Kite Cast API

The Kite Cast API is a small, opinionated interface for creating streaming sessions and moving bytes through them. It is designed to sit behind a CDN and expose one long-lived transport path per session.

Base URL: https://api.kitecast.example. Edge path: https://<edge>/api/stream/<session-id>.

Rate limits, quotas, and support tiers vary by plan. See pricing.

Authentication

All control-plane calls (session lifecycle, metrics, webhooks) are authenticated with a bearer token issued at signup. Data-plane traffic on /api/stream/<session-id> is authenticated by the session ID itself — the ID is a one-shot capability, rotated on each session create.

Authorization: Bearer kc_live_9f4a2e1b...c8

Versioning

Control-plane API is versioned in the path (/v1/). The data-plane path is unversioned; framing changes are negotiated per-session at create time via the framing field.

Create a session

POST /v1/sessions

Provisions a session and returns a signed edge URL. The URL is bound to viewer geo and device fingerprint at issue time and cannot be replayed from another client.

Body

Field	Type	Description
`ingest`	string	Source URL (rtmps, srt, http-flv, or webrtc SDP)
`delivery`	string[]	Output formats: `hls`, `ll-hls`, `dash`, `webrtc`, `raw`
`ladder`	string	ABR ladder preset or `auto`
`ttl`	integer	Session lifetime in seconds. Default 3600, max 86400
`framing`	object	Optional. Padding/chunk hints for the edge — see framing

Response 200

{
  "session_id": "7c9f4c40-1e2b-4f6a-9a8b-0e5b6a10af12",
  "play_url":  "https://cdn.kitecast.example/api/stream/7c9f4c40-1e2b-4f6a-9a8b-0e5b6a10af12",
  "expires_at": "2026-08-20T18:11:04Z",
  "framing": { "padding": "100-1000", "chunk": "packet-up", "method": "GET" }
}

Stream endpoint

GET /api/stream/<session-id>

The data plane. All player and encoder traffic flows through this single URL. Requests are long-lived, unbuffered, and padded per the session's framing profile.

Do not fetch this URL with a general-purpose HTTP client that buffers responses. Kite Cast delivers bytes as they arrive from origin; buffered clients will appear to hang.

Framing profile

Every session picks a framing profile at create time to keep on-wire signatures stable and to interoperate with strict middleboxes.

Field	Values	Notes
`padding`	`none` \| `100-1000` \| custom range	Per-chunk pad bytes. Flattens size distribution for cache stability
`chunk`	`packet-up` \| `stream-up`	Uplink chunking mode
`method`	`GET` \| `POST`	Transport verb. Default GET. POST is disabled on plans that traverse third-party CDNs

Terminate a session

DELETE /v1/sessions/{id}

Ends the session immediately, evicts all edge caches, and revokes the signed URL. Ingest connections receive a graceful shutdown.

Errors

Errors are returned as RFC 9457 problem details.

{
  "type":   "https://docs.kitecast.example/errors/session-expired",
  "title":  "Session expired",
  "status": 410,
  "detail": "The session ended at 2026-08-20T17:55:00Z."
}

Rate limits

Control plane is limited per token; data plane is limited per session and per edge PoP. Limits are returned in X-RateLimit-* headers on every response.

Webhooks

Every session lifecycle event (created, started, ended, degraded) is delivered to your configured webhook endpoint with an HMAC-SHA256 signature.