api reference

Notes for integrators

• CORS is open (Access-Control-Allow-Origin: *), so browser clients work directly.
• The API is unauthenticated on the LAN, like the other device-facing surfaces on port 7090. Do not expose port 7090 to the internet.
• The API works with or without the Loxone integration enabled — it is not a Loxone surface and does not depend on one.
• Additive changes (new fields, new source.kind values, new event types) are not breaking. Ignore fields and event types you do not know.
• A device that reconnects is put back to playing by the server. If a player drops off and returns while its zone was playing, the server starts its stream again by itself — the position restarts, the track and queue do not. You do not need to watch for this and you should not send a stop/play (or an off/on/play) to force it. Anything doing that today can drop it; if you still see a zone reporting playing with nothing audible after a device returns, that is a bug worth reporting rather than working around.
• The version is in the path. Within v1, fields are only ever added — nothing is renamed or removed under you. Anything that has to break appears as v2, served alongside v1 rather than replacing it, so you migrate when it suits you. Calling /api/... without a version returns 404 api-version-required and names the prefix to use, rather than failing in some way you have to guess at.