---
name: reolink-cloud-endpoints
description: Reolink desktop app cloud endpoints — what each is used for, who calls them, and which require account auth (relevant when implementing src/cloud/).
metadata:
  type: project
---

Reolink desktop app v8.17.8 (Electron, libBCSDKWrapper.dylib backend) uses two distinct cloud APIs against `apis.reolink.com`. Sourced from JS bundle `~node_modules_sharp_vendor_Sync_recursive_versions_json_~private_main_index_ts.js` (main process) and `libBCSDKWrapper.dylib` strings.

**Auth model**: OAuth2. Access token obtained via `POST https://apis.reolink.com/v1.0/oauth2/token/` (form-urlencoded; `client_id=process.env.VUE_APP_CLIENT_ID`, `grant_type` ∈ {`refresh_token`,`rotp`,…}). Stored as `settingsManager.accessToken`. Attached to subsequent calls as `Authorization: Bearer <token>`.

## v1.0 endpoints (Bearer auth required)
- `GET /v1.0/devices/` — list of devices the account owns.
- `DELETE /v1.0/devices/<UID>/` (or `/devices/shares/<UID>/`) — unbind a device.
- `POST /v1.0/oauth2/authorization/` — grant a device-code (RSA-pad UID to 24 chars with `0`s; body `{responseType:"device_code", clientId:<padded UID>, options:{…}}`).
- `POST /v1.0/oauth2/token/` — login/refresh.
- `GET /v1.0/users/@me/profile/` — user profile.

## v2 endpoints
- `GET /v2/devices/<UID>/server-binding?language=<lang>` — **NO AUTH HEADER**. Returns `{ availableZones: [ { id, name, locations, status, services: { p2p:{server}, cloud:{server}, roms_ota:{server}, alarm_push:{server} } }, … ] }`. Used by `GdprManager.getDeviceServerBinding`. The same default zone JSON is embedded as a fallback string in `libBCSDKWrapper.dylib` (8 zones: ids 1,2,3,6,7,8,9 + extras). Function: zone-allocation hint per UID — returns the SET of relays/clouds applicable, NOT a single "use this relay" answer.
- `GET /v2/devices/access-authorization/<UID>` — **Bearer auth required**. Format string `%s/v2/devices/access-authorization/` lives in libBCSDKWrapper.dylib next to `Bearer %s` and `Authorization`. Invoked from the C++ SDK after `BCSDK_SetAccountCenter(base_url, access_token, ca_path)`. Returns a JSON payload with `certChain`, `LoginUser{authType,authLogin,authSignature,authToken,authUser,scopes,privileges}`, `LoginNet{udpPort,…}`, and RSA crypto material (`pubKey`, `pubKeyAlgo`, `cipherKeySeed`, `tokenKey`, `cipherContent`). This is the **delegated-login** endpoint: it returns credentials the app can use to sign in to the camera as the Reolink-account owner WITHOUT typing the camera password. NOT a relay-hint endpoint.

## Implications for `src/cloud/`
- **Relay-hint without account**: feasible via `server-binding` (no auth). But the response is the global zone list, not a single relay. You still need to pick the right zone — likely by examining `availableZones[*].status` (one entry has `"status":"active"` or `"default"`; e.g., zone 1 has `status:"default"`) OR by intersecting with where the user's UID is geographically registered. Without testing, assume the response is filtered per-UID server-side and pick `availableZones[0]` or the entry with `status:"active"` for that UID's region.
- **Delegated camera login** (`access-authorization`): requires a logged-in Reolink account whose access_token has the UID associated with it (via the user adding the device to the account). NOT feasible without user-supplied account credentials.
