API Reference
Every public and customer-facing endpoint of the Streamway API: live streams, restream, clips, on-demand media, analytics, webhooks and account management. Two families are out of scope: server-to-server fleet endpoints under /v1/system, gated by a system key and an IP allowlist, and the operator-only endpoints that expose fleet topology, which are documented internally.
Conventions
Rules that hold across every endpoint. Read this once and the reference below gets much shorter.
Response envelope
Successful responses wrap the payload: { "success": true, "data": … }. The Response examples in this reference show the data payload only — so a field shown as id is read at body.data.id. Every endpoint that does not follow this carries an explicit note: the stats group, the billing group, the manifest redirect, the embed player, and the 204 deletes.
Errors
{ "success": false, "error": "…", "code": "…" }. Two layers deviate and it matters when you write a client: the auth and role middleware omit code entirely, and the rate limiter answers with a different shape altogether — { "code": "too_many_requests", "message": "…" }. Branch on the HTTP status, not on the presence of a field.
Authentication
Three credentials, tried in this order: x-api-key, then the access_token cookie, then Authorization: Bearer <jwt>. A key that fails to resolve does not end the request — it falls through to the next credential, so a stale key beside a valid session silently succeeds as the session user.
Rate limiting
Per client IP, 100 requests per minute by default, applied to everything under /v1. No X-RateLimit-* headers are sent — the only signal is the 429 itself, so back off on status rather than waiting for a header that never arrives.
Pagination
Three shapes, by group. Streams use { page, limit, total, total_pages }; clips use { page, per_page, total, items }; recordings, media, webhook logs, the stream error journal and system events use { total, limit, offset }. Empty results are inconsistent too — some return [], some null — so treat both as empty.
Times, sizes and IDs
All timestamps are RFC3339 UTC. All sizes and transfer figures are bytes, never gigabytes. Note which id an endpoint takes: the public playback routes key on ingress_id, while the client routes key on the stream id — passing the wrong one returns a clean 404 that looks like a missing resource.
Error codes
Service
Health, build info and counters. Not under /v1, no authentication.
Authentication
Register, sign in, rotate sessions and reset passwords.
Public & Playback
Unauthenticated endpoints: platform counters, public stream lookup, manifest redirect and the embed player.
Streams
Create, configure and monitor live streams — push (RTMP) and pull (RTSP/RTMP/HLS) ingest.
Restream
Forward a live stream on to YouTube, Twitch and other RTMP endpoints while it is running.
Clips
Cut shareable segments out of a stream by time offset.
Schedules
Plan broadcasts ahead of time and drive a calendar view.
Analytics
Viewer and delivery metrics, ingest health, player quality of experience, and live vs on-demand traffic.
Recordings
Recorded stream sessions.
Media Library (VOD)
Upload, organise, transcode and play back on-demand files.
Webhooks
Receive stream, recording and media events as HTTP callbacks.
API Keys
Long-lived credentials for server-to-server calls.
Templates
Reusable stream settings presets.
Organizations
Teams, membership, roles and invitations.
Ingest Tasks
Pull-based ingest: we connect out to an RTSP, RTMP or HLS source and publish it as a stream.
Account
Profile, workspace settings, quotas, onboarding and the account event log.
Billing
Subscription and invoices. Proxied to the platform billing service.
Notifications
Which events reach you by email and by webhook.