First API call

Call three interfaces from your server: administrator token, paged device detail, then a live-address API. Do not embed AppSecret or accessToken in a browser or app package.

Prepare AppId, AppSecret, and DataCenter

Copy AppId and AppSecret from Create an app.
Read the data-center id in Console · My information.
Host: https://openapi-[DataCenter].easy4ip.com. Replace [DataCenter] with that id.

Build the request body and signature

Every call uses the same JSON request body: id, system, and params. system fields are in Development specification:

Field	Rule from the specification
`system.ver`	Currently `1.0`
`system.appId`	Your `AppId`
`system.time`	UTC unix time in seconds; skew must stay within 5 minutes
`system.nonce`	32-bit random value; reuse within 5 minutes returns `SN1005`
`system.sign`	See the next paragraph
`id`	Unique non-empty string per request

Signing source string (UTF-8, this order): time:{time},nonce:{nonce},appSecret:{appSecret}. Key: lowercase hex of SHA-256(appSecret). Then sign = Base64(HMAC-SHA256(source, key)). Full steps and samples: Development specification section 4. Compute sign per request; do not copy a sample value.

Call accessToken

POST https://openapi-[DataCenter].easy4ip.com/openapi/accessToken

params may be an empty map. Method page: accessToken.

The administrator accessToken is valid for 3 days. Refresh when it is about to expire or the API returns TK1002. Each token has its own 3-day life; do not mint a new one on every request.

Keep the token on the server. It is not a player credential.

Call device.detail.page

POST https://openapi-[DataCenter].easy4ip.com/openapi/v2/device.detail.page

Put the administrator token in params.token. Set page ≥ 1 and pageSize between 1 and 50. Method page: Paged device detail.

Confirm the bound camera is in result.data. Sub-account calls also need openid. This method is not in device.capability.list.

Create or read a live address

Pick the player you actually use. The module index is Device live.

HLS: bindDeviceLive. streamId 0 is HD, 1 is SD. Treat the URL as a secret.
RTMP: createDeviceRtmpLive.
ImouPlayer: mint kitToken on the server (type 1 for live). See Light-app first preview.

Addresses expire. Query and delete stay on the same live module.

Verify result.code and collect request evidence

Success is result.code "0". Other codes: Return codes. Daily call limits: Interface call limits.

When a call fails, keep id, system.time, system.nonce, the method URL, and result.code / result.msg. Do not log appSecret or a live URL in a public ticket.