REST API reference

https://api.vyslo.ai:8443/api/v1/app

Create an app. Self-serve; the new app starts in sandbox.

建立應用。自助註冊；新應用為 sandbox 態。

name

1–64 characters, required

requestedScopes

Scope bitmap; undefined bits are rejected. Ask only for what you use

callbackUris

Callback allowlist, up to 10 entries of ≤512 characters each. Empty means the app cannot be authorized

Returns appId, status, createdAt, appSecret (this response only) and webhookSecret.

返回 appId、status、createdAt、appSecret（僅此一次）與 webhookSecret。

Your own apps. Secrets are omitted — appSecret and webhookSecret come back null here.

你自己的應用列表。不返回密鑰——此處 appSecret 與 webhookSecret 為 null。

Name, status and requested scopes of any app, for rendering a consent screen. Readable by any signed-in account, not just the owner.

任一應用的名稱、狀態與申請權限，用於渲染同意頁。任何已登入帳號皆可讀，不限 owner。

Owner only. {"url":"https://…"} must be an http(s) URL; an empty string clears it. 204 on success.

僅 owner。{"url":"https://…"} 必須是 http(s) 地址；傳空串即清除。成功返回 204。

Owner only. {"callbackUris":[…]} replaces the whole allowlist. 204 on success.

僅 owner。{"callbackUris":[…]} 整表替換。成功返回 204。

The user grants an app and a capability token is issued. {"appId":42,"scopes":17,"callback":"notesbot://vyslo-auth"} → {"token":"…","issuedAt":"…"}.

用戶向應用授權並簽發能力令牌。 {"appId":42,"scopes":17,"callback":"notesbot://vyslo-auth"} → {"token":"…","issuedAt":"…"}。

Scopes that land in the token

requested ∩ what the app registered. An empty intersection is refused — tampering cannot widen it

Sandbox apps

Only the app's own owner can authorize it

Banned apps

Always refused

callback

Must hit the allowlist; checked before any token is issued

Re-issue a token for {"appId":42} while the grant stands. The app-side equivalent is /open/ext/token/renew, which needs no account token.

在授權仍有效時為 {"appId":42} 重新簽發令牌。應用側的等價接口是 /open/ext/token/renew，不需要帳號令牌。

The signed-in user's connected apps: appId, appName, appStatus, scopes, grantedAt. This is what the app's "authorized apps" screen renders.

當前用戶已連接的應用：appId、appName、appStatus、scopes、grantedAt。App 的「已授權的應用」頁就用它。

{"appId":42} revokes the grant and appends the app to this user's revocation list, bumping its version. 204 on success; subsequent app calls are refused immediately.

{"appId":42} 撤銷授權，並把該應用加入此用戶的撤銷單、版本號 +1。成功返回 204；該應用後續調用立即被拒。

{"version":7,"revokedAppIds":[…],"updatedAt":"…"} — the revocation list for this user, which an online client relays to the card. version is monotonic so a card can reject a replayed older list.

{"version":7,"revokedAppIds":[…],"updatedAt":"…"}——該用戶的撤銷單，由任一在線客戶端 轉達給卡片。version 單調遞增，卡片可據此拒絕被回放的舊單。

Trade the current token for a fresh one, no body. Call it roughly weekly; the token itself is the credential.

用當前令牌換一枚新的，無請求體。大約每週調用一次；令牌本身就是憑證。

Needs recordings.read. One recording of the authorizing user, with transcript segments and summary lines.

需 recordings.read。返回授權用戶名下某一條錄音的轉寫分段與摘要要點。

recordingId, title, status, recordedOn, timeLabel, createdAt

Metadata; missing values come back as empty strings, not null

ownerVerified, svVerdict

Cloud voiceprint review. ownerVerified is svVerdict == "owner", not a per-recording proof signed by the card

segments[]

speaker, text, timestamp, in order

summaryLines[]

Summary points; an empty array when there is no summary

404 covers all of: no such recording, not this user's, or visibility is not visible.

404 同時涵蓋：錄音不存在、不屬於該用戶、或 visibility 不是 visible。

Needs recordings.audio, which the user grants separately from reading text. Streams the stored file with Content-Disposition: attachment; the type follows the file (audio/ogg for Opus, audio/wav, audio/mpeg, otherwise audio/mp4). 404 when there is no stored audio.

需 recordings.audio，用戶需在讀取文字之外單獨授權。以 Content-Disposition: attachment 流式返回已存檔案；類型隨檔案而定 （Opus 為 audio/ogg，另有 audio/wav、audio/mpeg， 其餘為 audio/mp4）。沒有已存音頻時返回 404。