From zero to a transcript

BASE=https://api.vyslo.ai:8443/api/v1/app

# 1. Ask for the SMS code
curl -s -X POST "$BASE/auth/sms/send" \
  -H 'Content-Type: application/json' \
  -d '{"phone":"13800138000"}'

# 2. Exchange phone + code for an access token
curl -s -X POST "$BASE/auth/login" \
  -H 'Content-Type: application/json' \
  -d '{"phone":"13800138000","code":"123456"}'
# {"accessToken":"eyJ…","userId":"7f3c…","phone":"13800138000", …}

TOKEN=eyJ…

curl -s -X POST "$BASE/open/apps" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
        "name": "Meeting Notes Bot",
        "requestedScopes": 17,
        "callbackUris": ["notesbot://vyslo-auth"]
      }'

{
  "appId": 42,
  "name": "Meeting Notes Bot",
  "status": "sandbox",
  "requestedScopes": 17,
  "callbackUris": ["notesbot://vyslo-auth"],
  "createdAt": "2026-10-30T06:12:44Z",
  "appSecret": "G7m…",        // returned once, never again
  "webhookSecret": "qT4…"     // sign/verify webhook bodies with this
}

# 204 No Content on success. Send {"url":""} to clear it.
curl -s -X POST "$BASE/open/apps/42/webhook" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://notesbot.example.com/hooks/vyslo"}'

# The callback allowlist is replaced wholesale, up to 10 entries:
curl -s -X POST "$BASE/open/apps/42/callbacks" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"callbackUris":["notesbot://vyslo-auth","https://notesbot.example.com/auth/return"]}'

curl -s -X POST "$BASE/open/authorize" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"appId":42,"scopes":17,"callback":"notesbot://vyslo-auth"}'
# {"token":"<capability token>","issuedAt":"2026-10-30T06:20:01Z"}

CAP=<capability token>

curl -s "$BASE/open/ext/recordings/rec_01J9…" \
  -H "X-Vyslo-Token: $CAP"

{
  "recordingId": "rec_01J9…",
  "title": "Thursday standup",
  "status": "ready",
  "recordedOn": "2026-10-29",
  "timeLabel": "09:14",
  "createdAt": "2026-10-29T09:41:08Z",
  "ownerVerified": true,
  "svVerdict": "owner",
  "segments": [
    {"speaker": "S1", "text": "Let's start with the firmware side.", "timestamp": "00:02"},
    {"speaker": "S2", "text": "Board 5 is back from power tuning.",  "timestamp": "00:07"}
  ],
  "summaryLines": [
    "Firmware: board 5 power tuning finished, waiting on a re-measure.",
    "Owner committed to sending the updated budget on Friday."
  ]
}

# Needs recordings.audio (bit 16) in the grant; streams the stored file.
curl -s "$BASE/open/ext/recordings/rec_01J9…/audio" \
  -H "X-Vyslo-Token: $CAP" -o recording.opus

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.VYSLO_WEBHOOK_SECRET;

// Raw body — a re-serialized JSON object will not hash to the same value.
app.post('/hooks/vyslo', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto.createHmac('sha256', SECRET).update(req.body).digest('hex');
  const got = Buffer.from(req.get('X-Vyslo-Signature') || '', 'utf8');
  const want = Buffer.from(expected, 'utf8');

  if (got.length !== want.length || !crypto.timingSafeEqual(got, want)) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(req.body.toString('utf8'));
  res.sendStatus(204);               // ack fast, then work
  queue.add(event.recordingId);      // idempotent: retries repeat recordingId
});

curl -s -X POST "$BASE/open/ext/token/renew" \
  -H "X-Vyslo-Token: $CAP"
# {"token":"<fresh token>","issuedAt":"2026-10-30T06:31:12Z"}

val vyslo = VysloOpen(context, appId = 42L)

// Authorize: the VYSLO app shows the consent screen, then deep-links back.
startActivity(vyslo.authorizeIntent(
    scopes = VysloOpen.SCOPE_RECORDINGS_READ,
    callbackUri = "notesbot://vyslo-auth",
))

// In the activity that handles notesbot://vyslo-auth
vyslo.handleAuthorizationCallback(intent.data)   // true = token stored

// On a worker thread, after your server saw recording.ready
val rec = vyslo.fetchRecording(recordingId)
rec.ownerVerified      // cloud voiceprint review says this is the card's owner
rec.segments           // speaker / text / timestamp
rec.summaryLines

let vyslo = VysloOpen(appId: 42)

// Authorize: the VYSLO app shows the consent screen, then opens your callback URL.
UIApplication.shared.open(vyslo.authorizeURL(
    scopes: [.recordingsRead],
    callbackURI: "notesbot://vyslo-auth"
))

// In .onOpenURL (SwiftUI) or scene(_:openURLContexts:) (UIKit)
vyslo.handleAuthorizationCallback(url)   // true = token stored

// After your server saw recording.ready
let rec = try await vyslo.fetchRecording(recordingID)
rec.identity           // who is speaking, with the source of the verdict
rec.segments           // speaker / text / timestamp / identity
rec.summaryLines