Explicitly log in to the NVR (exactly one attempt, never retried).

Normally unnecessary: the first NVR tool call logs in. After any failed login, automatic logins stop; fix the cause before calling this. Once the server's failure budget is spent it refuses until restarted.

NVR session state: authenticated, failed logins this process, the last failure's lockout counters and whether login is frozen. No network I/O.

NVR model, firmware and identity (read-only).

Capability spec: max channels, codecs, feature flags (read-only).

System basics such as device name, time zone and session timeout (read-only).

NVR network configuration (read-only).

Main/minor stream resolution tables (read-only).

Catalogued gateway to any NVR call. Identify the call with (module, method, key) from nvr_list_calls/nvr_describe_call; pass the module body as params. Unknown calls are refused with the nearest matches. Anything the catalog flags as mutating, or whose method is not "get", needs VIGI_NVR_ALLOW_WRITES=true AND confirm_write=true. Set allow_extra=true to send keys outside the call's example. With VIGI_NVR_DRY_RUN the exact body is returned as data.request (and data.dry_run=true) and not sent. Credential fields in the reply are redacted.

Off-catalog escape hatch: send {"method": method, module: params} directly. Prefer nvr_call. Everything but method="get" needs both write gates; the login and user_management modules are always refused. Logged at WARNING. Honours VIGI_NVR_DRY_RUN. Reply credentials are redacted.

List every API module the NVR exposes, with per-module call and mutating-call counts (read-only; no device I/O).

List the catalogued calls for one module (method, key, whether it mutates, an example and a response-shape hint). Read-only.

Describe one call by (module, method, key): its example parameters, whether it mutates and its response shape. Read-only.

All bound NVR channels (chm added_dev). Credential fields always redacted.

One channel by id (credential fields redacted).

Group channels by device uuid and flag duplicates. Within a group, rows with online="0" or conn_status!="0" are marked stale (removal candidates).

Read-only. Produce an ordered, resumable cleanup plan: back up config, remove every ghost (one call each), re-read, then move each real camera stranded above slot 8 into the lowest confirmed-empty low slot. Each step lists the exact tool, arguments and the precondition to verify from the previous step; also returns a summary (counts, final layout) and an unsafe_if list of conditions that block moves (two real cameras share a uuid, more than 8 real cameras, an online ghost). Nothing is written; hand each step to the matching write tool yourself.

Unbind one channel (chm_del_dev). DESTRUCTIVE. Requires VIGI_NVR_ALLOW_WRITES=true, confirm_write=true and expected_uuid equal to the live row's uuid. Refuses a row whose live online=="1" (a connected camera) unless force=true. Honours VIGI_NVR_DRY_RUN. Run nvr_backup_config first. Returns before/after rows.

Move a binding to another channel slot (chm_mod_dev_chn), keeping its credentials and settings. Refuses if new_id is occupied (the firmware would replace it). Same gates as nvr_remove_channel. Returns before/after rows.

Installed hard disks and their state (read-only, raw reply).

Recording / storage policy status (read-only, raw reply).

Disks (status, capacity, free space, health) plus the overwrite and recording-plan policy (read-only). include_raw=true adds the raw reply at data.raw.

Download the NVR configuration backup to the server's backup directory (mode 0600). Read-only on the NVR; run this before any channel cleanup.

Per-channel video stream configuration: main/minor resolution, codec and bitrate tables plus advanced encoder settings (read-only). Pass include_raw=true to also get the unprocessed device reply under data.raw.

Image, OSD, privacy-mask (cover) and ROI configuration for one channel (1-16), read-only. include_raw=true adds the raw device reply at data.raw.

Detection configuration for one channel (1-16) and one detection kind (read-only). kind is one of: motion, people, vehicle, linecross, intrusion, region_entrance, region_exiting, loitering, abandon_and_taken, scene_change, audio_exception, tamper. include_raw=true adds the raw device reply under data.raw. Refuses an unknown kind or an out-of-range channel.

Best-effort list of recent NVR events/alerts (disk, network, video-loss and similar), read-only. Pass since as an ISO-8601 timestamp to drop older events that carry a parseable time. include_raw=true adds the raw reply at data.raw.

NVR user accounts: names and groups only (credentials are never returned), read-only. include_raw=true adds the redacted raw reply at data.raw.

Firewall configuration: allow/deny lists and protocol/service exposure (read-only). include_raw=true adds the raw reply at data.raw.

TP-Link cloud (TP-Link ID) binding and connection status (read-only). include_raw=true adds the raw reply at data.raw.

Device time, time zone, NTP and DST configuration (read-only). include_raw=true adds the raw reply at data.raw.

Report whether ONVIF/RTSP is enabled (onvif_server.onvif.enabled) and whether the RTSP port (default 554, VIGI_NVR_RTSP_PORT) accepts TCP connections. Read-only.

Enable ONVIF/RTSP on the NVR (onvif_server set). One-time setup. WRITE: needs VIGI_NVR_ALLOW_WRITES=true and confirm_write=true. Honours VIGI_NVR_DRY_RUN. Re-reads and returns enabled_before/after.

Redacted live RTSP URL for a channel (1-16), stream 1=main/2=sub, plus a hint naming the env vars that hold the credentials. The password is never returned. Read-only.

Export a replay window (ISO-8601 start/end, UTC offset required) to an mp4 in the export dir. By default uses ffmpeg -c copy (lossless). Writes to local disk, so it is gated like a write: VIGI_NVR_ALLOW_WRITES=true AND confirm_write=true. VIGI_NVR_DRY_RUN returns the argv with the URL redacted. Window <= VIGI_NVR_EXPORT_MAX_MINUTES. Set target_max_mb (e.g. 20 for Gmail) and/or max_width to re-encode with libx264 (CRF/scale chosen from duration and target) so the file fits; then also returns original_bytes, encoded_bytes and fits_target. Returns path, bytes, duration_s, sha256 and a redacted ffmpeg stderr tail. An empty window surfaces as NO_FOOTAGE_IN_WINDOW.

Capture one JPEG frame from a channel's live stream into the export dir (read-only; stream defaults to 2=sub). Needs RTSP enabled and ffmpeg available. Returns path, bytes and sha256.

List mp4/jpg files in the export directory (name, bytes, mtime). Read-only.

Delete one file from the export directory by name (path-confined; the name must be a generated export filename). WRITE: needs VIGI_NVR_ALLOW_WRITES=true and confirm_write=true.

Typed recording timeline for one channel (1-16) on one day (YYYY-MM-DD), read-only: a list of {start, end, type, raw_type} where type is normal / motion / smart / manual / alarm / unknown. tz is 'local', 'utc' or an IANA zone. include_raw=true adds the raw device reply at data.raw. On an unrecognised reply shape returns PROTOCOL_ERROR with the payload under data.raw (the live run corrects the shape).

Alias of nvr_list_recording_segments (kept for compatibility). Lists recorded segments for one channel (1-16) on one day (YYYY-MM-DD), read-only.

Merged, de-duplicated activity windows for one channel (1-16) or "all", read-only. Combines the typed recording timeline with event logs, merging spans that overlap or sit within min_gap_s and dropping windows shorter than min_len_s. Provide date (YYYY-MM-DD) or since (ISO-8601); optionally narrow with since/until. kinds defaults to motion/smart/alarm. Returns sorted windows [{channel, name, start, end, duration_s, kinds, sources}] and a per-channel summary.

One JPEG contact sheet of cols x rows frames evenly sampled across a replay window (ISO-8601 start/end, UTC offset required), each tile's exact time burned in. Read-only (reads frames into the export dir). Returns the file info plus a tile->timestamp map so an agent can cite the moment. Needs RTSP enabled and ffmpeg available.

Individual JPEG frames every every_s seconds across a replay window (ISO-8601 start/end, UTC offset required), up to max_frames. Read-only. Returns each frame's name, path and timestamp. Use after a contact-sheet hit to pin the exact moment.

Return one export file's content as base64 for files up to max_mb (default 20; Gmail caps attachments near 25 MB). Over the limit returns TOO_LARGE with the size and a hint to re-export with target_max_mb or fetch the exports:// resource. Path-confined to the export dir.

Delete exports older than VIGI_NVR_EXPORT_RETENTION_DAYS (default 7). Double-gated like any delete: needs VIGI_NVR_ALLOW_WRITES=true and confirm_write=true. VIGI_NVR_DRY_RUN=true lists what would be deleted without deleting.

Healthcheck: reachability, offered auth scheme, the device's lockout counters, local session state and safety policy. Never logs in.