Device Platform API Design for Hardware Brands
What the Platform API Must Not Do
The platform API is not a development sandbox. It does not permit runtime modification of safety-critical firmware partitions, real-time sensor calibration, or injection of unvetted AI models. It does not support dynamic reconfiguration of radio transmission parameters beyond the factory-certified band and power envelope. No endpoint grants access to raw biometric buffers, camera feeds or LiDAR point clouds—even for debugging. Companion robot behaviour logic, such as the K1-ai-companion-robot response engine or the E1-ai-learning-robot curriculum scheduler, remains immutable post-deployment. This is non-negotiable: altering these layers invalidates the EMC, low-voltage and laser classification documentation supplied per model.
Branding Endpoints: Safe and Scoped
Branding changes are limited to assets shipped with the firmware image: splash screen, boot logo, app icon, and language string tables. These are bundled into signed firmware builds, not served dynamically from the cloud. Custom packaging, logo placement and age grading on toy packaging are governed by the OEM/ODM services MOQ policy—not API calls. The H3-health-smartwatch and AI wearables line both require EN 1811 nickel release validation before any skin-contact branding element (e.g., engraved logo) is approved. No API allows runtime switching between CE, UKCA or FCC-labelled firmware variants—those are separate builds, each with its own test report.
Token Management: Where Access Ends
Each brand receives one set of production tokens tied to a specific hardware revision and firmware version. Tokens expire 90 days after first use and cannot be renewed without revalidation of the full test scope. There is no token rotation API. No token grants access to the AI training pipeline, model weights, or inference logs. Token misuse—such as using a learning robot token to authenticate a service robot—triggers automatic revocation and requires new quotation under AI Robots line terms. All tokens are issued only after the importer confirms WEEE, BattG and EORI/VAT responsibilities per EU and UK importer duties.
Support Boundary: The Hard Line
WingPhoenix supports only the documented, factory-tested API surface. We do not support custom webhook integrations, third-party certificate pinning, or client-side modifications to the SDK. If your integration bypasses the signed OTA path or modifies the TLS handshake, it voids the warranty and invalidates the CE RED declaration. Support tickets arising from unauthorised API usage are closed without resolution. This is stated in our published factory policy—and reinforced in how to vet a supplier.
Endpoints That Require Re-Testing
Any change to these endpoints triggers rebooking of the full regulatory test scope at an accredited laboratory. This applies even if the change appears cosmetic or non-functional:
- Firmware update URI (even redirect-only)
- Telemetry upload endpoint (including payload schema or compression method)
- Authentication flow (OAuth2 scopes, JWT claims, or token lifetime)
- Device registration endpoint (especially if it alters MAC address handling or serial number binding)
- Language fallback mechanism (if it affects EN 71-3 text rendering or accessibility labels)
| Endpoint Type | Allowed? | Requires Re-Test? | MOQ Trigger | Notes |
|---|---|---|---|---|
| Branded splash screen URL | Yes | No | 500 units | Static asset only; no script execution |
| Firmware OTA download URI | No (factory-signed only) | Yes | 2,000 units | Custom URI invalidates EN 301 489-1 scope |
| Telemetry batch upload | Yes (schema locked) | Yes | 2,000 units | Schema change requires EN 62368-1 fault analysis |
| OAuth2 token exchange | Yes (scoped only) | No | 500 units | No custom scopes or refresh logic permitted |
| Real-time sensor readout | No | N/A | N/A | Violates EN 62368-1 isolation requirements |
| Companion robot dialogue trigger | No | N/A | N/A | Behaviour logic is immutable post-certification |
| Learning robot lesson load | Yes (signed ZIP only) | Yes | 1,000 units | Each lesson bundle requires EN 71-1 mechanical review |
Why This Matters for Your Importer
Your EU or UK importer must verify that every exposed API endpoint maps to a live, revision-specific test report—not a generic “platform” certificate. Claims like “API compliant with CE” are meaningless unless the report cites the exact firmware hash, hardware BOM, and test configuration used in your order. WingPhoenix supplies documents per model and hardware revision, not per platform version. That is why we recommend reviewing the full scope with your lab before finalising any custom endpoint—even if it seems trivial. Start with the how we build and test
Questions buyers ask
Which API capabilities should we grant our brand partners to avoid support overload?
Expose only the endpoints needed for branding, firmware versioning and basic telemetry—never direct sensor control, model retraining or cloud credential management. Keep all health metric pipelines, translation engines and companion robot interaction logic closed by default.
How do we align API access with our CE, FCC and toy safety obligations?
Every exposed endpoint must map to a test scope booked per hardware revision at an accredited lab. For example, EN 71-3 compliance for toys requires that no API can alter chemical migration pathways in the firmware.
Why did our branded sample fail EMC testing after we changed the firmware update endpoint?
Because the original CE RED test scope covered only the factory-signed OTA path. Any custom endpoint—even for download-only—requires retesting under EN 301 489-1 and EN 300 328. See how we build and test.
What’s the one claim most suppliers won’t substantiate about their platform API?
That third-party tokens or custom endpoints have been validated against the full regulatory scope—including EN 62368-1 fault conditions, RoHS 3 material declarations and UN38.3 thermal runaway scenarios for battery-connected devices.
Related: more on ai memory platform · buyer guides · customisation tiers