Reference · built on requestConnectorAccess control & video

Milestone XProtect

Cameras, events, alarms, and device state from Milestone XProtect through its API Gateway, with bookmark and alarm actions.

Request accessPricing ↗

About

XProtect is Milestone Systems' video management software, installed on the customer's recording and management servers. Every XProtect site includes at least one API Gateway, the common entry point to the RESTful Config, Events, and Alarms APIs and to the Events and State WebSocket API. Older SOAP interfaces remain for recorder commands and alarm commands.

Through Fibric, an operator subscribes to camera and device events, reads the alarm list, and proposes a bookmark, a triggered event, or an alarm state change. You review it first. The gateway call then goes out a single time, with a receipt describing the change and its reversal.

This is a reference listing. It documents what Fibric would read from Milestone XProtect and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Sites, cameras, hardware, recording servers, roles, rules, and event types through the RESTful Config API under /api/rest/v1
  • Live events and device state through the Events and State WebSocket API at /api/ws/events/v1, with addSubscription filters and getState
  • Stored events from cameras and analytics applications through the RESTful Events API
  • Alarms with their metadata through the RESTful Alarms API, by id or as a full list
  • Status of items such as cameras through the Status API
  • Bookmarks on recorded video through the Config API bookmarks resource

Proposed actions

  • Target capability: propose a bookmark on a camera's recording around the time of an incident
  • Target capability: propose triggering a user-defined event through the RESTful Events API so XProtect rules can act on it
  • Target capability: propose triggering an alarm, or updating an existing alarm's state, through the RESTful Alarms API
  • Target capability: propose a camera or rule configuration change through the RESTful Config API for your approval

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Keep every camera recording

    Device state changes from the WebSocket API and camera status from the Status API feed one health list. The operator proposes a ticket for each camera offline past your threshold.

    With Camera Health

  • Bookmark the footage behind an access alarm

    A door alarm from your access control system is matched to the nearest camera. The operator proposes a bookmark and a triggered event so the clip is easy to find later.

    With Door Held Open, Incident Draft

  • Triage alarms by site and rule

    Alarms from the RESTful Alarms API are grouped by source and rule. The operator proposes state changes for duplicates and drafts the note for those that need a person.

    With Alarm Triage

  • Preserve evidence for a claim or audit

    For a reported incident, the operator lists the cameras and time window, proposes bookmarks, and records the references in the compliance packet.

    With Compliance Evidence

Requirements

  • An XProtect VMS installation, 2022 R1 or later, with an API Gateway reachable over HTTPS
  • A Basic user or Windows user whose role grants access to the cameras and devices involved
  • XProtect 2023 R2 or later for the RESTful Alarms API, and 2023 R3 or later for the Events and State WebSocket API
  • An XProtect VMS license file, or a free 30-day trial license, for any test system
Authentication
A bearer token from the XProtect Identity Provider at /API/IDP/connect/token, obtained with the password grant as a Basic user and sent to the API Gateway on each request.

Limits

  • A WebSocket session persists for 30 seconds of inactivity by default; a client must resume with the session id or start over
  • A WebSocket client must authenticate within 5 seconds of connecting, by bearer header or the authenticate command
  • Recorder Command, Image Server, and Alarm Command are SOAP or TCP/XML interfaces marked legacy; outputs and PTZ still route through them
  • The Config API requires management authorization; read access alone does not permit configuration changes

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Milestone XProtect ↗

Questions and answers

Does XProtect push events to an integration?
Yes, over WebSocket. Connect to wss://{api-gateway}/api/ws/events/v1, send startSession, then addSubscription with resource types, source ids, and event types. Events arrive in CloudEvents format. getState returns current state for stateful events. This API needs XProtect 2023 R3 or later.
How does authentication work?
The API Gateway accepts a bearer token from the XProtect Identity Provider. The quickstart posts to /API/IDP/connect/token with grant_type password and client_id GrantValidatorClient, using a Basic user created in the Management Client. The token then goes in the Authorization header on gateway calls.
Is the API Gateway optional?
No. Milestone states the API Gateway is no longer optional and at least one must be present in an XProtect VMS site. It fronts the RESTful Config, Events, and Alarms APIs and the Events and State WebSocket API; the SOAP services remain, marked legacy.
Ask about Milestone XProtect

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Milestone XProtect through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy