Q-SYS API Inbound

The natural pair to API Outbound. Where API Outbound triggers HTTP requests from Q-SYS, API Inbound listens for HTTP requests into Q-SYS and maps payload fields onto control pins. Drop the plugin into a design, point any external system at http://<core-ip>:<port>/<path>, and the request becomes a structured Q-SYS event.

Core Functionality

• Embedded HTTP/1.1 server, one listen-port per plugin instance
• GET, POST, PUT, PATCH, and DELETE method support
• Configurable listen path with {placeholders} for path-style REST APIs (e.g. /devices/{id}/state)
• RequestReceived trigger pin fires on every accepted request
• Per-request connection cap to prevent runaway clients

Path Parameters

• {name} placeholders embedded in the Listen Path property
• Auto-detected as the path property changes; matching PathParam pins are exposed under the Path Params group
• Values are URL-decoded before being written to pins
• A request whose URL does not match the path pattern returns 404 with no pin updates

Body Bindings

• Up to 8 JSON body bindings configured at design time
• Dot-and-bracket path syntax (result.message, devices[0].state, meta.user.id)
• 0-based array indexing
• Per-binding BodyFound LED outputs confirm path resolution
• Strings, numbers, booleans, objects, and arrays are stringified for output pins

Query Bindings

• Up to 8 query-string parameter bindings configured at design time
• Maps ?key=value pairs onto QueryValue pins
• Per-binding QueryFound LED outputs

Response Generation

• Configurable response status code (default 200)
• Configurable response Content-Type (default application/json)
• Response body template with {placeholder} substitution for path params, query params, and core variables
• Custom error responses for 401 (auth failure), 404 (path mismatch), 413 (payload too large), 429 (rate limited), 500 (handler error)

Authentication

• None
• Bearer Token (Authorization: Bearer <value>)
• X-API-Key header
• Custom header name/value pair
• HTTP Basic (Authorization: Basic <base64(user:pass)>)
• Per-request authentication enforced before any pin updates; failed requests get HTTP 401 with WWW-Authenticate

Live Monitoring

• LastRequestUrl, LastRequestMethod, LastRequestBody
• LastResponseCode, LastError
• Rolling request log (last 20 requests) shown on the Monitoring card
• RequestCount, SuccessCount, ErrorCount running counters
• ServerListening LED

User Interface

• Tabbed faceplate: API Inbound, Instructions, Device Setup, About
• Endpoint card highlights method chips, listen URL (auto-built from Core IP + port + path), and the running RequestReceived counter
• Path Params, Body Bindings, and Query Bindings cards switch to a 2-column layout when more than 4 slots are configured
• Monitoring panel renders the last request URL/body and a rolling request log
• Instructions tab covers the listen-URL workflow, path placeholders, JSON path syntax, authentication, and response templating, with side-by-side reference cards
• About tab carries the standard AchKayEm Solutions licensing flow and disclaimer

Licensing and Trial

• 30-minute fully functional trial period
• Unlimited or per-Core activation via license key from the AchKayEm Solutions vault
• License key cryptographically bound to Q-SYS Core ID(s) at activation, verified entirely offline