Kami
लगइनसुरु गर्नुहोस्

Android companion API

Last updated: 24 October 2026

Base URL: https://www.kami.supadeuralibazar.com · App package com.kami.app

Authentication

The phone's own user links the app in Settings → Anti-theft → "Link Android app", which shows a Device ID and Token. Send both on every request:

X-Device-Id: <device uuid>
X-Device-Token: <secret token>

POST /api/public/device/heartbeat

Send every 5–15 minutes (and on LOCATE). Returns pending commands, which are then marked delivered.

{
  "battery": 78, "is_charging": false,
  "network": "4G", "sim_operator": "Maxis", "signal": 4,
  "lat": 1.4927, "lng": 103.7414, "accuracy": 12,
  "location_name": "Johor Bahru, Malaysia"
}

→ 200 { "ok": true, "commands": [ { "id": "…", "type": "SIREN_ON", "payload": null } ] }

POST /api/public/device/command-ack

After running a command. The app MUST show a visible notification for every command.

{ "command_id": "<uuid>", "status": "done" | "failed" }

Command types: LOCATE, SIREN_ON, SIREN_OFF, LOCK, LOST_MODE_ON (payload.message), LOST_MODE_OFF, REQUEST_PHOTO.

POST /api/public/device/event

Anti-theft triggers, only honoured if the owner enabled anti-theft.

{ "type": "failed_unlock", "attempts": 3 }        → email + push
{ "type": "sim_change", "new_sim_operator": "Ncell" } → email + SMS
{ "type": "lost_report" }                          → confirmation email

POST /api/public/device/evidence

multipart/form-data: photo (jpeg/png/webp ≤ 8 MB), trigger_reason (wrong_pin_attempts | sim_change | manual_request), optional lat, lng.

Push (FCM)

For instant delivery, the backend sends an FCM data message {"type":"sync"}; the app then calls heartbeat to fetch commands.

Offline SMS

The app listens for incoming SMS matching the user's codes (GRD-LOC-…, GRD-SIR-…, GRD-LCK-…, GRD-LST-…) and replies with location or runs the action, always showing a notification.

Not allowed

  • No silent microphone, no hidden icon, no fake shutdown, no undisclosed capture.