Integration API Overview

Every ARSA AI Box Series unit runs its own dashboard, and the dashboard has a REST API for your other systems: an ERP, a building management system, a traffic management centre, a BI tool or a script of your own. The API runs on the box itself, on your network. There is no ARSA cloud in between: your system calls the box, and the box calls your system when you subscribe to webhooks.

Two APIs On Every Box

• The platform API (/api/v1) is the same on every product: sites and their zones, cameras, alerts, live video and recordings, alert contacts and webhooks, sirens and relays, reports, and webhooks for integrators.
• The product API sits beside it and carries the product’s own figures:

A box runs one product, so it serves the platform API and that product’s API. Site and camera ids are the same in both.

How A Call Looks

curl --cacert box.pem \
  -H "Authorization: Bearer <API_KEY>" \
  "https://<BOX_HOST>/api/v1/sites"

<BOX_HOST> is the address you open the dashboard at. <API_KEY> is the token of an API account that an admin makes on the dashboard. The box uses its own certificate; box.pem is a copy of it, which an admin downloads on the dashboard (System, then API accounts, then Download the box’s certificate) with its fingerprint to check (The Box’s Certificate).

Where To Go Next

• Authentication and Scopes: API accounts, tokens, scopes, personal data, the rate limit and errors.
• Quick starts: Basic Safety Guard, Traffic Monitor, Smart Retail Counter and DOOH Audience Meter.
• Webhooks: detection events, summaries and alerts pushed to your system, and how to verify their signature.
• The reference of every operation: platform, Basic Safety Guard, Traffic Monitor, Smart Retail Counter and DOOH Audience Meter.

Versions

This documentation describes API version 1.0.0. The version is part of every path (/api/v1, /api/<product>/v1). Within a major version, changes only add: new operations, new optional fields and new values. A change that could break an integration comes with a new major version, served beside the old one for a transition period. Read fields you know and ignore the ones you do not, so additions do not affect you.

What The API Leaves To People

Some actions stay with a person signed in to the dashboard and are refused to API tokens: signing in, users and API accounts, the licence, updates, remote access, privacy settings, the face database and the notification channels. The keys and tokens of the machine feeds (the watchlist push, the POS and play-log feeds, the DATEX II and audience feeds) are also made on the dashboard by an admin of the site.