API Reference

This reference covers the HTTP API used by Kernel’s own clients (web, Roku, Android, iOS, Apple TV): signing in, browsing libraries, and playing back VOD and Live TV. Admin and setup-wizard endpoints aren’t included here.

Base URL

http://<your-server>:9014

There’s no separate API host. The same server that serves the web app serves the API.

Authentication

Call POST /login with your username and password to get a token:

curl -X POST http://<your-server>:9014/login \
  -H "Content-Type: application/json" \
  -d '{"username": "you", "password": "your-password"}'

{"auth": {"token": "<jwt>", "device_id": "<id>"}}

Send the token back on every subsequent request:

Authorization: Bearer <jwt>

Login tokens don’t expire. Treat them like a long-lived credential; don’t log them or embed them in client-side code you don’t control.

Device headers

Send these on login and on playback requests so Kernel can pick the right format and bitrate for your client:

Header	Purpose
`Device-Id`	Stable identifier for this install. If omitted, Kernel derives one from your User-Agent.
`Device-OS`	e.g. `Roku OS`, `android ...`. Drives the HLS vs. DASH decision for Live TV.
`Device-Max-Height`	Caps the resolution Kernel will serve.
`Device-Codecs`	Video codecs your client can decode (e.g. hevc/av1 support).
`Device-HDR`	`1`/`true` if your client supports HDR.
`Device-Audio-Codecs`	Comma-separated audio codecs your client decodes (e.g. `aac,ac3`).
`Device-Audio-Channels`	Max audio channels your client supports.
`Device-Containers`	Containers your client can play directly.

Errors

Errors are always a JSON object with a single error field:

{"error": "User Account Inactive"}

Overview

Endpoints

Base URL

Authentication

Device headers

Errors

Next steps

Playback Guide

Auth & Account

Libraries & Items

Live TV & EPG

​Base URL

​Authentication

​Device headers

​Errors

​Next steps

Playback Guide

Auth & Account

Libraries & Items

Live TV & EPG

Base URL

Authentication

Device headers

Errors

Next steps