SIMULATION No cameras, door controllers or dispatch links are connected to this host. Device telemetry, video and alarms are synthetic. Platform services, permissions, audit chain, package install and sandbox are real.

PK-261005-002 · Milestone XProtect — API Gateway

v0.1.2 · target OHCHS · built 2026-10-05 12:08:50 EDT by it-admin-01
P1 3 P2 2 Unacked 5 Video 17/19 17:19:14 EDT OPSOC Operator 01
BuiltSandboxApprovedPromoted
bundle sha256 8f3e0eeafebcc97b… 12 files mode read_only

Next gate

Gates are operated by District IT. Current role can review the package but not advance it.

manifest.json

sha256 8ceef84aa6d6c2b791e1…
1{
2    "schema": "msad17.connector-manifest/1",
3    "name": "msad17/milestone_apigw",
4    "build_id": "PK-261005-002",
5    "version": "0.1.2",
6    "label": "Milestone XProtect — API Gateway",
7    "vendor": "Milestone Systems (XProtect 2023 R1+)",
8    "category": "VMS",
9    "target_site": {
10        "id": "ohchs",
11        "name": "Oxford Hills Comprehensive High School"
12    },
13    "generated": {
14        "by": "Prepackaged Catalog 0.7.0",
15        "template": "tpl-r4",
16        "mode": "prepackaged",
17        "source": "prepackaged",
18        "at": "2026-10-05T12:08:50-04:00",
19        "requested_by": "it-admin-01"
20    },
21    "runtime": {
22        "php": ">=8.2",
23        "extensions": [
24            "curl",
25            "json"
26        ],
27        "platform": ">=0.7.0",
28        "entry": "Msad17\\Connectors\\MilestoneApigw\\B2610051208502\\Connector"
29    },
30    "protocol": "REST (JSON) · OAuth2 via XProtect IDP · Events & State WebSocket",
31    "auth": {
32        "method": "oauth2_password_idp",
33        "secret_refs": [
34            "${secret:msad17/ohchs/xprotect/username}",
35            "${secret:msad17/ohchs/xprotect/password}"
36        ]
37    },
38    "capabilities": [
39        "inventory",
40        "health",
41        "live_uri",
42        "playback_uri",
43        "events"
44    ],
45    "mode": "read_only",
46    "write_actions": [],
47    "blocked_actions": [
48        "door.unlock",
49        "door.lock",
50        "door.schedule_override",
51        "credential.grant",
52        "credential.revoke",
53        "ptz.move",
54        "firmware.push",
55        "config.write"
56    ],
57    "endpoints": [
58        {
59            "method": "POST",
60            "path": "/API/IDP/connect/token",
61            "purpose": "OAuth2 token (XProtect basic user)"
62        },
63        {
64            "method": "GET",
65            "path": "/api/rest/v1/cameras",
66            "purpose": "Camera inventory → registry reconciliation"
67        },
68        {
69            "method": "GET",
70            "path": "/api/rest/v1/recordingServers",
71            "purpose": "Recorder inventory / status"
72        },
73        {
74            "method": "GET",
75            "path": "/api/ws/events/v1",
76            "purpose": "Events & State stream"
77        }
78    ],
79    "egress": {
80        "allow": [
81            "config.base_url host only"
82        ],
83        "deny": [
84            "internet",
85            "other VLANs"
86        ]
87    },
88    "licensing": "Uses existing XProtect basic user; no extra SDK license for API Gateway REST.",
89    "normalizes_to": "msad17.event/1",
90    "ownership": {
91        "owner": "MSAD 17 District IT",
92        "developer_support_after_promote": "none",
93        "rollback": "Demote in Integration Bot → previous promoted build re-activates"
94    }
95}