are region-bound too: a token minted on US hosts fails on EU hosts, and the reverse. Mint it through the API host in the same region as the cameras you'll stream.

OAuth: "This application is not available for your organization"

OAuth clientIds are region-bound. If your app was registered in one region and a user tries to authorize it through the other region's console, the consent screen shows This application is not available for your organization. Make sure the registration call, the authorization URL, and the token exchange all target the same region as the signing-in user's organization.

Next steps