Fetch the signed commands waiting for a CMS installation

GET /api/v1/cms/commands

https://app.tanba-ooh.kz/api/v1/cms/commands

Scope relay:commands. Operator organisations only. Returns the commands (cut-off, restore, restart, content switch, emergency broadcast) that address structures linked to the installation and that the installation has not yet been given. Each item carries the signed envelope exactly as the signer stored it, in envelope as base64 of the DER bytes; the platform has already checked it against the command roots and against the command's own row before handing it out, and a command that fails the check is never listed. A command is handed out once and again after 5 minutes if it has not been acknowledged, at most three times; a delivery without an answer after the third try is recorded as failed (no_result). The command is signed by the platform: the installation executes it and acknowledges it, and the console shows the delivery as relayed and not verified on the device.

With wait the call holds the connection for up to that many seconds until a command is available, and answers an empty list when none came. A retired installation answers 409 installation_retired; an installation of another organisation is not found.

Authentication

API key in the Authorization header.

Scope: relay:commands

Parameters

Name	In	Type	Required	Description	Example
`installation`	query	string (uuid)	yes	Identifier of the registered CMS installation.	`5d0c8e7a-21b4-4c3f-9a6e-0b1d2c3e4f50`
`wait`	query	integer	no	Seconds to hold the call open when nothing is waiting, 0 to 30.	`30`

Responses

200 The waiting commands, oldest first, an emergency broadcast before the rest.

`application/json`

Name	Type	Required	Description	Example
`items`	array of object	yes	Commands to execute; empty when none is waiting.
`items[].command_id`	string (uuid)	yes	Identifier of the command; the envelope names the same one.	`"01a1377e-c8e3-7c41-8ae9-3a8dc9413fbd"`
`items[].type`	string	yes	What to do. cutoff, restore, restart, content_switch, emergency_broadcast
`items[].scope`	string	yes	How the command was addressed. device, structure, operator, district, all
`items[].scenario`	string \| null	yes	Name of the scenario for a content switch or an emergency broadcast; otherwise null.	`null`
`items[].issued_at`	string (date-time)	yes	When the command was issued.	`"2026-10-14T09:00:00+05:00"`
`items[].not_after`	string (date-time)	yes	The command must not be executed after this moment.	`"2026-10-14T10:00:00+05:00"`
`items[].structures`	array of object	yes	The structures of this installation the command applies to; acknowledge each one.
`items[].structures[].id`	string (uuid)	yes	Identifier of the structure.	`"82895149-94fa-4a60-9604-d95e705c6212"`
`items[].structures[].code`	string	yes	Code of the structure.	`"ALM-0012"`
`items[].envelope`	string	yes	Base64 of the signed command envelope (DER).	`"MIIGvQYJKoZIhvcNAQcCoIIGrjCCBqoCAQExDzANBglghkgBZQMEAgEFADCB"`

Example

{
  "items": [
    {
      "command_id": "01a1377e-c8e3-7c41-8ae9-3a8dc9413fbd",
      "type": "cutoff",
      "scope": "structure",
      "scenario": null,
      "issued_at": "2026-10-14T09:00:00+05:00",
      "not_after": "2026-10-14T10:00:00+05:00",
      "structures": [
        {
          "id": "82895149-94fa-4a60-9604-d95e705c6212",
          "code": "ALM-0012"
        }
      ],
      "envelope": "MIIGvQYJKoZIhvcNAQcCoIIGrjCCBqoCAQExDzANBglghkgBZQMEAgEFADCB"
    }
  ]
}

Errors

Errors are problem documents (application/problem+json) with a stable code.

Status	Meaning
401	No valid session or API key (`unauthenticated`, `session_expired`, `invalid_api_key`).
403	The role or the key's scope does not allow this (`forbidden`, `key_scope_denied`, `key_route_denied`).
404	Nothing there, or not visible to the caller.
409	The installation is retired (`installation_retired`).
422	Field errors (`validation_failed`).
429	Rate limit; see `Retry-After`.
503	The platform cannot check command signatures now (`command_roots_unavailable`); retry later, commands are not lost.
default	An error as a problem document.

Code samples

curl

curl 'https://app.tanba-ooh.kz/api/v1/cms/commands?installation=5d0c8e7a-21b4-4c3f-9a6e-0b1d2c3e4f50' \
  -H 'Authorization: Bearer YOUR_API_KEY'

Python

import requests

response = requests.get(
    "https://app.tanba-ooh.kz/api/v1/cms/commands?installation=5d0c8e7a-21b4-4c3f-9a6e-0b1d2c3e4f50",
    headers={
        "Authorization": "Bearer YOUR_API_KEY",
    },
)
print(response.status_code, response.text)

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://app.tanba-ooh.kz/api/v1/cms/commands?installation=5d0c8e7a-21b4-4c3f-9a6e-0b1d2c3e4f50", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer YOUR_API_KEY")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	data, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.Status, string(data))
}