Developers

REST control plane and signed webhook design.

Lockia Push exposes a REST control plane. Devices speak MQTT to our gateway. Third-party integrations authenticate with Lockia Push machine identities and call the REST API with scoped tokens.

OAuth machine-to-machine

Issued through Lockia Push identity. Scopes per client, IP allowlists per environment, rotation in one click.

Scoped REST endpoints

POST /v1/messages, GET /v1/messages/:id, /v1/devices, /v1/audit-events. Same shape as the console uses.

Webhooks (not commercially enabled)

Endpoint management and SSRF-safe test delivery exist, but the signed event-delivery worker returns 501 and is not offered as a shipped customer feature.

SDK preview

Apache-licensed JavaScript and Android protocol-v2 SDKs include reconnect credentials, durable ACK state, and real-broker tests. Go and Rust SDKs remain roadmap items.

Broker isolation

Default-deny LockiaMQ authentication, authorization, TLS, and persistence are source-controlled and runtime-tested. Live HA promotion remains operator-gated.

Audit evidence

Core mutations and denials emit actor and result metadata. Retention workflows and exports require approved policy plus production evidence before contractual use.

Sample

Get a token, send an encrypted command, verify a webhook.

Three-step integration. Same code in the console's connection guide on /api-access.

1. Get an access tokenbash

curl -X POST $ZITADEL_ISSUER/oauth/v2/token \
  -u "$LOCKIA_CLIENT_ID:$LOCKIA_CLIENT_SECRET" \
  -d 'grant_type=client_credentials&scope=urn:zitadel:iam:org:project:id:$ZITADEL_PROJECT_ID:aud messages.write messages.read'

2. Send an encrypted commandbash

curl -X POST https://admin.lockiapush.com/v1/messages \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d @encrypted-envelope.json

3. Verify webhook signaturehint

# Header: X-Lockia-Signature: t=<unix>,v1=<hex>
# Verify: hmac_sha256(signing_secret, t + "." + raw_body) == v1