API

Xonaplay API

A REST API to upload, process, and deliver your videos. Request an upload ticket, push the file straight to the engine, and get an adaptive HLS stream (360p to 1080p) with AES-128 encryption ready to embed. JSON over HTTPS, authenticated with per-workspace API keys.

Base URLhttps://api.xonaplay.com/v1

Quickstart

1

Create an API key and authenticate your first call

Generate an API key from the dashboard (Workspace → API Keys). Production keys are prefixed with xpl_live_. Send it as a Bearer token and confirm the connection by listing your videos.

curl https://api.xonaplay.com/v1/videos \
  -H "Authorization: Bearer xpl_live_8f3c2a9b41d7e6..." \
  -H "X-Xona-Workspace: ws_4a7f21c9"
2

Request an upload ticket and push the file to the engine

Ask the control plane for an upload ticket. It returns an engine uploadUrl and a short, single-use token (X-Upload-Token). You upload the raw file directly to the engine with that token, bypassing the control plane.

# 1) Request the ticket
curl -X POST https://api.xonaplay.com/v1/videos/upload-ticket \
  -H "Authorization: Bearer xpl_live_8f3c2a9b41d7e6..." \
  -H "X-Xona-Workspace: ws_4a7f21c9" \
  -H "Content-Type: application/json" \
  -d '{"filename":"demo.mp4","title":"My demo"}'
# => { "videoId":"vid_92ab", "uploadUrl":"https://engine.xonaplay.com/upload", "uploadToken":"ut_3f..." }

# 2) Upload the file straight to the engine
curl -X POST https://engine.xonaplay.com/upload \
  -H "X-Upload-Token: ut_3f..." \
  -F "[email protected]"
3

Check the status and grab the HLS URL

Poll the video (or subscribe to a webhook) until status is ready. Once transcoding finishes, the response includes the master.m3u8 URL with the adaptive variants, ready for your player.

curl https://api.xonaplay.com/v1/videos/vid_92ab \
  -H "Authorization: Bearer xpl_live_8f3c2a9b41d7e6..." \
  -H "X-Xona-Workspace: ws_4a7f21c9"
# => { "id":"vid_92ab", "status":"ready",
#      "hls":"https://api.xonaplay.com/v1/hls/ws_4a7f21c9/vid_92ab/master.m3u8",
#      "variants":["360p","480p","720p","1080p"] }

Authentication

Every request is authenticated with an API key sent as a Bearer token in the Authorization header. Production keys use the xpl_live_ prefix; test keys use xpl_test_. Also pass the workspace your resources belong to via the X-Xona-Workspace header (id ws_...). Treat keys as secrets: never ship them in client-side code or expose them in the browser. If a key leaks, revoke and rotate it from the dashboard. Calls without a valid key return 401; a valid key against the wrong workspace returns 403.

Authorization: Bearer xpl_live_8f3c2a9b41d7e6c5a0d2
X-Xona-Workspace: ws_4a7f21c9
Content-Type: application/json

Endpoints

Auth

GET/auth/whoamiReturns the workspace and permissions tied to the current API key.
GET/auth/usageCurrent-period usage: storage, transcoded minutes, and bandwidth.

Videos

POST/videos/upload-ticketCreates a video and returns a one-time uploadUrl + uploadToken for the engine.
GET/videos/:idVideo status (uploading, processing, ready, failed), metadata, and HLS URL.
GET/videosPaginated list of the workspace's videos, with status and date filters.
DELETE/videos/:idDeletes the video, its HLS variants, and the underlying storage assets.

Playback

GET/hls/:tenant/:video/master.m3u8Master HLS playlist with the adaptive variants. Segments encrypted with AES-128.

Webhooks

POST/webhooksRegisters an endpoint to receive events (video.ready, video.failed, video.deleted).
GET/webhooksLists configured webhooks and their delivery status.
DELETE/webhooks/:idRemoves a registered webhook.

API Keys

POST/api-keysCreates a new API key. The full secret is shown only once.
GET/api-keysLists the workspace's keys (prefix and last 4 digits, never the secret).
DELETE/api-keys/:idRevokes a key immediately; calls using it start returning 401.

This page summarizes the main endpoints. The full interactive reference, with request/response schemas, error codes, and a try-it client, is generated with OpenAPI (Scalar) directly from the Elysia engine and always reflects what's in production. The raw OpenAPI spec is available at /v1/openapi.json.