RTC HTTP API: rooms, admission, media, and controls

This page describes public calling conventions; use the contract bundled with the target version for exact fields. A business backend manages rooms and issues one-use tickets with an authorized Authorization: Bearer ak_pat_... token. A meeting SDK consumes the ticket and uses a device-bound X-AK-RTC-Token on /api/v2/rtc/session/.... Browsers and apps must not hold the platform management token. Post-meeting archives use a separate archive ticket.

sequenceDiagram
    participant Backend as Business backend
    participant API as AKStream.Next
    participant SDK as Meeting SDK
    Backend->>API: POST /rtc/rooms (ak_pat_)
    Backend->>API: POST /rooms/{roomId}/access-tickets
    Backend-->>SDK: roomId + one-use accessTicket
    SDK->>API: POST /session/rooms/{roomId}/join
    API-->>SDK: participantToken + deviceSessionId + capabilities
    SDK->>API: X-AK-RTC-Token + independent publication/subscription

Backend: rooms and one-use identity

Room fields: roomType supports meeting/chatroom/screen/whiteboard; accessMode is Open/InviteOnly; optional passcode is stored as a hash. scheduledStartAtUtc plus durationMinutes schedules a meeting; earlyJoinMinutes/maxExtensionMinutes/reminderMinutes define time limits. maxPublishers/maxScreenShares limit this room, while license quota is still enforced separately. mediaServerId/app select the media destination and namespace, not client-controlled free text after creation.

Ticket fields: subjectIssuer + subjectId are stable business identity; the backend confirms displayName; requested capabilities are an upper bound intersected with role and room policy. Only a permitted backend can grant bypassWaitingRoom. Never put accessTicket in a shareable URL or plaintext log.

Meeting SDK: device session and renewal

platform identifies an actual client such as pc-web/h5/android/ios/wechat-mini-program. A device session ID belongs to one join and is not a hardware serial number. Requested capabilities and initial mic/camera flags are not grants; all later HTTP/WS work uses the server's effective identity.

Independent publications and subscriptions

Here ... means /api/v2/rtc/session/rooms/{roomId}. SDKs handle SDP, ICE, recovery, and release; application UI should call SDK methods rather than reimplement WHIP/WHEP. HTTP 200 only proves control-plane negotiation; verify real frames and audio on a second device.

Host governance, external sources, collaboration

A trusted backend first creates/revokes source grants with GET/POST /api/v2/rtc/rooms/{roomId}/external-sources/grants and DELETE .../grants/{grantId} for an existing channelId. GrantRtcExternalSourceRequest can set allowRecording/allowHistoricalArchive; the meeting SDK selects only an authorized grantId. Candidate snapshots do not reveal RTSP source URLs. Verify device and codec combinations in the target environment.

Errors and next step

See references/openapi.json in the matching Skill for all public HTTP methods, paths and models. Component interfaces are outside third-party integration; newer documentation does not establish support in an older deployment.