> ## Documentation index > Fetch the complete documentation index at: https://developer.rhombus.com/llms.txt > Use it to discover all available pages before exploring further. # Changelog > Release notes for the Rhombus API — track new endpoints, breaking changes, deprecations, SDK updates, and platform improvements over time. ## October 2026 _Breaking Changes, New Features, Enhancements_ — One authentication model across every host, streaming over LAN, and SHA-256 webhook signatures ### One authentication model across every host Every Rhombus API host (api2, the media hosts and the event WebSocket) accepts the same credentials and answers authentication failures the same way. [Authentication](https://developer.rhombus.com/authentication) describes the model. #### Breaking changes **401 for credential problems, 403 for permissions** — A missing, invalid, expired or revoked credential gets `401`; a valid credential that isn't allowed gets `403`. Both carry the [standard error body](https://developer.rhombus.com/errors#authentication-and-permission-errors), with an `errorCode` such as `INVALID_CREDENTIAL` or `PERMISSION_REQUIRED` and a `txid`. If your code treats `403` as a bad key, handle `401` too. **Federated tokens last at most 24 hours** — `durationSec` defaults to 1 hour and is capped at 24 hours, and the response adds `expiresAtMs`. A token minted with a `domain` works only from that origin, so `domain` must be an absolute origin such as `https://app.example.com`. A federated token can't mint another, and it ends when the credential that minted it is deleted or revoked. [Federated tokens](https://developer.rhombus.com/authentication/federated-tokens) **Partner calls need `x-auth-org`** — Outside the partner endpoints, a partner credential without `x-auth-org` gets `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT` headers and stops working on that date. The event WebSocket requires it already. [Partner API calls](https://developer.rhombus.com/partner-api-calls#calls-without-x-auth-org) **Policy-alert events** — Policy alerts on the event WebSocket are filtered by the subscriber's role, and `targetUsers` and `targetRoles` are UUID strings. [Event reference](https://developer.rhombus.com/websocket/event-reference) **Per-key IP restrictions removed** — API keys no longer have `restrictToAllowedIps`, and [`getApiTokens`](https://developer.rhombus.com/api-reference/org-integrations-webservice/get-api-tokens) no longer returns it. Keys now report `expiresAtMs`, and `parentTokenUuid` or `oauthGrant` when another key or an OAuth grant created them. #### New features **OAuth on every host, with scopes** — Send OAuth access tokens as `Authorization: Bearer` on api2, the media hosts and the event WebSocket. Apps request the `read`, `write` and `physical` scopes, and refresh tokens rotate on every use. [OAuth](https://developer.rhombus.com/oauth-authentication#scopes) **API key lifecycle** — Create keys with an expiry, rotate them with an overlap, and renew certificates through the API: [`submitApiTokenApplication`](https://developer.rhombus.com/api-reference/org-integrations-webservice/submit-api-token-application), [`rotateApiToken`](https://developer.rhombus.com/api-reference/org-integrations-webservice/rotate-api-token) and [`renewApiTokenCert`](https://developer.rhombus.com/api-reference/org-integrations-webservice/renew-api-token-certificate), with partner versions under `/api/partner/`. [API keys](https://developer.rhombus.com/authentication/api-keys#manage-keys-with-the-api) **Revoke a federated token** — [`POST /api/org/revokeFederatedSessionToken`](https://developer.rhombus.com/api-reference/org-webservice/revoke-federated-session-token) ends a token early, for example when your user signs out. [Revoke a token](https://developer.rhombus.com/authentication/federated-tokens#revoke-a-token) **SHA-256 webhook signatures** — Webhooks carry `x-rhombus-signature-sha256`, an HMAC-SHA256 of the raw body. [Verifying webhook signatures](https://developer.rhombus.com/webhooks#verifying-webhook-signatures) **Stream manifests carry their auth** — DASH manifests and alert-clip HLS playlists add the federated or share query to every segment URL, so one manifest URL works in any player. [Media authentication](https://developer.rhombus.com/authentication/media) **CLI and MCP server** — `rhombus login` signs in with OAuth and takes `--region us|eu`. The MCP server acts in a partner's client organization with `x-auth-org` or `RHOMBUS_PARTNER_ORG`. [Rhombus CLI](https://developer.rhombus.com/rhombus-cli), [Rhombus MCP](https://developer.rhombus.com/rhombus-mcp#partner-accounts) #### Updates **Revocation within 60 seconds** — Deleting a key, changing its role or revoking an OAuth grant takes effect within 60 seconds on every host, and open WebSockets close with code `1008`. **Rate limits** — Federated tokens and partner OAuth count toward your organization's rate limit, and a `429` is JSON with `RATE_LIMITED` and `Retry-After`. [Rate Limits](https://developer.rhombus.com/rate-limits) **Certificates** — New developer and partner certificates last 1 year, and a certificate signing request must be signed by its own key. **API Reference** — Every operation lists the `x-auth-org` header, and [`GET /api/oauth/authorize`](https://developer.rhombus.com/api-reference/oauth-webservice/authorize-oauth-application) lists `scope`. The deprecated `submitApiTokenApplication` that predates the `/org/` path is no longer in the reference because API credentials can't call it; use [`/api/integrations/org/submitApiTokenApplication`](https://developer.rhombus.com/api-reference/org-integrations-webservice/submit-api-token-application). **Claim keys** — `ClaimKeyExpirationEmailStateEnum` adds `SEVEN_DAY_EMAIL_SUCCEEDED` and `SEVEN_DAY_EMAIL_FAILED`. Handle values you don't recognize. --- ### Streaming over LAN documented #### New features **Streaming over LAN** — A new guide covers streaming live video, recorded footage, and two-way audio directly from cameras and audio gateways on your local network. Devices on your LAN never accept API keys: you mint a short-lived, device-scoped federated token with [`POST /api/org/generateFederatedSessionToken`](https://developer.rhombus.com/api-reference/org-webservice/generate-federated-session-token) and send it as `x-auth-scheme: federated-token` + `x-auth-ft`, as headers or query parameters. The guide also covers LAN URI formats, the audio WebSocket format, browser limitations, and troubleshooting. **API tokens vs federated tokens** — The quickstart now explains how the two credentials differ and where each one works. [Read the guide](https://developer.rhombus.com/implementations/lan-streaming) **Webhook signature verification** — The Webhooks page now documents the `x-rhombus-signature-sha1` and `x-rhombus-signature-sha256` headers, where to find each webhook's secret, and verification code for Python and Node.js. [Read more](https://developer.rhombus.com/webhooks#verifying-webhook-signatures) **Partner accounts in Sign in with Rhombus** — Partner users can complete the OAuth flow and mint partner API keys with the `partner-api-oauth-token` scheme. [Read more](https://developer.rhombus.com/oauth-authentication#working-with-partner-accounts) #### Updates **Corrections** — WebSocket partner connections send `x-auth-org` as a header, not a query parameter, and the handshake no longer needs a prior session. Console paths for creating API keys match the current Rhombus Console. The most-recent people-count events endpoint was removed from the API and is no longer documented; use `getCountReportV2` or `getOccupancyCountsV2` instead. --- **Updated**: 2026-10-21 ## August 2026 _New Features_ — US & EU API regions: regional endpoints documented across the docs ### US & EU API regions documented Rhombus operates two independent production regions — US and EU — and the documentation now covers both. #### New features **API Regions guide** — A new [API Regions (US & EU)](https://developer.rhombus.com/api-regions) guide covers the full regional endpoint map (`api2.eu.rhombussystems.com`, `media.eu.rhombussystems.com`, `console.eu.rhombussystems.com`, `auth-web.eu.rhombussystems.com`, `wss://ws.eu.rhombussystems.com:8443/websocket`), how to tell which region your organization is in, region-bound API keys, and cross-region troubleshooting — including why a wrong-region call returns `403 Invalid api key`. **EU endpoints throughout the docs** — The quickstart, API Reference overview, OAuth guide, partner guide, WebSocket pages, rate limits, and CLI documentation now show both regions' hosts. The WebSocket AsyncAPI definition gained a `production-eu` server entry. **Rhombus CLI region support documented** — `rhombus configure` prompts for a region (`us`/`eu`) and derives the endpoint automatically; `rhombus login` uses the matching regional sign-in and token hosts. Previously undocumented. [Read the guide](https://developer.rhombus.com/api-regions) --- **Updated**: 2026-08-03 ## July 2026 _New Features, Enhancements_ — EdgeCaster sub-second latency, new Access Control, LPR, Faces, and Reports guides, and a documentation accuracy pass ### EdgeCaster: sub-second latency, unlimited streams, and 24/7 self-healing The [EdgeCaster RTSP gateway](https://developer.rhombus.com/implementations/edgecaster-rtsp) received a major update focused on efficiency and sub-second latency. #### Enhancements **Sub-second latency** — The stream-copy pipeline (no transcoding) was retuned to strip buffering at every hop: FFmpeg runs with no input buffering, low-delay flags, fast startup, and zero mux delay, while MediaMTX drops stalled publishers quickly. EdgeCaster always pushes the latest frame with sub-second added latency inside the device; end-to-end latency also depends on the camera's keyframe interval and your consumer's own buffer. **Unlimited concurrent streams** — The previous 10-stream cap is gone. Streams are uncapped by default (`max_streams: 0`); the device runs as many as its network and CPU allow. Real-world testing on a Raspberry Pi 5 showed a handful of 1080p streams plus multiple RTSP readers at roughly 3% CPU. **24/7 self-healing** — Frame-level stall detection spots frozen-but-alive feeds within seconds and recovers them through a single guarded relaunch with a fresh Secure Raw Stream URL. Fast retries, then a 5-minute backoff — it never permanently gives up. **Simpler install** — A one-line installer for any Ubuntu/Debian machine (arm64, amd64, or armv7) and a ready-to-flash Raspberry Pi image. Manual git-checkout installs now receive nightly auto-updates too. **Redesigned, mobile-ready dashboard** — A cleaner, responsive operator console that works on any device or browser. #### New features **Live health dashboard** — Real-time metrics over Server-Sent Events (\~1s): active streams, CPU, memory, temperature, power/throttle status, load average, uptime, and per-stream throughput and reader counts. Pi temperature and power metrics require the `linux-raspi` kernel. **Webhook alerts** — Stream-down, under-voltage, thermal-throttling, and sustained high-CPU/load alerts to Slack, Make.com, or any HTTP listener, with configurable thresholds, per-alert cooldowns, and clear-on-recovery. Configure under Settings → Alerts, including a test-alert button. **Live logs viewer** — Stream Application, Streams, and Rhombus API logs live from the dashboard in a terminal-style console — no SSH needed. **One-click secure public access** — Reach the dashboard from anywhere via a Cloudflare quick tunnel (no Cloudflare account required), protected by a username and password. LAN access stays login-free; the public link is ephemeral and changes each time public access restarts, and RTSP is never tunneled. [Read the guide](https://developer.rhombus.com/implementations/edgecaster-rtsp) --- **Updated**: 2026-07-10 --- ### New implementation guides and a full accuracy pass #### New features **Access Control** — A comprehensive guide to the access control API: listing and managing access-controlled doors, remote unlock, Wiegand credentials, access groups and grants, weekly schedules, and lockdown plans. [Read the guide](https://developer.rhombus.com/implementations/access-control) **License Plate Recognition & Vehicle** — Query LPR detection events, search license plates (including fuzzy matching), build vehicle watchlists with alert and trust flags, label vehicles, and export detections. [Read the guide](https://developer.rhombus.com/implementations/lpr-vehicle) **Face Recognition & People Counting** — Enroll and manage known people, upload face images for matching, query face-match events, tune the match confidence threshold, and pull camera people-counting analytics. [Read the guide](https://developer.rhombus.com/implementations/faces-people-counting) **Reports & Analytics** — Generate count and time-series reports, read occupancy and line-crossing counts, work with the report type/interval/scope enums, and export report data as CSV. [Read the guide](https://developer.rhombus.com/implementations/reports-analytics) #### Updates **Documentation accuracy pass** — Every guide was reviewed against the production API and corrected for endpoint paths, request and response fields, authentication headers, and event payloads. Notable corrections include the "Sign in with Rhombus" OAuth 2.0 flow, the webhook delivery payload structure, and the WebSocket event schema. --- **Updated**: 2026-07-08 ## June 2026 _New Features_ — Partner API guide ### Partner API documentation #### New features **Partner API Calls** — A new guide for managed service providers and resellers covering how to make API calls as a partner: authenticating with a partner API key, managing client organizations with partner endpoints, and scoping client-level calls to a managed org using the `x-auth-org` header. [Read the guide](https://developer.rhombus.com/partner-api-calls) --- **Updated**: 2026-06-29 ## April 2026 _New Features, Enhancements_ — New developer tools, SDK, and integrations, plus 29 new endpoints ### Developer tools and integrations #### New features **Rhombus CLI** — A command-line tool for managing your entire Rhombus deployment from the terminal. Supports 60+ API resource categories, video stitching, frame analysis, real-time alert monitoring, and AI-powered chat. Available via Homebrew, shell script, or from source. [Read the guide](https://developer.rhombus.com/rhombus-cli) **React SDK** — The official [`@rhombussystems/react`](https://www.npmjs.com/package/@rhombussystems/react) package provides drop-in components for embedding Rhombus camera streams in your React applications. Includes both a DASH buffered player and a realtime H.264 WebSocket player. [Read the guide](https://developer.rhombus.com/implementations/react-sdk) **Rhombus API MCP Server** — An MCP server that gives AI tools like Claude, Cursor, and others direct access to your cameras, access control, sensors, and the full Rhombus platform. Supports 30+ tools across all major resource types. [Read the guide](https://developer.rhombus.com/rhombus-mcp) **Claude Code Plugins** — Ready-made skills, agents, and hooks for Claude Code organized by persona (developer, user, partner). Install from the [Rhombus Claude Code Plugin Marketplace](https://github.com/RhombusSystems/claude-code-plugins). [Read the guide](https://developer.rhombus.com/claude-code-plugins) **EdgeCaster RTSP Gateway** — A Raspberry Pi edge gateway that converts Rhombus secure camera streams to RTSP for legacy VMS, NVR, and third-party video systems. [Read the guide](https://developer.rhombus.com/implementations/edgecaster-rtsp) **Official n8n community node** — The [`@rhombussystems/n8n-nodes-client`](https://www.npmjs.com/package/@rhombussystems/n8n-nodes-client) package provides native Rhombus access in n8n with 6 resource types and 19 operations — no raw HTTP configuration needed. [Read the guide](https://developer.rhombus.com/low-code-no-code/n8n) **OAuth 2.0 authentication** — You can now authenticate Rhombus users in your application using OAuth 2.0 with PKCE ("Sign in with Rhombus"). [Read the guide](https://developer.rhombus.com/oauth-authentication) **SAML SSO and SCIM provisioning** — Programmatically configure SAML single sign-on and SCIM user provisioning for your Rhombus organization, with support for Okta, Azure AD, Google Workspace, and OneLogin. [Read the guide](https://developer.rhombus.com/implementations/saml-sso-provisioning) #### Updates **API Reference navigation** — The API Reference sidebar now organizes 800+ endpoints into 7 collapsible groups (Cameras & Video, Access Control, Security & Alerts, IoT Sensors, Organization & Users, Integrations, Devices & System) for faster browsing. **Rate limits guide** — New documentation covering how Rhombus API rate limiting works, including retry strategies and code examples. [Read the guide](https://developer.rhombus.com/rate-limits) **WebSocket documentation** — Comprehensive rewrite of the real-time event streaming guides covering authentication, connection lifecycle, STOMP protocol, event monitoring, and troubleshooting. [Read the guides](https://developer.rhombus.com/websocket/overview) **Improved implementation guides** — The [alarm monitoring](https://developer.rhombus.com/implementations/alarm-monitoring) and [IoT sensors](https://developer.rhombus.com/implementations/iot-sensors) guides now include complete API workflows with multi-language code examples. --- **Updated**: 2026-04-20 --- ### Major API Expansion The Rhombus API has been updated with **29 new endpoints** added across **2 new service categories**. #### New Endpoints **Relay** (24 endpoints): - NVR management: details, state, uptime, reboot, unregister, firmware updates - Third-party camera integration: assign, authenticate, discover, manage passwords, RTSP endpoints - PTZ controls: move and status **Access Control Integrations** (4 endpoints): - Boulevard integration: create, read, update, delete, and connection testing #### New Service Categories - **Relay Webservice** --- **API Version**: 1.0 **Updated**: 2026-04-02 ## March 2026 _New Features_ — 2 new endpoints ### New API Endpoints The Rhombus API has been updated with **2 new endpoints** added. #### New Endpoints **Component**: - [`POST /api/component/findPaginatedComponentEventsByAccessControlledDoor`](https://developer.rhombus.com/api-reference/component-webservice/retrieve-all-component-events-relevant-to-the-specified-accesscontrolleddoor-1) - Retrieve all component events relevant to the specified AccessControlledDoor **Report**: - [`POST /api/report/getOccupancyCountsV2`](https://developer.rhombus.com/api-reference/report-webservice/get-occupancy-counts-v2) - Get occupancy counts V2 --- **API Version**: 1.0 **Updated**: 2026-03-07 ## February 2026 _New Features_ — 2 new endpoints ### New API Endpoints The Rhombus API has been updated with **2 new endpoints** added. #### New Endpoints **Report**: - [`POST /api/report/getBatchThresholdCrossingCountReport`](https://developer.rhombus.com/api-reference/report-webservice/get-batch-threshold-crossing-count-report) - Get batch threshold crossing count report - [`POST /api/report/getThresholdCrossingCountReportForOrg`](https://developer.rhombus.com/api-reference/report-webservice/get-org-wide-batch-threshold-crossing-count-report) - Get org wide batch threshold crossing count report --- **API Version**: 1.0 **Updated**: 2026-02-10 ## January 2026 _New Features_ — 5 new endpoints ### New API Endpoints The Rhombus API has been updated with **5 new endpoints** added. #### New Endpoints **Elevator**: - [`POST /api/component/elevator/addAccessControlledElevatorLandingLabel`](https://developer.rhombus.com/api-reference/elevator-webservice/create-a-label-that-can-be-assigned-to-an-access-controlled-elevator-landing) - Create a label that can be assigned to an access controlled elevator landing - [`POST /api/component/elevator/findAccessControlledElevatorLandingShadows`](https://developer.rhombus.com/api-reference/elevator-webservice/find-access-controlled-elevator-landing-shadows-within-the-org) - Find access controlled elevator landing shadows within the org - [`POST /api/component/elevator/findAccessControlledElevatorLandingShadowsByLocation`](https://developer.rhombus.com/api-reference/elevator-webservice/find-access-controlled-elevator-landing-shadows-within-the-specified-location) - Find access controlled elevator landing shadows within the specified location - [`POST /api/component/elevator/getAccessControlledElevatorLandingLabelsForOrg`](https://developer.rhombus.com/api-reference/elevator-webservice/get-all-access-controlled-elevator-landing-labels-for-the-organization) - Get all access controlled elevator landing labels for the organization - [`POST /api/component/elevator/removeAccessControlledElevatorLandingLabel`](https://developer.rhombus.com/api-reference/elevator-webservice/remove-a-label-to-an-access-controlled-elevator-landing) - Remove a label to an access controlled elevator landing --- **API Version**: 1.0 **Updated**: 2026-01-30 ## November 2025 _Enhancements, New Features_ — Documentation launch and navigation restructure (v0.1 to v0.3) ### Documentation Navigation Restructure Reorganized the documentation into topic-based navigation groups for easier discovery. - **Guides**: Getting started, implementation guides for cameras, access control, alarm monitoring, IoT sensors, and more - **Integrations**: Low-code/no-code platforms (Zapier, Make.com, N8N) and AI tool integration via MCP - **API Reference**: Complete REST API reference with live endpoint testing, auto-generated from the OpenAPI spec All existing links continue to work — no breaking changes to content or URLs. --- ### New API Endpoints The Rhombus API has been updated with **2 new endpoints** added. #### New Endpoints **Alert Monitoring**: - [`POST /api/alertmonitoring/disableMonitoringForLocation`](https://developer.rhombus.com/api-reference/alert-monitoring-webservice/disable-monitoring-for-location) - Disable monitoring for location - [`POST /api/alertmonitoring/enableMonitoringForLocation`](https://developer.rhombus.com/api-reference/alert-monitoring-webservice/enable-monitoring-for-location) - Enable monitoring for location --- ### New Documentation Launch Complete redesign of the Rhombus Developer Documentation. - **New platform**: Improved search, dark mode, and mobile support - **3-tab navigation**: Guides, Integrations, and API Reference for clear content separation - **Interactive API playground**: Live endpoint testing directly in the documentation - **Nightly sync**: Automated pipeline keeps API documentation current with production - **AI-ready**: MCP server integration, `llms.txt` context files, and downloadable OpenAPI spec Email to share feedback or request new content.