🍂 Autumn

🚀 API Gateway

Centralized API proxy for weather, location, telephone, NASA, books, email, iOS automation, and grade tracking — with 4-level role-based access control

Base URL: https://api.novaroma-homelab.uk

Authentication

POST /auth/login

Get a JWT access token. Tokens expire after 1 hour. Include the token in all other requests via Authorization: Bearer <token>.

Request Body:

username required

Your username

password required

Your password

Weather

GET /weather

Current weather for a city. Returns temperature, humidity, wind speed, and conditions.

Query Parameters:

city required

City name (e.g. "London", "New York")

units

metric (default), imperial, or standard

GET /weather/forecast/hourly

Hourly weather forecast for the next 48 hours. Requires coordinates.

Query Parameters:

lat required

Latitude

lon required

Longitude

units

Units of measurement (default: metric)

GET /weather/forecast/daily

Daily weather forecast for up to 16 days. Requires coordinates.

Query Parameters:

lat required

Latitude

lon required

Longitude

cnt

Number of days (1–16, default: 7)

units

Units of measurement (default: metric)

Location

GET /geo/geocode

Convert city names or addresses to geographic coordinates (latitude / longitude).

Query Parameters:

text required

City name or address to geocode

GET /geo/ip

Get geographic location based on IP address. Detects country, region, city, and coordinates.

Query Parameters:

ip

IP address to look up (optional — uses your IP if omitted)

Telephone Directory

GET /telephone/search

Search the Swiss telephone directory (search.ch) for people or businesses. Returns results as XML.

Query Parameters:

was required

Name to search for (person or business)

wo

Location filter (city or canton)

maxnum

Max results (capped at 200)

NASA

GET /nasa/apod

NASA Astronomy Picture of the Day. Returns the image URL, title, and explanation.

Query Parameters:

date

Date in YYYY-MM-DD format (default: today)

hd

Return high-definition image URL (true / false)

GET /nasa/epic/{collection}

Earth satellite images from NASA's EPIC camera. collection is natural or enhanced.

Query Parameters:

date

Date in YYYY-MM-DD format (default: most recent available)

GET /nasa/epic/{collection}/available

List all dates that have EPIC imagery available for the given collection.

Library

GET /library/search

Search Open Library for books, authors, or works.

Query Parameters:

q required

Search query

author

Filter by author name

limit

Max results (default: 10)

GET /library/books

Get book details by ISBN or Open Library ID.

Query Parameters:

bibkeys required

Comma-separated keys (e.g. ISBN:0451526538)

GET /library/covers/{type}/{identifier}

Get a book cover image. type is b (book), a (author), or w (work).

Query Parameters:

size

S, M (default), or L

GET /library/authors/{author_id}

Get author details by Open Library author ID (e.g. OL26320A).

GET /library/subjects/{subject}

Browse books by subject (e.g. science_fiction, history).

Query Parameters:

limit

Max results (default: 20)

GET /library/works/{work_id}

Get work information by Open Library work ID (e.g. OL27516M).

GET /library/archive/*

Internet Archive S3-compatible API proxy. Covers, metadata, and bulk data access.

Email

POST /email/send

Send an email via Resend. Full control over sender and recipients. API key is stored server-side.

Request Body:

to required

Array of recipient addresses (e.g. ["[email protected]"])

subject required

Email subject

html required

Email body in HTML

from_email

Sender (optional, e.g. "App <[email protected]>")

POST /email/send-simple

Simplified email — domain is pre-configured server-side, just provide usernames.

Request Body:

to_users required

Array of usernames (e.g. ["john"][email protected])

subject required

Email subject

html required

Email body in HTML

from_name

Sender display name (optional)

Rate Limits

Every request is rate-limited at two layers: your role limit (requests / hour) and per-API quota (shared across all users). Current limits are returned in X-RateLimit-* response headers.

GET /rate-limits/me

Your current rate limit status: how many calls you have used and how many remain this hour.

GET /rate-limits/apis

Current quota usage for every external API (NASA, OpenWeather, etc.).

GET /rate-limits/all admin+

Full overview: all role limits and all API quotas.

Health Monitoring

Push-based health monitoring for custom software and hardware. Devices call in their own status via heartbeat endpoints, and clients read the aggregated health dashboard. Supports a three-tier control system for flexible device management.

🎯 Three-Tier Control System

1. server_enabled (Hard Block)
Server-side API blocking. When false → 503 response, nothing gets through. Complete shutdown.

2. is_active (Soft Signal)
Device-side signal. Device sees this in heartbeat response and can stop itself. Heartbeats still transmit.

3. health (Self-Report)
Device reports own status: ok, warning, error, or killed. Full client control.

💻 Software Health

GET /software

List all registered software with health status, last heartbeat time, and staleness indicator (stale if no heartbeat in 5 minutes).

GET /software/{name}

Get health status for one software service.

POST /software/{name}/heartbeat

Software pushes its own heartbeat. Must be registered first via /settings/software.

Request Body:

health required

ok, warning, error, or killed

details

Custom JSON data (version, uptime, status, etc.)

🔧 Hardware Health

GET /hardware

List all registered hardware devices with health status, config, and staleness indicator.

GET /hardware/{name}

Get health status and config for one hardware device.

POST /hardware/{name}/heartbeat

Device pushes heartbeat with optional config and details. Must be registered first via /settings/hardware.

Request Body:

health required

ok, warning, error, or killed

config

Device config (IP, firmware, location, etc.)

details

Custom JSON data (CPU temp, uptime, status, etc.)

Grades

Proxy for the sercraft.ch Grade Tracker API. Login first to get an X-Grade-Token, then include it in all subsequent grade requests.

👤 Account

POST /grade/user/auth

Login to the grade tracker. Returns an X-Grade-Token to use in all other grade requests.

Request Body:

user required

Grade tracker username

password required

Grade tracker password

POST /grade/user

Register a new grade tracker account.

Query Parameters:

username required
password required

GET /grade/user

Get current grade tracker user profile.

PATCH /grade/user

Change username or password. Provide new_password or new_username along with current password.

DELETE /grade/user

Delete the grade tracker account.

📚 Subjects

GET /grade/subjects

List all subjects. Pass subject_id to get a single subject.

POST /grade/subjects

Create a new subject.

Query Parameters:

name required
average

Initial average

points

Initial points

num_exams

Number of exams

PUT /grade/subjects

Update a subject's name or average. Requires subject_id.

DELETE /grade/subjects

Delete a subject. Requires subject_id.

GET /grade/subjects/exams

Get all exams for a specific subject. Requires subject_id.

📝 Exams

GET /grade/exam

List all exams. Pass exam_id to get a single exam.

POST /grade/exams

Create a new exam entry.

Query Parameters:

subject_id required
name required
grade required
weight required
details required
date

YYYY-MM-DD (defaults to today)

PUT /grade/exams

Update an exam. Requires exam_id and at least one field to change.

DELETE /grade/exams

Delete an exam. Requires exam_id.

Settings

Live configuration — changes take effect immediately, no server restart needed. Role badges show the minimum role required.

👤 Users

GET /settings/users admin+

List all user accounts.

POST /settings/users admin+

Create a new user.

Request Body:

username required
password required
role

user, admin, superAdmin, or Root (default: user)

POST /settings/users/{id}/enable admin+

Re-enable a disabled user account.

POST /settings/users/{id}/disable admin+

Disable a user account (blocks login). Cannot disable your own account.

PUT /settings/users/{id} superAdmin+

Change a user's role or password.

Request Body (all optional):

role

New role (user, admin, superAdmin, Root)

password

New password

DELETE /settings/users/{id} Root

Permanently delete a user. Cannot delete your own account.

⚙️ APIs

GET /settings/apis admin+

List all API configurations (name, active status, max calls / hour).

GET /settings/apis/{name} admin+

Get config for a single API (e.g. nasa, openweather).

PUT /settings/apis/{name} superAdmin+

Toggle an API on/off or change its hourly call limit.

Request Body (all optional):

is_active

true or false

max_calls_per_hour

New quota limit

🛡️ Roles

GET /settings/roles admin+

List all roles and their hourly request limits.

PUT /settings/roles/{role} Root

Change a role's max calls per hour or active status.

Request Body (all optional):

max_calls_per_hour

New limit

is_active

true or false

💻 Software

GET /settings/software admin+

List all registered software entries with active status.

POST /settings/software admin+

Register a new software entry for health monitoring.

Request Body:

name required

Unique software name (e.g. python-cli-tools)

PUT /settings/software/{name} superAdmin+

Toggle software active status or server-side blocking (three-tier control).

Request Body (all optional):

is_active

Device-side signal (soft block)

server_enabled

Server-side blocking (hard block via 503)

DELETE /settings/software/{name} Root

Permanently delete a software entry.

🔧 Hardware

GET /settings/hardware admin+

List all registered hardware devices with config and active status.

POST /settings/hardware admin+

Register a new hardware device for health monitoring.

Request Body:

name required

Unique device name (e.g. router-hall)

config

Initial device config (JSON object)

PUT /settings/hardware/{name} superAdmin+

Update device config, active status, or server-side blocking (three-tier control).

Request Body (all optional):

config

Device configuration (pushed to device on next heartbeat)

is_active

Device-side signal (soft block)

server_enabled

Server-side blocking (hard block via 503)

DELETE /settings/hardware/{name} Root

Permanently delete a hardware device entry.