Skip to main content

Connection requirements

Endpoint​

Send GraphQL queries and mutations as HTTPS POST requests to:

https://core-api.app.xysense.io/api/external/query

Headers​

Example headers for a GraphQL query request:

Accept: application/json
Content-Type: application/json
Accept-Encoding: br, gzip
Authorization: Bearer <token>

All request/response bodies are to be JSON encoded.

Accept: application/json
Content-Type: application/json

All API requests must include an authorization header. Use the bearer token returned by the authentication flow.

Authorization: Bearer <token>

If your application supports it, it is strongly suggested that you enable either Brotli or GZip compression to minimise the response size. This is especially useful when polling for occupancy changes, as the result set can grow quite large during active periods of the day.

Accept-Encoding: br, gzip

TLS policy​

The API accepts TLS 1.2 or TLS 1.3 connections using the following cipher suites:

  • TLS-AES-128-GCM-SHA256
  • TLS-AES-256-GCM-SHA384
  • TLS-CHACHA20-POLY1305-SHA256
  • ECDHE-ECDSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES128-GCM-SHA256
  • ECDHE-ECDSA-AES128-SHA256
  • ECDHE-RSA-AES128-SHA256
  • ECDHE-ECDSA-AES256-GCM-SHA384
  • ECDHE-RSA-AES256-GCM-SHA384
  • ECDHE-ECDSA-AES256-SHA384
  • ECDHE-RSA-AES256-SHA384

After connecting, handle HTTP failures separately from errors returned in a successful GraphQL response. See Errors.