Authentication
Get a token from Keycloak, send it as a bearer header.
The API is the same one the console uses. Every request needs a bearer token issued by Keycloak for the eagleseye realm; the tenant is inside the token.
Getting a token
For a server-side integration, use the client credentials or password grant against the realm's token endpoint:
POST https://<host>/auth/realms/eagleseye/protocol/openid-connect/token
Content-Type: application/x-www-form-urlencoded
grant_type=password&client_id=eagleseye-console&username=<user>&password=<password>
The response carries access_token (valid for a few minutes) and refresh_token. For a browser or mobile app use the authorization code flow with PKCE instead, as the console does.
Using it
GET https://<host>/api/v1/vehicles
Authorization: Bearer <access_token>
Responses are JSON. Errors carry a JSON body with an error message and the usual status codes: 400 invalid, 401 no or expired token, 403 not allowed, 404 not found, 409 conflict.
The live socket
Browsers cannot set headers on a WebSocket, so the token rides the URL for that one endpoint:
wss://<host>/ws/live?access_token=<access_token>
The first frame is a snapshot of every vehicle of your tenant; every following frame is one position as it happens. See Live socket.