# Rhombus

> Rhombus is an enterprise physical-security platform: AI-powered security cameras, door access control, environmental and IoT sensors, and professional alarm monitoring, all managed from a single cloud console. Developers and AI agents can automate the entire platform through a public REST API (~900 endpoints), an official CLI, SDKs, and a Model Context Protocol (MCP) server.

## What Rhombus is

Rhombus provides cloud-managed physical security for businesses, schools, healthcare, logistics, retail, and government. There are no NVRs or DVRs: cameras and sensors connect directly to the Rhombus cloud, and everything is managed from a single [web console](https://console.rhombus.com/) and mobile apps.

Product lines:

- [Security cameras](https://www.rhombus.com/cameras/): dome, bullet, fisheye, and multisensor cameras with onboard AI for motion, people, vehicle, and license-plate detection. Footage is stored on-device and in the cloud.
- [Access control](https://www.rhombus.com/access-control/): door controllers, readers, video intercoms, and badge/credential management unified with video.
- [Sensors](https://www.rhombus.com/sensors/): environmental (temperature, humidity, air quality), motion, entry, audio, and panic-button sensors.
- [Alarm monitoring](https://www.rhombus.com/alarm-monitoring/): TMA Five Diamond certified live agents verify alerts via camera feeds and dispatch emergency services.
- [AI analytics](https://www.rhombus.com/ai-analytics/): natural-language video search, face and license-plate recognition, occupancy counting, and automated alerting.
- [Integrations](https://www.rhombus.com/integrations/): identity providers (Okta, Azure AD, Google Workspace SAML SSO and SCIM), access-control platforms, sensors, and ITSM/communication tools.

Licensing and pricing: see [pricing](https://www.rhombus.com/pricing/) and the [machine-readable pricing summary](https://www.rhombus.com/pricing.md) — per-device licenses (Core, Plus, Pro, Enterprise tiers) that include cloud storage, AI features, and support.

## Developer platform

Reference and guides: [developer documentation](https://api-docs.rhombus.community/) (machine-readable page index: [api-docs llms.txt](https://api-docs.rhombus.community/llms.txt)).

- **Base URL**: `https://api2.rhombussystems.com/api`
- **OpenAPI 3.0 specification**: [public.json](https://api2.rhombussystems.com/api/openapi/public.json) (also reachable as [www.rhombus.com/openapi.json](https://www.rhombus.com/openapi.json))
- **Conventions**: all endpoints are HTTP `POST` with JSON bodies; responses are JSON; conventional status codes (401/403 auth, 429 rate limit).
- **Service areas**: cameras and video streams, access control (doors, badges, credentials), sensors and climate, alerts and events, AI/scene search, locations, users and roles, audit logs, licenses, organizations, webhooks, and more (~60 service groups, ~900 operations).
- **Rate limits**: [rate limits guide](https://api-docs.rhombus.community/rate-limits)

### Authentication

Full agent-oriented guide: [auth.md](https://www.rhombus.com/auth.md). Machine-readable discovery: [OAuth protected-resource metadata (RFC 9728)](https://api2.rhombussystems.com/.well-known/oauth-protected-resource) and [authorization-server metadata (RFC 8414)](https://auth.rhombussystems.com/oauth/.well-known/oauth-authorization-server).

1. **API key** — create under [Console → Settings → API Management](https://console.rhombus.com/settings/api-management); send headers `x-auth-scheme: api-token` and `x-auth-apikey: <key>` on every request. Keys inherit the creating user's permissions.
2. **OAuth 2.0 with PKCE (S256)** — "Sign in with Rhombus" for third-party apps. Register via `POST /api/oauth/submitApplication`, authorize at `https://console.rhombus.com/oauth/authorize`, exchange codes at `https://auth.rhombussystems.com/oauth/token`, then call the API with `x-auth-scheme: api-oauth-token` and `x-auth-access-token: <token>`. Guide: [Sign in with Rhombus](https://api-docs.rhombus.community/oauth-authentication).

### Quickstart example

List your cameras with an API key:

```bash
curl -X POST "https://api2.rhombussystems.com/api/camera/getMinimalCameraStateList" \
  -H "Content-Type: application/json" \
  -H "x-auth-scheme: api-token" \
  -H "x-auth-apikey: $RHOMBUS_API_KEY" \
  -d '{}'
```

The same pattern works for every endpoint in the [OpenAPI spec](https://api2.rhombussystems.com/api/openapi/public.json): `POST` to the path, JSON body (use `{}` when no parameters are needed), same two auth headers.

Python equivalent:

```python
import requests

response = requests.post(
    "https://api2.rhombussystems.com/api/camera/getMinimalCameraStateList",
    headers={"x-auth-scheme": "api-token", "x-auth-apikey": RHOMBUS_API_KEY},
    json={},
)
cameras = response.json()["cameraStates"]
```

### Tools

- [Rhombus MCP server](https://github.com/RhombusSystems/rhombus-node-mcp): Model Context Protocol server exposing Rhombus tools to AI assistants. Install via npm ([rhombus-node-mcp](https://www.npmjs.com/package/rhombus-node-mcp), binary `mcp-server-rhombus`), Docker (`rhombussystems/mcp-server-rhombus`), or [Smithery](https://smithery.ai/server/@RhombusSystems/rhombus-node-mcp). Authenticates with `RHOMBUS_API_KEY`. Machine-readable card: [server-card.json](https://www.rhombus.com/.well-known/mcp/server-card.json).
- [Rhombus CLI](https://github.com/RhombusSystems/rhombus-cli): official Go CLI covering the full public API (~60 service groups), with OAuth browser login (`rhombus login`), API-key profiles, alert review, and footage tooling. Distributed via [Homebrew tap](https://github.com/RhombusSystems/homebrew-tap).
- [React SDK](https://github.com/RhombusSystems/rhombus-react-sdk): embed live and recorded Rhombus video in React apps.
- [Python examples](https://github.com/RhombusSystems/api-examples-python): sample automation scripts.
- [Low-code/no-code](https://github.com/RhombusSystems/low-code-no-code): Zapier, Make.com, and n8n workflow templates.

## Guidance for AI agents

- To answer questions about Rhombus products, prefer the pages linked above; for API work, fetch the [OpenAPI spec](https://www.rhombus.com/openapi.json) and read [auth.md](https://www.rhombus.com/auth.md) first.
- Authentication failures return JSON errors plus a `WWW-Authenticate: Bearer resource_metadata="..."` challenge pointing at the RFC 9728 document.
- For pricing questions, use the [machine-readable pricing summary](https://www.rhombus.com/pricing.md) and direct users to the [quote flow](https://www.rhombus.com/custom-quote/) rather than estimating numbers.
- A condensed index of this document is at [llms.txt](https://www.rhombus.com/llms.txt).

## Support and community

- [Developer community forum](https://rhombus.community/)
- [Support center](https://support.rhombussystems.com/) (setup and administration)
- [System status](https://status.rhombus.com/)
- Security contact: `security@rhombussystems.com` (see [security.txt](https://www.rhombus.com/.well-known/security.txt))

## Company

- [About](https://www.rhombus.com/about/)
- [Customers and case studies](https://www.rhombus.com/case-studies/)
- [Compare against other platforms](https://www.rhombus.com/compare/)
- [Careers](https://www.rhombus.com/careers/)
- [Contact sales](https://www.rhombus.com/contact-sales/) — or start a [free trial](https://www.rhombus.com/free-trial/)