# XtremePlayer API v1

Base URL: `/api/v1`

License checks call License-Web. Invalid / missing licenses return `403`.

## App endpoints (no token)

| Method | Path | Description |
|--------|------|-------------|
| GET | `/app/bootstrap` | App settings, flags, ads, DNS, notifications, posters, select pages |
| POST | `/reports` | Body: `user_name`, `user_pass`, `report_title`, `report_msg` |
| GET | `/ads/interstitial` | Active custom ads |
| GET | `/posters` | Active posters |
| GET | `/devices/{deviceId}` | Device credentials |
| GET | `/activations/{code}` | Activation credentials |
| GET | `/trials` | Query: `username`, `password`, `dns` — trial status via Xtream |
| POST | `/trials` | Body: optional `username`, `dns` — create trial line |

## Web / provision endpoints (require API token)

Send token as `Authorization: Bearer {token}`, `X-Api-Token: {token}`, or `token` query/body.

| Method | Path | Description |
|--------|------|-------------|
| GET | `/web/bootstrap` | Web settings + DNS + notifications |
| GET | `/web/dns` | Active DNS lists |
| GET | `/web/notifications` | Notifications |
| GET | `/web/devices/{deviceId}` | Device lookup |
| GET | `/web/activations/{code}` | Activation lookup |
| POST | `/provision/devices` | Body: `username`, `password`, `dns`, `device_id`, optional `user_type` |
| POST | `/provision/activations` | Body: `username`, `password`, `dns`, optional `user_type`, `activation_code` |

## Response shape

```json
{ "success": true, "data": {} }
```

Errors:

```json
{ "success": false, "message": "..." }
```

Create API tokens in Admin → API Tokens.