1. API Technical Specifications
FoxCloud OpenAPI
Vpp Flow
  • Vpp Flow
  • Full API Reference
  • What's New & Milestones
  • Getting Started
    • 1. Overview & Integration Scope
    • 2. Environments & Prerequisites
  • End-User Enrollment & OAuth Flow
    • 0. Introduction
    • 1. The User Authorization Journey
    • 2. OAuth Token Operating Model
    • 3. Implementation Guide
  • API Technical Specifications
    • 1. Universal Request Rules
    • 2. Rate Limiting Strategy
    • 3. Response Structure
    • 4. Error Code Reference
  • Telemetry & Data Acquisition
    • 1. Data Pipeline & Scaling Strategy
    • 2. Telemetry Data Query (Real-time)
    • 4. Telemetry Variable Dictionary
    • 5. System Performance & SLA
    • 3. Device Configuration & Settings: Pre-Dispatch State Awareness
  • Control Commands & Dispatch
    • 1. Core Dispatch Architecture: Scheduler V3
    • 2. Scheduler V3 Operations
    • 3. Real-time Device Settings
    • 4. Strategic Roadmap: Scaling for Massive Fleets
  • FAQ
    • Troubleshooting Quick Guide
  1. API Technical Specifications

1. Universal Request Rules

All API requests must adhere to the following standards to ensure successful communication and secure data transmission.

1.1 Mandatory Request Headers#

Every request must include the following headers for authentication and security verification.
Header KeyRequiredExample ValueDescription
timestampYes1719834567890Current timestamp in milliseconds.
signatureYesd41d8cd98f00b204e9800998ecf8427eMD5 signature string (see generation rule below).
langYesenLanguage preference (en for English, zh for Chinese).
AuthorizationYesBearer abc123...xyzOAuth token. Required for all authenticated APIs.
️ Critical Security Note: Real-time Timestamp
The timestamp must be generated in real-time for every single request. FoxCloud strictly validates the timeliness of this timestamp.
Expiration Check: Requests carrying timestamps that fall outside the acceptable time window will be immediately rejected.
Security Enforcement: Any request with an invalid signature or an expired timestamp will be blocked to prevent replay attacks. Do not cache or reuse old timestamps and signatures.

1.2 Signature Generation Algorithm#

To ensure request integrity, the signature header must be generated using the following MD5 encryption logic:
1.
Construct the Source String:
Concatenate the following three components using the literal string \r\n (backslash + r + backslash + n) as the separator:
[API Endpoint URL]\r\n[Access Token]\r\n[Timestamp]
️ Common Pitfall Warning: The separator is the 4-character string \r\n, NOT an actual carriage return or line feed character (ASCII 0x0D 0x0A). Do not use your programming language's newline escape sequence.
2.
Encrypt:
Perform MD5 hashing on the constructed source string.
3.
Set Header:
Convert the MD5 result to lowercase and place it in the signature header.
Example:
URL: /op/v0/device/list
Token: abc123xyz
Timestamp: 1719834567890 (Must be real-time)
Source String: /op/v0/device/list\r\nabc123xyz\r\n1719834567890
Signature: md5(source_string)
Modified at 2026-08-04 03:30:41
Previous
3. Implementation Guide
Next
2. Rate Limiting Strategy
Built with