XFlow Platform API (5.3.5.0)

Which authentication source owns this account. "" means a native local account, which makes every document that already exists correct with no migration: absent reads as empty. Otherwise the config.env provider id. See MIXED_AUTH_SSO.md section 3.

The provider's immutable subject ("sub") for this account, bound on the first federated sign-in. SERVER-SET: never accepted from a client payload, and never written by an admin's edit except to clear it (see UserAccountUpdate).

List of camera group permissions for the user.

Disabled refuses the account's sign-ins (password and provider alike) and, through the session snapshot the auth middleware consults on every request, the tokens it already holds. Absent on pre-existing documents = false.

Email of the user.

First name of the user.

Date and time of the user's most recent successful login (zero if never).

Last name of the user.

Date and time the user was last updated.

Organization of the user.

Password of the user.

Phone number of the user.

Whether a user-role account may access Recordings (playback + schedule). Admins and super users always may; absent on pre-existing docs = false (no access until granted).

Role of the user.

SessionLifetimeMins overrides the deployment's JWT_EXPIRATION_MINS for this account: 0 = the deployment default, SESSION_LIFETIME_UNLIMITED = tokens that never expire, otherwise minutes (at least SESSION_LIFETIME_MIN_MINS). Local accounts only: a federated account keeps the deployment default, so the provider's users never hold a longer session than the deployment chose. Absent on pre-existing documents = 0.

List of stream groups for the user.

Title of the user.

Type of grant. Must be 'password'.

XFlow instance key provided by Optima DTS.

Password of the user.

Username

Password

Which authentication source owns this account. "" means a native local account, which makes every document that already exists correct with no migration: absent reads as empty. Otherwise the config.env provider id. See MIXED_AUTH_SSO.md section 3.

The provider's immutable subject ("sub") for this account, bound on the first federated sign-in. SERVER-SET: never accepted from a client payload, and never written by an admin's edit except to clear it (see UserAccountUpdate).

List of camera group permissions for the user.

Disabled refuses the account's sign-ins (password and provider alike) and, through the session snapshot the auth middleware consults on every request, the tokens it already holds. Absent on pre-existing documents = false.

Email of the user.

First name of the user.

Date and time of the user's most recent successful login (zero if never).

Last name of the user.

Date and time the user was last updated.

Organization of the user.

Password of the user.

Phone number of the user.

Whether a user-role account may access Recordings (playback + schedule). Admins and super users always may; absent on pre-existing docs = false (no access until granted).

Role of the user.

SessionLifetimeMins overrides the deployment's JWT_EXPIRATION_MINS for this account: 0 = the deployment default, SESSION_LIFETIME_UNLIMITED = tokens that never expire, otherwise minutes (at least SESSION_LIFETIME_MIN_MINS). Local accounts only: a federated account keeps the deployment default, so the provider's users never hold a longer session than the deployment chose. Absent on pre-existing documents = 0.

List of stream groups for the user.

Title of the user.

New password of the user.

Manager Settings — admin-role access IP restriction. When enabled, only clients whose IP/CIDR is listed in AdminIpWhitelist (or loopback) may authenticate as, or make API calls as, an admin. Unlike the per-protocol stream whitelists, an empty list WHILE ENABLED denies all non-loopback admin access (the whitelist is the authoritative admin-IP gate, not an additive filter). Fleet-managed (part of ManagedClusterConfig) since 2026-08-30.

Admin-role access IP whitelist. Applies only when admin_access_restriction_enabled is true.

List of allowed HTTP origins / referers.

Client IPs blacklisted by the auto-blacklister. Site-local and server-owned: written only by targeted $push/$pull, never by the full config save or a managed push.

Duration in hours for which a client IP is automatically blacklisted. A value of 0 results in the client IP being blacklisted indefinitely (until manually removed from the blacklist).

Enable the automatic blacklisting of client IPs that concurrently accessing more than auto_blacklist_hls_max_connections unique HLS streams.

Maximum number of unique HLS streams that can be concurrently accessed before a given client IP is automatically blacklisted.

IP exemptions from automatic blacklisting. If set to null, no IPs are exempted from automatic blacklisting.

Enable the automatic blacklisting of client IPs that concurrently accessing more than auto_blacklist_llhls_max_connections unique LLHLS streams.

Maximum number of unique LLHLS streams that can be concurrently accessed before a given client IP is automatically blacklisted.

Enable the automatic blacklisting of client IPs concurrently accessing more than auto_blacklist_rtmp_max_connections unique RTMP/S streams.

Maximum number of unique RTMP/S streams that can be concurrently accessed before a given client IP is automatically blacklisted.

Enable the automatic blacklisting of client IPs concurrently accessing more than auto_blacklist_rtsp_max_connections unique RTSP/S streams.

Maximum number of unique RTSP/S streams that can be concurrently accessed before a given client IP is automatically blacklisted.

Enable the automatic blacklisting of client IPs concurrently accessing more than auto_blacklist_srt_max_connections unique SRT streams.

Maximum number of unique SRT streams that can be concurrently accessed before a given client IP is automatically blacklisted.

Enable automatic blacklisting of client IPs concurrently accessing more than auto_blacklist_webrtc_max_connections unique WebRTC streams.

Maximum number of unique WebRTC streams that can be concurrently accessed before a given client IP is automatically blacklisted.

Enable rotation of shared secrets for those streams that have auto rotate enabled. The shared secret will be rotated every auto_rotate_shared_secrets_period.

Time duration for automatically rotating shared secrets in minutes. Must be greater than or equal to 30.

IPs/CIDRs carved out of blacklisted CIDRs and ASNs; never out of single-IP rows or auto_blacklist entries. Fleet-managed.

Enable CDN integration for HLS/LLHLS overflow delivery.

Reject HLS and WebRTC video requests from origins not included in the allowed_origins list.

Enable streaming engine host (server) firewall rules management.

HLS IP whitelist.

Name of the HLS media playlist (optional). Default value is "xflow.m3u8".

Enable HLS open access (unsecured).

Number of segments to include in HLS playlist. Minimum allowed value is 3.

Duration of each segment in HLS playlist (in seconds). Minimum allowed value is 1.

Operator blacklist: IPs, CIDRs and ASNs ("AS16509") blocked for video access (ASN_BLACKLIST.md). Fleet-managed.

Timestamp of the last rotation of shared secrets.

Date and time the cluster configuration was last updated.

Load balancer disabled persistence threshold in minutes. Minimum allowed value is 1.

Load balancer evaluation period in minutes. Minimum allowed value is 1.

Load balancer failover persistence threshold in minutes. Minimum allowed value is 1.

Load balancer maximum per evaluation period reassignment count. Maximum per evaluation period stream reassignment count. After reassigning the maximum period reassignment count, XFlow will wait the load balancer evaluation period, then reassess the availability of servers for additional reassignments. Minimum allowed value is 0 (no reassignments).

Load balancer overloaded persistence threshold in minutes. Minimum allowed value is 1.

Load balancer server available threshold percentage. The resource utilization threshold below which the server is considered to be available for stream reassignment. Allowed range is 0 to 90. The available threshold percentage must be at least 5% less than the overloaded threshold percentage.

Load balancer server overloaded threshold percentage. The resource utilization threshold above which the server is considered to be overloaded. Allowed range is 30 to 100. The overloaded threshold percentage must be at least 5 percent greater than the available threshold percentage.

LL-HLS IP whitelist.

Enable LL-HLS open access (unsecured).

Number of segments to include in LLHLS playlist. Minimum allowed value is 7.

Duration of each segment in LLHLS playlist (in seconds). Minimum allowed value is 1.

Recording playback IP whitelist.

Enable recording playback open access (unsecured).

Enable application of the private DNS host overrides (private_hosts) on streaming engines, for source-stream name resolution.

Private hostname→IP overrides applied to source-stream name resolution (single IP each, no CIDR). Applied only when private_dns_enabled is true.

Manager Settings — PTZ preset filter. Applied inside the camera drivers as presets are read from each camera, so a preset that does not pass is never cached, stored or reported anywhere (players, Cameras Status, Camera Configuration preset tours) for any role. Same semantics as the Snaps / XCube stream filters (see data.MatchesConfigFilter). Fleet-managed.

Value to be used with the PTZ preset filter. Required when the filter is not 'none'. A leading '!' inverts the match (matching presets are hidden, all others shown). Case-sensitive.

Default retention. Segments are deleted after this timespan. 0s disables age-based deletion (watermark pruning still applies). e.g. 24h.

Recording (cluster-wide policy). The storage root and per-server enable live in ServerConfigTarget; these uniform policy fields apply to every recording server. Durations are strings with units up to hours (e.g. 1s, 1h, 24h).

Minimum duration of each recording segment file. e.g. 10m.

When true, each recording part is fsync'd to disk as written (bounds the power-loss window to ~one part; costs throughput).

RTMP IP whitelist.

Enable RTMP open access (unsecured).

RTSP IP whitelist.

Enable RTSP open access (unsecured).

Enforce auth token for HLS output.

Enforce auth token for LL-HLS output.

Enforce auth token for recording playback.

Enforce auth token for RTMP/S output.

Enforce auth token for RTSP/S output.

Enforce auth token for WebRTC output.

Shared auth token list.

IP address or hostname of server hosting Snaps service.

Enable integration with Snaps service (for snapshot collection, processing, and publishing).

Snaps service API port number.

Public URL of snapshots host folder (optional). If provided, it will be used by the XFlow web UI (Cameras view).

Snaps service API shared secret.

Filter to apply to stream identifiers in providing / syncing output stream access information.

Value to be used with the stream identifier filter in providing / syncing output stream access information.

Use HTTPS to access Snaps service API.

SRT IP whitelist.

Enable SRT open access (unsecured).

List of video wall controller API integration configurations (e.g., XCube, Datapath).

DNS (URL) to be used by the built-in WebRTC player. Default value is "https://dns.google/resolve".

WebRTC IP whitelist.

Enable WebRTC open access (unsecured).