Changelog
Release notes for the Rhombus API — track new endpoints, breaking changes, deprecations, SDK updates, and platform improvements over time.
On this page
One authentication model across every host
Every Rhombus API host (api2, the media hosts and the event WebSocket) accepts the same credentials and answers authentication failures the same way. Authentication describes the model.
Breaking changes
401 for credential problems, 403 for permissions — A missing, invalid, expired or revoked credential gets 401; a valid credential that isn't allowed gets 403. Both carry the standard error body, with an errorCode such as INVALID_CREDENTIAL or PERMISSION_REQUIRED and a txid. If your code treats 403 as a bad key, handle 401 too.
Federated tokens last at most 24 hours — durationSec defaults to 1 hour and is capped at 24 hours, and the response adds expiresAtMs. A token minted with a domain works only from that origin, so domain must be an absolute origin such as https://app.example.com. A federated token can't mint another, and it ends when the credential that minted it is deleted or revoked. Federated tokens
Partner calls need x-auth-org — Outside the partner endpoints, a partner credential without x-auth-org gets Deprecation and Sunset: Tue, 05 Jan 2027 00:00:00 GMT headers and stops working on that date. The event WebSocket requires it already. Partner API calls
Policy-alert events — Policy alerts on the event WebSocket are filtered by the subscriber's role, and targetUsers and targetRoles are UUID strings. Event reference
Per-key IP restrictions removed — API keys no longer have restrictToAllowedIps, and getApiTokens no longer returns it. Keys now report expiresAtMs, and parentTokenUuid or oauthGrant when another key or an OAuth grant created them.
New features
OAuth on every host, with scopes — Send OAuth access tokens as Authorization: Bearer on api2, the media hosts and the event WebSocket. Apps request the read, write and physical scopes, and refresh tokens rotate on every use. OAuth
API key lifecycle — Create keys with an expiry, rotate them with an overlap, and renew certificates through the API: submitApiTokenApplication, rotateApiToken and renewApiTokenCert, with partner versions under /api/partner/. API keys
Revoke a federated token — POST /api/org/revokeFederatedSessionToken ends a token early, for example when your user signs out. Revoke a token
SHA-256 webhook signatures — Webhooks carry x-rhombus-signature-sha256, an HMAC-SHA256 of the raw body. Verifying webhook signatures
Stream manifests carry their auth — DASH manifests and alert-clip HLS playlists add the federated or share query to every segment URL, so one manifest URL works in any player. Media authentication
CLI and MCP server — rhombus login signs in with OAuth and takes --region us|eu. The MCP server acts in a partner's client organization with x-auth-org or RHOMBUS_PARTNER_ORG. Rhombus CLI, Rhombus MCP
Updates
Revocation within 60 seconds — Deleting a key, changing its role or revoking an OAuth grant takes effect within 60 seconds on every host, and open WebSockets close with code 1008.
Rate limits — Federated tokens and partner OAuth count toward your organization's rate limit, and a 429 is JSON with RATE_LIMITED and Retry-After. Rate Limits
Certificates — New developer and partner certificates last 1 year, and a certificate signing request must be signed by its own key.
API Reference — Every operation lists the x-auth-org header, and GET /api/oauth/authorize lists scope. The deprecated submitApiTokenApplication that predates the /org/ path is no longer in the reference because API credentials can't call it; use /api/integrations/org/submitApiTokenApplication.
Claim keys — ClaimKeyExpirationEmailStateEnum adds SEVEN_DAY_EMAIL_SUCCEEDED and SEVEN_DAY_EMAIL_FAILED. Handle values you don't recognize.
Streaming over LAN documented
New features
Streaming over LAN — A new guide covers streaming live video, recorded footage, and two-way audio directly from cameras and audio gateways on your local network. Devices on your LAN never accept API keys: you mint a short-lived, device-scoped federated token with POST /api/org/generateFederatedSessionToken and send it as x-auth-scheme: federated-token + x-auth-ft, as headers or query parameters. The guide also covers LAN URI formats, the audio WebSocket format, browser limitations, and troubleshooting.
API tokens vs federated tokens — The quickstart now explains how the two credentials differ and where each one works.
Webhook signature verification — The Webhooks page now documents the x-rhombus-signature-sha1 and x-rhombus-signature-sha256 headers, where to find each webhook's secret, and verification code for Python and Node.js. Read more
Partner accounts in Sign in with Rhombus — Partner users can complete the OAuth flow and mint partner API keys with the partner-api-oauth-token scheme. Read more
Updates
Corrections — WebSocket partner connections send x-auth-org as a header, not a query parameter, and the handshake no longer needs a prior session. Console paths for creating API keys match the current Rhombus Console. The most-recent people-count events endpoint was removed from the API and is no longer documented; use getCountReportV2 or getOccupancyCountsV2 instead.
Updated: 2026-10-21
US & EU API regions documented
Rhombus operates two independent production regions — US and EU — and the documentation now covers both.
New features
API Regions guide — A new API Regions (US & EU) guide covers the full regional endpoint map (api2.eu.rhombussystems.com, media.eu.rhombussystems.com, console.eu.rhombussystems.com, auth-web.eu.rhombussystems.com, wss://ws.eu.rhombussystems.com:8443/websocket), how to tell which region your organization is in, region-bound API keys, and cross-region troubleshooting — including why a wrong-region call returns 403 Invalid api key.
EU endpoints throughout the docs — The quickstart, API Reference overview, OAuth guide, partner guide, WebSocket pages, rate limits, and CLI documentation now show both regions' hosts. The WebSocket AsyncAPI definition gained a production-eu server entry.
Rhombus CLI region support documented — rhombus configure prompts for a region (us/eu) and derives the endpoint automatically; rhombus login uses the matching regional sign-in and token hosts. Previously undocumented.
Updated: 2026-08-03
EdgeCaster: sub-second latency, unlimited streams, and 24/7 self-healing
The EdgeCaster RTSP gateway received a major update focused on efficiency and sub-second latency.
Enhancements
Sub-second latency — The stream-copy pipeline (no transcoding) was retuned to strip buffering at every hop: FFmpeg runs with no input buffering, low-delay flags, fast startup, and zero mux delay, while MediaMTX drops stalled publishers quickly. EdgeCaster always pushes the latest frame with sub-second added latency inside the device; end-to-end latency also depends on the camera's keyframe interval and your consumer's own buffer.
Unlimited concurrent streams — The previous 10-stream cap is gone. Streams are uncapped by default (max_streams: 0); the device runs as many as its network and CPU allow. Real-world testing on a Raspberry Pi 5 showed a handful of 1080p streams plus multiple RTSP readers at roughly 3% CPU.
24/7 self-healing — Frame-level stall detection spots frozen-but-alive feeds within seconds and recovers them through a single guarded relaunch with a fresh Secure Raw Stream URL. Fast retries, then a 5-minute backoff — it never permanently gives up.
Simpler install — A one-line installer for any Ubuntu/Debian machine (arm64, amd64, or armv7) and a ready-to-flash Raspberry Pi image. Manual git-checkout installs now receive nightly auto-updates too.
Redesigned, mobile-ready dashboard — A cleaner, responsive operator console that works on any device or browser.
New features
Live health dashboard — Real-time metrics over Server-Sent Events (~1s): active streams, CPU, memory, temperature, power/throttle status, load average, uptime, and per-stream throughput and reader counts. Pi temperature and power metrics require the linux-raspi kernel.
Webhook alerts — Stream-down, under-voltage, thermal-throttling, and sustained high-CPU/load alerts to Slack, Make.com, or any HTTP listener, with configurable thresholds, per-alert cooldowns, and clear-on-recovery. Configure under Settings → Alerts, including a test-alert button.
Live logs viewer — Stream Application, Streams, and Rhombus API logs live from the dashboard in a terminal-style console — no SSH needed.
One-click secure public access — Reach the dashboard from anywhere via a Cloudflare quick tunnel (no Cloudflare account required), protected by a username and password. LAN access stays login-free; the public link is ephemeral and changes each time public access restarts, and RTSP is never tunneled.
Updated: 2026-07-10
New implementation guides and a full accuracy pass
New features
Access Control — A comprehensive guide to the access control API: listing and managing access-controlled doors, remote unlock, Wiegand credentials, access groups and grants, weekly schedules, and lockdown plans. Read the guide
License Plate Recognition & Vehicle — Query LPR detection events, search license plates (including fuzzy matching), build vehicle watchlists with alert and trust flags, label vehicles, and export detections. Read the guide
Face Recognition & People Counting — Enroll and manage known people, upload face images for matching, query face-match events, tune the match confidence threshold, and pull camera people-counting analytics. Read the guide
Reports & Analytics — Generate count and time-series reports, read occupancy and line-crossing counts, work with the report type/interval/scope enums, and export report data as CSV. Read the guide
Updates
Documentation accuracy pass — Every guide was reviewed against the production API and corrected for endpoint paths, request and response fields, authentication headers, and event payloads. Notable corrections include the "Sign in with Rhombus" OAuth 2.0 flow, the webhook delivery payload structure, and the WebSocket event schema.
Updated: 2026-07-08
Partner API documentation
New features
Partner API Calls — A new guide for managed service providers and resellers covering how to make API calls as a partner: authenticating with a partner API key, managing client organizations with partner endpoints, and scoping client-level calls to a managed org using the x-auth-org header. Read the guide
Updated: 2026-06-29
Developer tools and integrations
New features
Rhombus CLI — A command-line tool for managing your entire Rhombus deployment from the terminal. Supports 60+ API resource categories, video stitching, frame analysis, real-time alert monitoring, and AI-powered chat. Available via Homebrew, shell script, or from source. Read the guide
React SDK — The official @rhombussystems/react package provides drop-in components for embedding Rhombus camera streams in your React applications. Includes both a DASH buffered player and a realtime H.264 WebSocket player. Read the guide
Rhombus API MCP Server — An MCP server that gives AI tools like Claude, Cursor, and others direct access to your cameras, access control, sensors, and the full Rhombus platform. Supports 30+ tools across all major resource types. Read the guide
Claude Code Plugins — Ready-made skills, agents, and hooks for Claude Code organized by persona (developer, user, partner). Install from the Rhombus Claude Code Plugin Marketplace. Read the guide
EdgeCaster RTSP Gateway — A Raspberry Pi edge gateway that converts Rhombus secure camera streams to RTSP for legacy VMS, NVR, and third-party video systems. Read the guide
Official n8n community node — The @rhombussystems/n8n-nodes-client package provides native Rhombus access in n8n with 6 resource types and 19 operations — no raw HTTP configuration needed. Read the guide
OAuth 2.0 authentication — You can now authenticate Rhombus users in your application using OAuth 2.0 with PKCE ("Sign in with Rhombus"). Read the guide
SAML SSO and SCIM provisioning — Programmatically configure SAML single sign-on and SCIM user provisioning for your Rhombus organization, with support for Okta, Azure AD, Google Workspace, and OneLogin. Read the guide
Updates
API Reference navigation — The API Reference sidebar now organizes 800+ endpoints into 7 collapsible groups (Cameras & Video, Access Control, Security & Alerts, IoT Sensors, Organization & Users, Integrations, Devices & System) for faster browsing.
Rate limits guide — New documentation covering how Rhombus API rate limiting works, including retry strategies and code examples. Read the guide
WebSocket documentation — Comprehensive rewrite of the real-time event streaming guides covering authentication, connection lifecycle, STOMP protocol, event monitoring, and troubleshooting. Read the guides
Improved implementation guides — The alarm monitoring and IoT sensors guides now include complete API workflows with multi-language code examples.
Updated: 2026-04-20
Major API Expansion
The Rhombus API has been updated with 29 new endpoints added across 2 new service categories.
New Endpoints
Relay (24 endpoints):
- NVR management: details, state, uptime, reboot, unregister, firmware updates
- Third-party camera integration: assign, authenticate, discover, manage passwords, RTSP endpoints
- PTZ controls: move and status
Access Control Integrations (4 endpoints):
- Boulevard integration: create, read, update, delete, and connection testing
New Service Categories
- Relay Webservice
API Version: 1.0 Updated: 2026-04-02
New API Endpoints
The Rhombus API has been updated with 2 new endpoints added.
New Endpoints
Component:
POST /api/component/findPaginatedComponentEventsByAccessControlledDoor- Retrieve all component events relevant to the specified AccessControlledDoor
Report:
POST /api/report/getOccupancyCountsV2- Get occupancy counts V2
API Version: 1.0 Updated: 2026-03-07
New API Endpoints
The Rhombus API has been updated with 2 new endpoints added.
New Endpoints
Report:
POST /api/report/getBatchThresholdCrossingCountReport- Get batch threshold crossing count reportPOST /api/report/getThresholdCrossingCountReportForOrg- Get org wide batch threshold crossing count report
API Version: 1.0 Updated: 2026-02-10
New API Endpoints
The Rhombus API has been updated with 5 new endpoints added.
New Endpoints
Elevator:
POST /api/component/elevator/addAccessControlledElevatorLandingLabel- Create a label that can be assigned to an access controlled elevator landingPOST /api/component/elevator/findAccessControlledElevatorLandingShadows- Find access controlled elevator landing shadows within the orgPOST /api/component/elevator/findAccessControlledElevatorLandingShadowsByLocation- Find access controlled elevator landing shadows within the specified locationPOST /api/component/elevator/getAccessControlledElevatorLandingLabelsForOrg- Get all access controlled elevator landing labels for the organizationPOST /api/component/elevator/removeAccessControlledElevatorLandingLabel- Remove a label to an access controlled elevator landing
API Version: 1.0 Updated: 2026-01-30
Documentation Navigation Restructure
Reorganized the documentation into topic-based navigation groups for easier discovery.
- Guides: Getting started, implementation guides for cameras, access control, alarm monitoring, IoT sensors, and more
- Integrations: Low-code/no-code platforms (Zapier, Make.com, N8N) and AI tool integration via MCP
- API Reference: Complete REST API reference with live endpoint testing, auto-generated from the OpenAPI spec
All existing links continue to work — no breaking changes to content or URLs.
New API Endpoints
The Rhombus API has been updated with 2 new endpoints added.
New Endpoints
Alert Monitoring:
POST /api/alertmonitoring/disableMonitoringForLocation- Disable monitoring for locationPOST /api/alertmonitoring/enableMonitoringForLocation- Enable monitoring for location
New Documentation Launch
Complete redesign of the Rhombus Developer Documentation.
- New platform: Improved search, dark mode, and mobile support
- 3-tab navigation: Guides, Integrations, and API Reference for clear content separation
- Interactive API playground: Live endpoint testing directly in the documentation
- Nightly sync: Automated pipeline keeps API documentation current with production
- AI-ready: MCP server integration,
llms.txtcontext files, and downloadable OpenAPI spec
Email support@rhombus.com to share feedback or request new content.