Milestone Logo


You are recommended to set up a small separate system for development.


To set up a development system with the XProtect API Gateway, you'll need:

  • XProtect VMS Products 2022 R1 or later
  • An XProtect VMS license file

To deploy the system with certificates, you'll need:

  • The fully qualified domain name of the development system
  • A server certificate for the development system
Refer to Milestone product system requirements for more information about system requirements.
If you have previously installed the 2021 R2 pre-release of the API Gateway, you'll have to uninstall the pre-release before proceeding.

Installing XProtect

This is a brief walkthrough of the installation of a simple development system with all system components on the same host. Learn more.

If you have already set up a system with XProtect VMS 2022 R1 or later, you can skip to Verify installation.

1. Create a server certificate (optional)

Create and install a server certificate. When prompted for DNS names, include the fully qualified domain name for the server. Learn more.

You should consider setting up a server certificate and using HTTPS. While the IDP, the API Gateway, and the management server all can work with either HTTP or HTTPS, production systems should be set up with server certificates. User credentials, bearer tokens, and other sensitive data are transmitted in cleartext if you do not set up certificates and use HTTPS.

2. Download installer

Download the XProtect VMS products installer from the software download page.

3. Install XProtect

Run the installer you just downloaded:

  • When you get to the Select license file page, download and select a free XProtect Essential+ license file, unless you have requested a free trial license, or have created a test license as a Milestone Technology Partner. Learn more.
  • When you get to the Select an installation type page, select Single computer.
  • When you get to the Select encryption page, enable Server certificate and select the VMS SSL Certificate you created and installed in step 1.
  • When you get to the Add users page, add a Basic user with the Administrators role, for example user seamrune with password Rad23Swops#.

4. Verify installation

Make sure that the API Gateway is operational and reachable.

curl --insecure --request GET ""
This assumes that you will set up a server certificate and use HTTPS. If you chose to not create and use a server certificate, replace https with http in all instructions.

5. Create a user

Use the XProtect Management Client to create an XProtect Basic user with administrator rights. Learn how.

6. Get a token

Replace the hostname, username seamrune, and password Rad23Swops# in the following code samples.

curl --insecure --request POST "" \
--header "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "grant_type=password" \
--data-urlencode "username=seamrune" \
--data-urlencode "password=Rad23Swops#" \
--data-urlencode "client_id=GrantValidatorClient"

Response body

    "access_token": "eyJhbGciOiJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L . . . ay0ferTwm-DZ4OxNXGTHk5t7R_YTWPjg",
    "expires_in": 3600,
    "token_type": "Bearer",
    "scope": "managementserver"
In Windows Command Prompt (CMD), replace the line continuation character \ with ^.

7. Your first API request

Replace the hostname and the bearer token value eyJhbG . . . YTWPjg in the following code samples.

curl --insecure --request GET "" \
--header "Authorization: Bearer eyJhbGciOiJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L . . . ay0ferTwm-DZ4OxNXGTHk5t7R_YTWPjg"

Response body

    "array": [
            "timeZone":"Central Europe Time",
            "platform":"[Not Available]",
            "relations": {
                "self": {
In Windows Command Prompt (CMD), replace the line continuation character \ with ^.
Cookie Policy · © 2022 Milestone Systems A/S - All rights reserved · Privacy Policy