The Xeqmate external API lets your own system read platform data — cameras, recording clips, plate reads and face reads — and create, edit and deactivate users without opening the interface. REST, HTTPS only, one token per account, a published rate limit and every call written to the audit trail.
It is a REST API that gives each account programmatic access to its own data on the platform: cameras, recordings, plate and face reads, and user management. A platform administrator switches the API on inside the account record and generates a unique token per account (prefix xqm_) that goes in the header of every request. HTTPS only, capped at 50 requests per minute, with every call audited.
https://app.xeqmate.com/api/v1/integrations, with Authorization: Bearer <token> on every request.X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; over the limit, the API answers 429 with Retry-After.page and limit, defaulting to and capped at 100 items per page.Z.Cameras, recordings, reads and users — the scope is exactly what the account administrator sees in the platform.
| Method | Route | What it does |
|---|---|---|
| GET | /camera | Lists the cameras visible to the account, filtered by name and type (video, LPR, facial). |
| GET | /camera/{id} | A single camera by id, with status, recording, analytics and location. |
| GET | /camera/{id}/record | Recording clips for the period (up to 31 days per query), with signed MP4 and thumbnail URLs valid for 30 days. |
| GET | /camera/{id}/plate | Plate reads for the period (up to 7 days per query), with vehicle data and images. |
| GET | /camera/{id}/face | Face reads for the period (up to 7 days per query), with attributes and images for each face. |
| GET | /user | Lists the account users, filtered by name, email and status. |
| GET | /user/{id} | A single user by id. |
| GET | /user/role | Roles the account can assign to users. |
| POST | /user | Creates a user — the platform generates the temporary password and emails it. |
| PUT | /user/{id} | Edits a user; only the fields sent in the body change. |
| DELETE | /user/{id} | Deactivates the user (soft delete) and ends their sessions. |
Without inicio and fim, recording and read queries fall back to the last 24 hours. Read endpoints do not return a total — page until meta.has_more comes back false.
List the account’s LPR cameras:
curl -H "Authorization: Bearer xqm_..." \
"https://app.xeqmate.com/api/v1/integrations/camera?tipo=alpr&limit=2"Response:
{
"success": true,
"data": [
{
"id": 163,
"codigo": "XEQ4MLIQICX591",
"nome": "I-35 - Northbound exit",
"tipo": "Fixa",
"status": "Online",
"ultima_conexao": "2026-08-18T23:33:19Z",
"gravacao": { "habilitada": true, "retencao_dias": 4 },
"analiticos": { "placa": true, "facial": false },
"localizacao": {
"latitude": -27.108206,
"longitude": -52.55431,
"cidade": "Austin - TX"
}
}
],
"meta": { "page": 1, "limit": 2, "total": 282 }
}Errors always use the same shape, on any 4xx/5xx status:
{ "success": false, "message": "Invalid API token.", "error": 401 }| Code | When it happens |
|---|---|
| 400 | A body or URL field is off contract — the message comes back as a field → reason map. |
| 401 | Missing authentication header, or a token that is invalid, revoked or regenerated. |
| 402 | Account blocked for non-payment. |
| 403 | Account inactive, or the external API switched off in the account settings. |
| 404 | Camera or user outside the account scope; camera without recording, LPR or facial. |
| 409 | Email or tax ID already registered; user already inactive. |
| 422 | Period over the limit (7 days for reads, 31 for recordings), start after end, or an unknown filter value. |
| 429 | More than 50 requests in a minute — wait the seconds given in Retry-After. |
| 502 | The camera media server did not answer; try again shortly. |
The API is your system calling Xeqmate. For the other direction — the platform calling your system when a plate or face alert fires — the tool is the webhook: a POST with a fixed JSON shape, a Bearer token and an HMAC signature. Together they cover a full integration, from the real-time event to the historical query. See how it works on the integrations page.
The API is not open to the public: a platform administrator enables the external API inside each account record and generates the token there. Every time the token is shown, regenerated or revoked, that is audited too. This per-account model is the same one used by integrators reselling the platform: every end customer can have their own isolated access, pulling for example the cloud recordings of their own cameras. For the platform overview, see VMS SaaS.
No. Access is enabled per account: a platform administrator switches the external API on in the account record and generates a unique token (prefix xqm_). Calls only work with the switch on and the token in the header — turning the switch off blocks the token immediately.
50 requests per minute per token. Every response returns the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers; over the limit, the API answers 429 with the wait time in Retry-After.
Yes. GET /camera/{id}/record returns the recording clips for the period queried (up to 31 days per query) with pre-signed MP4 and thumbnail URLs valid for 30 days — your system downloads the video directly, with no platform session.
Yes: create (POST /user, with a temporary password emailed to the user and a mandatory change at first login), edit (PUT /user/{id}) and deactivate (DELETE /user/{id}, which ends open sessions). Available roles come from GET /user/role.
Yes, all of them — including reads and rejected calls (401, 403, 429). Each one shows up in the platform audit trail under the account, with the token prefix in the detail. Generating, regenerating, revoking and even displaying the token are audited events too.
The API is pull-based: your system asks, the platform answers. To receive plate and face alerts in real time, the tool is the webhook — the platform sends a signed POST to your system URL on every alert. See the integrations page.
30 minutes with our team: we connect one of your cameras live and show the camera, recording and read queries running against your own scenario.
We reply within one business day · no credit card, no install, no commitment