Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

zm-api

A modern, fast, type-safe REST API for ZoneMinder — rebuilding a twenty-year-old Perl, PHP, and CGI surface as one native service.

Rust + Axum OpenAPI 3.1 WebRTC + HLS AGPL-3.0
Install API reference GitHub

zm-api talks directly to an existing ZoneMinder MySQL/MariaDB database and ships in passive mode — it serves the REST API and leaves ZoneMinder’s own daemons running exactly as they were. Installing it changes nothing about how your cameras record, so it is safe to put on a live box and take back off again.

When you are ready, it takes over daemon supervision too, replacing zmdc.pl and zmwatch.pl with one native supervisor. Passive is the on-ramp; takeover is where it is meant to end up, and zm-api-takeover moves you either way in one command.

One binary, one language

No PHP-FPM, no CGI, no Perl runtime to babysit. A single native executable and a systemd unit.

Live streaming built in

WebRTC and HLS from zmc's stream socket, plus recorded-event playback with byte-range seeking.

Real access control

JWT auth with separate access and refresh keys, per-feature RBAC, and row-level monitor ACLs.

Self-documenting

Every endpoint is in a generated OpenAPI 3.1 document, served live and published with each release.

A better supervisor

Takeover replaces zmdc.pl and zmwatch.pl with one native process: exponential backoff, database reconciliation, and daemon control over REST.

Safe to adopt

Passive by default, so installing changes nothing. Switch to takeover when you choose, and back again with one command.

Actually tested

1,100+ unit and integration tests with a coverage gate, run against a real ZoneMinder schema in CI.

Where to start

If you have a running ZoneMinder and want zm-api alongside it, go to Install and then Upgrading an existing ZoneMinder — the database migration step is easy to miss and fails quietly.

If you are building a client against it, start with Authentication and Permissions, then browse the API reference.

If you are deciding how to deploy the pieces together, Architecture covers what has to share a host and how to serve a dashboard.

Status

zm-api is in active development at 3.0.0-alpha. It keeps the v3 major from ZoneMinder’s API lineage, so the URL shape is familiar, but it is not a drop-in replacement for the CakePHP API — the response envelopes, authentication, and error format are all different.