Server API
The Server API is a server-to-server REST API for reading a client's tours from your own backend. Where the Web and iOS SDKs authenticate a single end user scoped to one organisation, the Server API authenticates your backend and can read every tour across all of your organisations.
| Web / iOS SDK | Server API | |
|---|---|---|
| Caller | an end user or device | your backend |
| Scope | one organisation | the whole client (all organisations) |
| Auth | a JWT you sign, verified via your JWKS | OAuth2 client credentials, token minted by us |
Base URL
Every endpoint lives under:
https://api.noughtyreality.com/tours/v1
Authentication
The API uses the OAuth2 client credentials grant: you exchange a client_id
and client_secret for a short-lived bearer token, then send that token on every
request. See Authentication.
Endpoints
| Method | Path | Purpose |
|---|---|---|
POST | /auth/server/token | Exchange credentials for an access token |
GET | /server/tours | List every tour for your client |
GET | /server/tours/{id} | Get one tour, with its full floor/room/scan tree |