Your first authorised API request.

Plans & access

Personal API tokens, MCP and external automation require an active confirmed Power or Business camera subscription on your account. A widget requires an eligible subscription on its exact camera. A trial, staff role or similarly named legacy plan does not grant these commercial features. The ordinary signed-in app and MFA remain available on other plans.

The server rechecks access on new requests. Loss of eligibility pauses existing developer credentials and public delivery; you can still list/revoke credentials, disable shares and view owned saved footage under its normal retention rules.

Authenticate with an expiring token

1. Sign in interactively and open Account Settings → Account security.
2. Choose a token name, the minimum scopes and an expiry of 1–365 days. At most 20 active personal tokens are allowed.
3. Verify your current password and, when enrolled, a fresh authenticator or recovery factor. Copy the token once.
4. Store it in a private server environment or secret manager as CAMBACKUP_API_TOKEN. Send it only in Authorization: Bearer … over HTTPS.

Do not put a real token in source, a query string, browser code, screenshots, an AI conversation or command history. Tokens cannot refresh into an interactive login, change authentication settings, enroll MFA or mint more credentials. Revocation, expiry and security-session changes invalidate them. Interactive sign-in credentials are for app sessions; do not build a password-scraping integration.

Make a harmless first read

Base URL: https://api.cambackup.com/api/v1. Preserve the exact trailing-slash convention from the reference. This example requires cameras:read. Read the token privately into the environment first; the example does not contain a working credential.

curl --fail-with-body \
+  --header "Authorization: Bearer $CAMBACKUP_API_TOKEN" \
+  https://api.cambackup.com/api/v1/camera/

The camera list returns only resources owned by the authenticated account. Do not log the full result: camera configuration can contain sensitive information. Test a denied scope and an unrelated resource as well as a successful request.

Choose the smallest scope

Groups use :read and :write. Exact routes are mapped explicitly; an unknown route fails closed. A write permission is not a substitute for any separately required read permission.

Read access can reveal private configuration and playback capabilities. Billing write can affect a subscription. Admin scopes never grant an administrator role. Start/stop live operations require write even where a legacy route uses GET. Device gateway pairing and security mutations require interactive authentication.

Work with confirmed recording and media

Recording controls set desired work; they do not prove a saved video exists. Check GET /recording-entitlement/{id}/, then use the documented start/stop actions, recorded timeline and confirmed recording resources. Camera entitlement, storage, output policy and current account state still apply.

curl --fail-with-body \
+  --header "Authorization: Bearer $CAMBACKUP_API_TOKEN" \
+  'https://api.cambackup.com/api/v1/video-recording/?limit=25&camera_id=123'

Replace camera 123 with an owned ID. Recorded-list pagination accepts limit from 1–100 and a positive before_id from the last returned record; continue only while results remain. Optional camera_id narrows the list. Other resources have their own documented pagination rather than one universal cursor format.

Clip/snapshot requests can return a background job. Inspect GET /jobs/{id}/ until a terminal state, then use the resulting owned resource. Private media GET/HEAD supports media:read, ownership checks and byte ranges. Browser playback can use the returned short-lived media capabilities. URLs stay on CamBackup domains; capability URLs remain secrets and must not be sent to analytics or public tools.

Account SSE uses current-token checks while open. Video bytes and event streams are ordinary API workflows, not MCP tool output. Disconnect consumers cleanly and respect live demand bounds.

Connect a POS system, sensor or application

A camera-scoped integration key can only submit named events for that camera. Create it interactively in the camera’s integration settings and store it privately as CAMBACKUP_CAMERA_KEY. Alternatively use a personal token with recordings:write on POST /camera-integrations/{id}/events/.

curl --fail-with-body --request POST \
+  --header "Authorization: Bearer $CAMBACKUP_CAMERA_KEY" \
+  --header 'Content-Type: application/json' \
+  --data '{"external_id":"sale-2026-0001","name":"Checkout completed","duration":60}' \
+  https://api.cambackup.com/api/v1/integration-events/

• external_id: a stable operation identifier, 1–128 characters. Keep it identical on retries.
• name: a short event label, 1–120 characters. Avoid customer/payment data.
• duration: 0 for a bookmark, 1–3600 for future capture seconds. No pre-roll is created.

Identical retries return the existing event; changed contents under the same ID return 409. At most 60 new events per camera per minute are accepted. A requested capture keeps one absolute deadline through interruptions and retries. An already requested recording window is not extended. Inspect the event’s capture state and the real timeline; HTTP 202 is not proof of saved footage.

Handle errors and uncertain outcomes

Error bodies can be JSON or plain text; inspect status and content type rather than assuming one global error envelope. Keep logs to safe route templates, status and non-secret correlation information. A timeout can leave a mutation’s outcome unknown. Inspect current state or use the same event idempotency key before retrying. There is no universal guarantee that any POST is automatically safe to repeat.

The complete method & schema reference

Open the interactive API reference or read the generated OpenAPI JSON. It covers the actual supported routes, request bodies and response schemas. Keep client code aligned with that version rather than guessing endpoint names from this introduction.

Next: step-by-step token setup, MCP clients, or public camera widgets.