API Endpoints

Complete reference for all available Bassode API endpoints.

Base URL: https://api.bassode.com

Authentication Legend

API key — all requests require X-Api-Key + X-Api-Secret
JWT — user must be logged in; include Authorization: Bearer <token>
Subscriber JWT — user must have an active subscription or trial

Users

POST /api/Users/Register

Create a new Bassode user account.

Required

API key with scope: auth:register

Request Body

{
  "email": "user@example.com",
  "password": "SecurePassword1!",
  "firstName": "Jane",
  "lastName": "Doe"
}

Response

{
  "id": 42,
  "email": "user@example.com",
  "firstName": "Jane",
  "lastName": "Doe"
}

POST /api/Users/Login

Authenticate a user and receive a signed JWT.

Required

API key with scope: auth:login

Request Body

{
  "email": "user@example.com",
  "password": "SecurePassword1!"
}

Response

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresAt": "2026-04-26T12:00:00Z",
  "user": {
    "id": 42,
    "email": "user@example.com",
    "firstName": "Jane",
    "lastName": "Doe",
    "role": 1,
    "isTrialSubscription": false
  }
}

GET /api/Users/{id}

Get a user's profile. A user can only retrieve their own profile.

Required

API key with system:full-access scope + JWT (own user)

API Keys

These endpoints allow users to manage their own API keys. All require a valid Subscriber JWT — the user must have an active subscription or trial.

POST /api/ApiKeys

Create a new API key for the authenticated user.

Required

API key (any scope) + Subscriber JWT

Request Body

{
  "name": "My Audio App",
  "scopes": "auth:login read:devices"
}

Response

{
  "id": 7,
  "key": "bsk_live_xxxxxxxxxxxxxx",
  "secret": "yyyyy...",
  "name": "My Audio App",
  "scopes": "auth:login read:devices",
  "createdAt": "2026-04-19T10:00:00Z"
}

Important: The secret is returned only once and cannot be retrieved again. Store it securely.

GET /api/ApiKeys

List all API keys belonging to the authenticated user.

Required

API key (any scope) + Subscriber JWT

PUT /api/ApiKeys/{id}/scopes

Update the scopes assigned to an API key.

Required

API key (any scope) + Subscriber JWT

Request Body

{
  "scopes": "auth:login auth:register read:devices"
}

DELETE /api/ApiKeys/{id}

Revoke an API key permanently.

Required

API key (any scope) + Subscriber JWT

Subscriptions

GET /api/SubscriptionPlans

List all available subscription plans.

Required

API key with scope: auth:login

Response

[
  {
    "id": 1,
    "name": "Monthly",
    "planType": 1,
    "price": 9.99,
    "currency": "USD",
    "durationDays": 30
  },
  {
    "id": 2,
    "name": "Yearly",
    "planType": 2,
    "price": 89.99,
    "currency": "USD",
    "durationDays": 365
  }
]

GET /api/Subscriptions

Get the active subscription for the authenticated user.

Required

API key with system:full-access scope + JWT

POST /api/Subscriptions

Create a subscription for the authenticated user.

Required

API key with system:full-access scope + JWT

Request Body

{
  "planId": 1
}

Audio Device Catalog

GET /api/Dac

Query the audio device catalog (DACs, amplifiers, speakers from multiple manufacturers).

Required

API key with scope: read:devices

Query Parameters

Parameter	Type	Description
`brand`	string	Filter by manufacturer
`page`	integer	Page number (default: 1)
`pageSize`	integer	Items per page (default: 50, max: 100)

Connected Devices

Endpoints for managing Bassode-compatible devices registered by users. A device is any hardware that implements the Bassode Device API and can be registered to a user account. The Bassode Transport is the first supported device type; additional device types will be introduced as new Bassode-compatible hardware becomes available.

GET /api/Devices

List all Bassode-compatible devices registered by the authenticated user.

Required

API key with scope: auth:login + JWT

POST /api/Devices/Register

Required

API key with scope: register:device + JWT

Request Body

{
  "serial": "BASS-a4d2c891",
  "name": "Living Room Bridge"
}

Health

GET /api/Health

Service health check. Returns database and API status. No authentication required.

Response

{
  "status": "healthy",
  "database": "connected",
  "timestamp": "2026-04-19T10:00:00Z"
}

Next Steps

See Code Examples Authentication Guide