Web API
HEAT Capture hosts an HTTP server on the workstation. The application’s own interface uses it, and it is the integration surface for scripted control and for simulator-side plugins. It cannot be turned off.
The full contract, including payload fields and error behaviour, is in the interface control document. This page is the operator and integrator summary.
Base address
| Item | Value |
|---|---|
| Scheme | http by default; https when enabled, with a self-signed certificate |
| Host | 0.0.0.0 as shipped in the desktop application, so every interface |
| Port | 5005 as shipped in the desktop application |
Both are configurable and both need a restart. See Configure.
Access control
Only some endpoints check who is calling. Session control, data publishing and the monitoring endpoints below do. Most of the workstation’s other endpoints, used by the application’s own interface, do not: any client that can reach the port can read and change configuration, install packages and restart the application.
Treat network isolation as the security boundary. Bind the server to localhost, or restrict the
port to known hosts with a firewall rule. The installer creates no firewall rule.
| Interface | Access control applied |
|---|---|
POST /api/session/*, GET /api/session/current-session | A user must be signed in |
/ws/publish | A user must be signed in; the handshake is refused otherwise |
/api/storage/capacity, /api/operations/summary | A user must be signed in |
There is no API key and no bearer-token scheme. Sign-in state is a property of the application process, not of the individual request, so any caller shares the state of whoever is signed in at the workstation.
Session control
| Endpoint | Method | Purpose | Auth |
|---|---|---|---|
/api/session/start-session | POST | Start a session | Signed-in user |
/api/session/pause-session | POST | Reject new packets before local storage and delivery | Signed-in user |
/api/session/resume-session | POST | Accept newly arriving packets again | Signed-in user |
/api/session/stop-session | POST | Stop and close the session | Signed-in user |
/api/session/current-session | GET | Current session, or {"active": false} | Signed-in user |
/api/session/reset-session | POST | Force-clear stuck local session state | Signed-in user |
/api/session/launch-sim | POST | Launch the configured simulator | Signed-in user |
/api/session/stop-sim | POST | Stop the launched simulator | Signed-in user |
/api/session/simulation-status | GET | Whether the launched simulator is running | Signed-in user |
GET on the start, pause, resume and stop paths returns 400 with
Invalid request, use post method. Starting returns 409 when a session is already active, and 507
with a capacity snapshot when the capture drive is below its minimum free space.
Publishing data
| Endpoint | Direction | Payload | Auth |
|---|---|---|---|
/ws/publish | Client to application | Binary WebSocket frames, each a protobuf Any | Signed-in user |
This is the interface HEAT Capture Plugins use. Frames larger than 10 MiB close the connection. Text frames are ignored. Malformed payloads are counted and reported once per connection.
Monitoring
| Endpoint | Method | Purpose | Auth |
|---|---|---|---|
/api/storage/capacity | GET | Capture drive snapshot, including canStartCapture | Signed-in user |
/api/operations/summary | GET | Storage, delivery, module, socket and process state in one document | Signed-in user |
Check /api/storage/capacity before starting a session on a workstation you do not control
directly; canStartCapture reflects the free-space minimum described in
Configure.