API Reference · v1

Digital Signage API

A REST API for digital signage: create a workspace, upload or generate slides, register a TV or display, assign a schedule, and read back a live HLS stream link. It is the same API behind the InfoSlides CLI and MCP server, so an AI agent can take an account from empty to a running screen without a human touching the dashboard.

Base URL

https://infoslides.app

Every path below is relative to this host. The machine-readable description of the same surface lives at /v1/openapi.json and needs no credential to fetch.

Authentication

Send a workspace API key as a bearer token on every request:

Authorization: Bearer isk_admin_…
Key formatScope
isk_admin_ Full workspace-admin credential. Reaches every authenticated endpoint the workspace's plan allows.
isk_dp_ Push-only data-provider key, bound to specific slide ids. Restricted by middleware to exactly one request shape — POST /v1/slides/{id}/source for a bound slide. Every other route is rejected with KeyScopeViolation before routing considers it, so a leaked push key can never read or modify anything else.

A tenant session token obtained through the CLI login flow (infoslides login) works anywhere an admin key does.

POST /v1/tenants is the one anonymous endpoint. It provisions a brand-new workspace on the permanent free plan (1 screen, 4 slideshows, 2 users, 200 MB, no credit card, no expiry) and returns its admin API key exactly once — the key is never recoverable afterwards. Nothing else under /v1 is reachable without a credential.

Response envelopes

Every JSON response wraps its payload in data, with optional warnings:

{
  "data": { "deviceId": "…", "name": "Lobby screen" },
  "warnings": [ { "code": "AspectMismatch", "message": "…" } ]
}

Errors use a parallel shape, with details.fields populated on validation failures:

{
  "error": {
    "code": "ValidationFailed",
    "message": "Unknown signup source 'banana'.",
    "details": { "fields": { "source": ["Must be one of: Unknown, Web, Api, Cli, Mcp."] } }
  }
}

Two responses are deliberately not enveloped: GET /v1/slides/{id}/preview.png returns raw image/png bytes, and the CLI auth legs return HTTP redirects.

Idempotency

Creating endpoints accept an Idempotency-Key request header (up to 128 characters). The first successful response for a key is stored for 24 hours; a repeat request with the same key returns that stored response verbatim, with Idempotent-Replay: true, without re-executing the action. This matters for agents, which retry more readily than humans do.

Endpoints that honour it are marked idempotent in the tables below.

Endpoints

Workspaces

Provision a workspace and read back its plan and quota.

POST /v1/tenantsidempotentno auth

Provisions a brand-new workspace on the free plan and returns its admin API key exactly once. Accepts an optional source field (web, api, cli, mcp) recording how the signup originated.

GET /v1/tenantany credential

"Whoami": the caller's workspace identity, plan, device-quota usage, and the scope of the credential used.

POST /v1/auth/resend-verificationany credential

Resends the workspace owner's verification email. Idempotent and silent — always reports success.

CLI authentication

Browser-based OAuth login for the CLI, using PKCE and a loopback redirect.

GET /v1/auth/cli/startno auth

Browser entry point. Validates the PKCE and loopback parameters, then redirects into the OAuth flow for the requested provider (google, microsoft, github).

GET /v1/auth/cli/completeno auth

Completion leg after external sign-in. Issues a single-use authorization code and redirects back to the CLI's loopback listener.

POST /v1/auth/cli/exchangeno auth

Exchanges the authorization code plus its PKCE verifier for a session token.

Slideshows

The unit of content: a deck of slides that renders to one HLS stream.

POST /v1/slideshowsidempotentadmin key / session

Creates a slideshow, optionally seeded with an ordered list of media-URL or template-backed slides.

POST /v1/slideshows/pptxidempotentadmin key / session

Uploads a .pptx file (multipart/form-data) and creates a slideshow from it.

GET /v1/slideshowsadmin key / session

Lists the workspace's slideshows as a page of summaries.

GET /v1/slideshows/{id}admin key / session

Returns a slideshow's full detail: resolution and its unified slide sequence.

PATCH /v1/slideshows/{id}admin key / session

Partial update: title, resolution, and/or a full slide reorder. Any change queues a re-render.

POST /v1/slideshows/{id}/cloneidempotentadmin key / session

Clones a slideshow — its row, its PPTX file, and every child slide — within the workspace.

POST /v1/slideshows/{id}/slidesidempotentadmin key / session

Inserts a slide from a media URL or an existing media asset id. An aspect-ratio mismatch attaches an AspectMismatch warning rather than failing.

POST /v1/slideshows/{id}/slides/dynamicidempotentadmin key / session

Inserts a template-driven dynamic slide. Push its data with POST /v1/slides/{id}/source.

Slides

Per-slide visibility rules, live data pushes, and self-verification previews.

PUT /v1/slides/{id}/conditionsadmin key / session

Replaces a slide's visibility conditions (time of day, weekday, data triggers). An empty list clears them.

POST /v1/slides/{id}/sourceadmin key, or bound isk_dp_ key

Pushes a JSON payload onto a dynamic slide's live data, validated against the template's data schema, and queues a re-render. Supports ?dryRun=true. The only endpoint a push-only isk_dp_ key may call.

GET /v1/slides/{id}/preview.pngadmin key / session

Returns a PNG of the slide's current rendered state — raw image/png bytes, not an envelope.

Media

Direct file upload into the workspace's media library.

POST /v1/mediaidempotentadmin key / session

Uploads a file (multipart/form-data, a single file part) into the media library and returns its id, type, and pixel dimensions.

Templates

Reusable slide templates, authored as HTML/CSS or generated from a prompt.

POST /v1/templatesidempotentadmin key / session

Creates a workspace-owned template from code mode (html + css) or AI mode (prompt + sampleJson). Supports ?dryRun=true. Requires a plan that includes AI Studio.

GET /v1/templatesadmin key / session

Lists templates visible to the workspace — global templates plus its own.

GET /v1/templates/{id}admin key / session

Returns a single template visible to the workspace.

Gallery

Curated starter decks that can be cloned into a workspace.

GET /v1/galleryany credential

Lists the curated starter-gallery decks available to clone.

POST /v1/gallery/{id}/cloneidempotentadmin key / session

Clones a starter-gallery deck into the caller's workspace, keeping its original display name.

Devices and streams

Register a screen, tell it what to play, and read back its HLS stream link.

POST /v1/devicesidempotentadmin key / session

Registers a device (TV, display, menu board). Gated by owner email verification and the workspace's active-device quota.

GET /v1/devicesadmin key / session

Lists every device owned by the workspace, broadcast channels included.

GET /v1/devices/{id}/statusadmin key / session

Returns a device's online/offline status and its currently-resolved slideshow.

POST /v1/devices/{id}/scheduleadmin key / session

Assigns a single always-on slideshow to a device, replacing any existing default entry. An orientation mismatch attaches an AspectMismatch warning rather than failing.

GET /v1/devices/{id}/streamadmin key / session

Returns the device's stable HLS stream-link URL. Always returns a URL, flagging StreamNotReady when nothing is playable yet.

API keys

Issue and revoke the credentials agents authenticate with.

POST /v1/apikeysidempotentworkspace admin

Creates a workspace API key — admin (isk_admin_) or push-only data-provider (isk_dp_, bound to specific slide ids). The plaintext key is returned exactly once.

GET /v1/apikeysworkspace admin

Lists the workspace's keys, revoked ones included. Only key prefixes are returned, never full keys.

DELETE /v1/apikeys/{id}workspace admin

Revokes an API key. Idempotent — revoking an already-revoked key still succeeds.

Billing

Upgrade path out of the free plan.

POST /v1/billing/checkoutworkspace admin

Returns a Paddle checkout URL the workspace admin can use to upgrade or change plan.

Error codes

Every error envelope carries exactly one of these codes, so a client can branch on error.code rather than parsing messages.

CodeHTTPMeaning
Unauthorized 401 Missing credential, or a credential type that is not an API key.
InvalidApiKey 401 The presented API key does not match any known key.
ApiKeyRevoked 401 The presented API key exists but has been revoked.
Forbidden 403 Valid credential, insufficient rights.
EmailNotVerified 403 Workspace owner's email is unverified. Remediate with POST /v1/auth/resend-verification.
EntitlementRequired 403 The feature requires a paid plan. Details carry an upgrade URL.
DeviceLimitReached 403 The workspace's active-device quota is exhausted.
KeyScopeViolation 403 A push-only data-provider key was used outside its allowed endpoint or slides.
ValidationFailed 400 Schema or field validation error. details.fields lists the offending fields.
NotFound 404 The resource does not exist within this workspace.
RateLimited 429 Too many requests. The Retry-After header is set.
InternalError 500 Unexpected server error.

Zero to a live screen

Four calls take a brand-new workspace to a playable HLS stream. The first is anonymous; the rest use the key it returns.

# 1. Provision a workspace (anonymous) — returns an admin API key, once.
curl -X POST https://infoslides.app/v1/tenants \
  -H 'Content-Type: application/json' \
  -d '{"tenantName":"Acme Cafe","ownerEmail":"[email protected]","source":"api"}'

# 2. Clone a starter deck from the gallery.
curl -X POST https://infoslides.app/v1/gallery/$GALLERY_ID/clone \
  -H "Authorization: Bearer $ISK"

# 3. Register the screen.
curl -X POST https://infoslides.app/v1/devices \
  -H "Authorization: Bearer $ISK" -H 'Content-Type: application/json' \
  -d '{"name":"Lobby screen"}'

# 4. Assign the deck, then read the stream link.
curl -X POST https://infoslides.app/v1/devices/$DEVICE_ID/schedule \
  -H "Authorization: Bearer $ISK" -H 'Content-Type: application/json' \
  -d '{"slideshowId":"'$SLIDESHOW_ID'"}'
curl https://infoslides.app/v1/devices/$DEVICE_ID/stream \
  -H "Authorization: Bearer $ISK"

The same workflow is available as a CLI and as an MCP server for AI agents — one dependency-free binary, 27 tools. See github.com/arnibj/InfoSlides.MCP or the agent guide.

© 2026 InfoSlides. All rights reserved.
An unhandled error has occurred. Reload