API keys and authentication

The interactive API reference covers public facility data and organization API-key integrations. Staff application, device, and provider callback routes are outside this developer reference.

Base URL

https://server2.gp-lights.com

The marketing website is not the API host. Use an organization ID supplied by your administrator. Examples use YOUR_ORG_ID; do not substitute another organization’s ID.

Choose the right credential

Surface	Authentication
Public effective status	No API key
Organization integration endpoints	x-org-api-key header
Staff and member application endpoints	Firebase ID token plus required role
Camera worker endpoints	Registered device ID and device secret
Zapier endpoints	Separate Zapier key workflow

An organization API key does not authorize every /admin URL. In particular, API key management and short-link management require a user session. The previous camera-list example was removed because that route is not implemented.

Create and protect a key

An organization super administrator or platform administrator creates a key in the integration settings. Store the returned secret securely: list responses expose metadata and a prefix, not the original secret. Explicitly choose narrow scopes; omitting scopes currently creates a wildcard key.

Keep keys on your server. Do not put them in browser JavaScript, mobile bundles, screenshots, query strings, or logs. Rotate by provisioning a replacement, updating your integration, verifying access, then revoking the old key.

curl --fail-with-body \
  'https://server2.gp-lights.com/api/v1/YOUR_ORG_ID/notification-options' \
  -H "x-org-api-key: $FACILIPULSE_API_KEY"

The example reads available options and sends no messages. Set FACILIPULSE_API_KEY using your deployment’s secret store.

Scopes

Scope	Use
admin:read	Read organization administrators
admin:write	Invite, update, or remove organization administrators
notifications:read	Notification options and logs
members:read	Member preferences and reports
members:write	Preference updates and roster sync
identity:resolve	Resolve or create an external member identity
auth:launch-link	Create a member or authorized admin launch link
webhooks:read	Webhook registrations and delivery history
webhooks:write	Register, remove, test, or replay webhooks

If supplied, x-org-id must match the route organization on the dedicated partner endpoints. Responses are endpoint-specific: do not assume every route uses an identical envelope.

Errors and retries

A missing or invalid key commonly returns 401; a disallowed scope returns 403. Mixed admin/API-key routes can fall back to session authentication, so exact error wording differs. Inspect the HTTP status and JSON error field.

Retry transient read failures with bounded backoff. Do not automatically retry message sends or assume a universal idempotency header exists. A timeout can happen after a mutation commits. Respect Retry-After when present; no universal partner rate quota is documented.

Continue with Member integration, Webhooks, or the API reference.