This document describes the REST API endpoints provided by LightNVR.
LightNVR provides a RESTful API that allows you to interact with the system programmatically. The API is accessible via HTTP and returns JSON responses using the cJSON library. The API is served by the libuv + llhttp web server.
If authentication is enabled in the configuration file, API requests must include a valid session token. Obtain a session by calling the login endpoint, then include the session cookie in subsequent requests.
# Login to get a session
curl -c cookies.txt -X POST -H "Content-Type: application/json" \
-d '{"username":"admin","password":"yourpassword"}' \
http://your-lightnvr-ip:8080/api/auth/login
# Use session cookie for subsequent requests
curl -b cookies.txt http://your-lightnvr-ip:8080/api/streamsGET /api/streams
Returns a list of all configured streams.
Response:
{
"streams": [
{
"id": 0,
"name": "Front Door",
"url": "rtsp://192.168.1.100:554/stream1",
"enabled": true,
"streaming_enabled": true,
"width": 1920,
"height": 1080,
"fps": 15,
"codec": "h264",
"priority": 10,
"record": true,
"segment_duration": 900,
"protocol": 0,
"record_audio": true,
"detection_based_recording": 0,
"detection_model": "",
"detection_threshold": 0.5,
"detection_interval": 10,
"pre_detection_buffer": 0,
"post_detection_buffer": 3,
"detection_api_url": "",
"is_onvif": false,
"onvif_username": "",
"onvif_password": "",
"onvif_profile": "",
"ptz_enabled": false,
"backchannel_enabled": false,
"buffer_strategy": "auto",
"retention_days": 30,
"status": "connected"
}
]
}GET /api/streams/{name}
Returns information about a specific stream by name.
GET /api/streams/{name}/full
Returns complete stream information including all configuration fields.
POST /api/streams
Adds a new stream. All fields from the stream schema are accepted.
PUT /api/streams/{name}
Updates an existing stream.
DELETE /api/streams/{name}
Deletes a stream.
POST /api/streams/test
Tests connectivity to a stream URL.
POST /api/streams/{name}/refresh
Forces a stream reconnection.
GET /api/streams/{name}/retention
Returns retention settings for a specific stream.
PUT /api/streams/{name}/retention
Updates retention settings for a specific stream.
GET /api/streams/{name}/zones
Returns detection zones for a stream.
POST /api/streams/{name}/zones
Creates or updates detection zones for a stream.
DELETE /api/streams/{name}/zones
Deletes detection zones for a stream.
GET /api/streams/{name}/ptz/capabilities
Returns PTZ capabilities for a stream's camera.
POST /api/streams/{name}/ptz/move
Starts continuous PTZ movement.
POST /api/streams/{name}/ptz/stop
Stops PTZ movement.
POST /api/streams/{name}/ptz/absolute
Moves to an absolute PTZ position.
POST /api/streams/{name}/ptz/relative
Performs a relative PTZ movement.
POST /api/streams/{name}/ptz/home
Moves to the home position.
POST /api/streams/{name}/ptz/set-home
Sets the current position as home.
GET /api/streams/{name}/ptz/presets
Lists PTZ presets.
POST /api/streams/{name}/ptz/goto-preset
Moves to a PTZ preset.
PUT /api/streams/{name}/ptz/preset
Creates or updates a PTZ preset.
GET /api/recordings
Returns a list of recordings. Supports query parameters for filtering by stream name, date range, and pagination.
GET /api/recordings/{id}
Returns information about a specific recording.
DELETE /api/recordings/{id}
Deletes a recording.
GET /api/recordings/play/{id}
Streams a recording for playback.
GET /api/recordings/download/{id}
Downloads a recording file.
PUT /api/recordings/{id}/protect
Toggles protection status on a recording (protected recordings are exempt from auto-deletion).
PUT /api/recordings/{id}/retention
Sets a per-recording retention override.
POST /api/recordings/batch-delete
Deletes multiple recordings at once. Returns a job ID for progress tracking.
GET /api/recordings/batch-delete/progress/{job_id}
Returns progress for a batch delete operation.
POST /api/recordings/batch-protect
Protects or unprotects multiple recordings at once.
GET /api/recordings/protected
Returns all protected recordings.
GET /api/recordings/files/check
Checks if a recording file exists on disk.
DELETE /api/recordings/files
Deletes a recording file from disk.
POST /api/recordings/sync
Synchronizes the recordings database with files on disk.
GET /api/timeline/segments
Returns recording segments for the timeline view. Supports query parameters for stream name and date range.
GET /api/timeline/manifest
Returns a manifest of available timeline data.
GET /api/timeline/play
Streams video for timeline playback at a specified point in time.
GET /api/system
GET /api/system/info
Returns system information including version, uptime, CPU/memory/storage usage, and stream counts.
The response also includes a versions.items array summarizing runtime-detected software versions such as the base OS, LightNVR, optional services, and linked libraries.
GET /api/system/status
Returns system health status.
GET /api/system/logs
Returns recent system log entries.
POST /api/system/logs/clear
Clears the system log file.
POST /api/system/restart
Restarts the LightNVR service.
POST /api/system/shutdown
Shuts down the LightNVR service.
POST /api/system/backup
Creates a backup of the database.
GET /api/settings
Returns system configuration settings.
POST /api/settings
Updates system configuration settings.
GET /api/health
Returns basic health status.
GET /api/health/hls
Returns HLS streaming subsystem health.
GET /api/ice-servers
Returns WebRTC ICE server configuration (STUN/TURN servers).
POST /api/auth/login
Authenticates a user and creates a session.
Request Body:
{
"username": "admin",
"password": "yourpassword"
}POST /api/auth/login/totp
Completes login with a TOTP code (for users with MFA enabled).
Request Body:
{
"token": "pending_session_token",
"totp_code": "123456"
}POST /api/auth/logout
GET /logout
Destroys the current session.
GET /api/auth/verify
Verifies that the current session is valid.
GET /api/auth/users
Returns all users (admin only).
POST /api/auth/users
Creates a new user.
GET /api/auth/users/{id}
Returns a specific user.
PUT /api/auth/users/{id}
Updates a user.
DELETE /api/auth/users/{id}
Deletes a user.
POST /api/auth/users/{id}/api-key
Generates an API key for a user.
PUT /api/auth/users/{id}/password
Changes a user's password.
PUT /api/auth/users/{id}/password-lock
Locks or unlocks a user's password from being changed.
POST /api/auth/users/{id}/totp/setup
Initiates TOTP setup, returns secret and QR code URI.
POST /api/auth/users/{id}/totp/verify
Verifies a TOTP code during setup to confirm it works.
POST /api/auth/users/{id}/totp/disable
Disables TOTP for a user.
GET /api/auth/users/{id}/totp/status
Returns whether TOTP is enabled for a user.
GET /api/onvif/discovery/status
Returns ONVIF discovery service status.
POST /api/onvif/discovery/discover
Triggers an ONVIF device discovery scan.
GET /api/onvif/devices
Returns discovered ONVIF devices.
GET /api/onvif/device/profiles
Returns media profiles for an ONVIF device.
POST /api/onvif/device/add
Adds a discovered ONVIF device as a stream.
POST /api/onvif/device/test
Tests connectivity to an ONVIF device.
GET /api/detection/results/{stream_name}
Returns recent detection results for a stream.
GET /api/detection/models
Returns available detection models.
GET /api/motion/config/{stream_name}
Returns motion recording configuration for a stream.
POST /api/motion/config/{stream_name}
Creates or updates motion recording configuration.
DELETE /api/motion/config/{stream_name}
Deletes motion recording configuration for a stream.
POST /api/motion/test/{stream_name}
Triggers a test motion event for debugging.
GET /api/motion/stats/{stream_name}
Returns motion recording statistics.
GET /api/motion/recordings/{stream_name}
Returns motion-triggered recordings.
DELETE /api/motion/recordings/{recording_id}
Deletes a motion recording.
POST /api/motion/cleanup
Triggers cleanup of expired motion recordings.
GET /api/motion/storage
Returns motion recording storage usage.
GET /hls/{stream_name}/{filename}
Serves HLS playlist (.m3u8) and segment (.ts) files for live streaming.
All API endpoints return appropriate HTTP status codes:
- 200: Success
- 400: Bad Request
- 401: Unauthorized
- 404: Not Found
- 500: Internal Server Error
Error responses include a JSON object with an error message:
{
"error": "Stream not found"
}Login and list streams:
# Login
curl -c cookies.txt -X POST -H "Content-Type: application/json" \
-d '{"username":"admin","password":"yourpassword"}' \
http://your-lightnvr-ip:8080/api/auth/login
# List streams
curl -b cookies.txt http://your-lightnvr-ip:8080/api/streams
# Get system information
curl -b cookies.txt http://your-lightnvr-ip:8080/api/system
# Add a new stream
curl -b cookies.txt -X POST -H "Content-Type: application/json" \
-d '{"name":"New Camera","url":"rtsp://192.168.1.103:554/stream1","enabled":true,"width":1280,"height":720,"fps":10,"codec":"h264","priority":5,"record":true}' \
http://your-lightnvr-ip:8080/api/streams
# Trigger ONVIF discovery
curl -b cookies.txt -X POST http://your-lightnvr-ip:8080/api/onvif/discovery/discover