SpaceAPI document and open/closed state for Pixelbar.
The /api/v1 endpoints are the supported API. The legacy endpoints
(/, /index.php, /spacestate.php, /togglestate.php, /togglebaker.php)
are a temporary compatibility shim for hardware and consumers that have not
migrated; do not build new integrations on them.
Authentication
Reading is open to everyone: the current state, the SpaceAPI document and
the health check need no credentials. Two kinds of credential exist for
everything else, and both are issued by the Pixelbar board — ask them if
you need one.
API key
A bearer token, used for reading history and for changing the state. Keys
carry a role: read covers history, write covers history and state
changes.
POST /api/v1/state HTTP/1.1
Host: spacestate.pixelbar.nl
Authorization: Bearer <your-api-key>
Content-Type: application/json
{
"state": "open",
"user": "your-name",
"method": "api"
}
A missing, unknown or under-privileged key gets
401 {"error":"unauthorized"}.
Legacy device token
The deprecated toggle endpoints take a per-device token in the query
string instead, and accept it only from that device's registered IP
address. These exist for hardware that predates the API key scheme; build
new integrations against POST /api/v1/state.
https://spacestate.pixelbar.nl/togglestate.php
?token=<your-device-token>
&user=your-name
&state=open
A bad token, or a good token from an unexpected address, redirects to
https://www.pixelbar.nl/ rather than returning an error status.