# HTTP

The OpenGate Devices API is a REST interface that integrates devices, sensors and machines into the
platform. It is the broadest of the south transports: it carries both conversations, in both directions.

| The device | Over HTTP it can | Read |
|---|---|---|
| Pushes what it measured | `POST` inventory data (serial number, ICC, MSISDN) and business data as data streams: location, temperature, pressure, consumption | [Data collection](data_collection/) |
| Receives what to do | Accept operation requests from OpenGate, or ask for the ones pending, and report the result | [Operations](operations/) |

## Who calls whom

This is the part worth settling before implementing anything, because it decides which side needs a
reachable endpoint:

| Flow | Who opens the connection | The device needs |
|---|---|---|
| Data collection | The device | Outgoing HTTPS only |
| [Operations driven by platform](operations/driven_by_platform/) | OpenGate | To expose an endpoint OpenGate can reach |
| [Operations driven by device](operations/driven_by_device/) | The device | Outgoing HTTPS only — it polls for pending operations |

Devices that sleep, sit behind NAT or have no public address use the device-driven flow, which is the usual
case in the field.

Before going to production, read the [security tips for operations](operations/security/): HTTPS,
`X-ApiKey` authentication and mutual TLS.

{{% children sort="weight" %}}