# Kontakt.io

> Kontakt.io is an AI-powered real-time location system (RTLS) and IoT platform for healthcare
> operations. Its Kio Cloud platform combines BLE/UWB tags, badges, gateways and sensors with
> software for asset tracking, staff safety, patient flow, room and seat occupancy, and
> environmental telemetry. Four OpenAPI contracts are published in the Kontakt.io Developer
> Center; Kio Cloud runs in US and UK regions.

Generated by API Evangelist on 2026-08-23. Kontakt.io does not publish its own /llms.txt
(https://kontakt.io/llms.txt and https://developer.kontakt.io/llms.txt both return 404), so this
file is generated from the provider's published contracts and documentation. Nothing here is
invented; every link was fetched.

## Authentication

- Preferred: OAuth2 client credentials against per-tenant Keycloak, then `Authorization: Bearer <jwt>`.
  Token endpoint: https://kc.cloud.{region}.kontakt.io/realms/{tenant}/protocol/openid-connect/token
  Token lifetime: 300 seconds. Region is `us` or `uk`.
- Legacy and deprecated: `Api-Key: <Kio Cloud Server API Key>` header. Still the ONLY scheme
  declared by the Location & Occupancy and Spaces specs.
- [Device Management authentication](https://developer.kontakt.io/docs/dev-ctr-device-api/e1e3f6ec0e943-authentication)
- [OAuth2 client credentials flow](https://developer.kontakt.io/docs/entity-management-integration-api/0255c5646ab01-authentication-o-auth2-client-credentials-flow)

## APIs

- [Device Management API](https://developer.kontakt.io/docs/dev-ctr-device-api/40960a0b6f340-device-management-api): 45 operations over devices, configs, firmware, commands, orders, managers, namespaces, proximity UUIDs and device access. Base https://dm-api.cloud.us.kontakt.io. Versioned by `Accept: application/vnd.com.kontakt+json;version=10`. POST bodies are form-encoded.
- [Location & Occupancy API](https://developer.kontakt.io/docs/dev-ctr-loc-occ-api/c6bcb378b0df8-location-and-occupancy): 47 operations over campuses, buildings, floors, rooms, footfall spaces, occupancy, telemetry, positions, presences, colocations, gateways and Streams. Base https://apps.cloud.us.kontakt.io.
- [Spaces API](https://developer.kontakt.io/docs/dev-ctr-loc-occ-api/yr2sakrpndb8n-spaces-api): 2 operations over Smart Location Spaces. Base https://api.cloud.us.kontakt.io/spaces.
- [Entity Management Integration API](https://developer.kontakt.io/docs/entity-management-integration-api/tq7cg4bn8ch38-entity-management-integration-api): 2 operations to batch import/update Staff and Asset entities. Base https://api.cloud.us.kontakt.io/entity-management.

## Specs

- openapi/kontaktio-device-management-openapi.yml (OpenAPI 3.0.0)
- openapi/kontaktio-location-occupancy-openapi.yml (OpenAPI 3.1.0)
- openapi/kontaktio-spaces-openapi.yml (OpenAPI 3.0.2)
- openapi/kontaktio-entity-management-openapi.yml (OpenAPI 3.0.1)

## Events

- [Streams introduction](https://developer.kontakt.io/docs/dev-ctr-loc-occ-api/07d6f990a7ca4-streams-introduction) — Telemetry, Position and Occupancy subscriptions pushed to AWS Kinesis, Azure Event Hub or IBM Watson. These are NOT HTTP webhooks; you must own the receiving stream. One subscription per type per company, five concurrent connections.
- asyncapi/kontaktio-streams-events.yml — the event catalog derived from the docs and spec. Kontakt.io publishes no AsyncAPI document.

## Runtime semantics

- [Pagination](https://developer.kontakt.io/docs/dev-ctr-device-api/a5e41de8f361f-pagination) — offset style: `startIndex`, `maxResult`, `orderBy`, `order`; `searchMeta` response envelope with `nextResults`/`prevResults` URLs.
- [Rate limits](https://developer.kontakt.io/docs/dev-ctr-device-api/4875408e160dc-rate-limits) — Device Management 60 req/s.
- [Rate limits](https://developer.kontakt.io/docs/dev-ctr-loc-occ-api/0519f6b37f233-rate-limits) — Location & Occupancy 40 req/s, historical endpoints 30 req/min, Streams 5 concurrent connections. 429 + `Retry-After` on exhaustion. No quota headers.
- [Responses and error codes](https://developer.kontakt.io/docs/dev-ctr-device-api/15d26022023bf-responses-and-error-codes) — custom `{message, errors[{field, error, invalidValue}]}` envelope. NOT RFC 9457. No 5xx declared in any spec.
- [Filtering](https://developer.kontakt.io/docs/dev-ctr-device-api/9792a18a42923-filtering)
- [Caching API calls](https://developer.kontakt.io/docs/dev-ctr-device-api/b08e0ba4a2a6f-caching-api-requests)
- No idempotency key exists on any write. Only `POST /order/claim` is documented as naturally idempotent.
- Reversal paths exist for configs, device access, external device imports, Meraki integrations, Portal Beam stitching, stream channels and subscriptions — but no time window is published for any of them. Batch entity import has no reversal at all.

## Changelogs

- [Device Management changelog](https://developer.kontakt.io/docs/dev-ctr-device-api/787c75c1e3d4a-changelog) — monthly, labelled Breaking change / Change / Deprecation / New / Cosmetic.
- [Location & Occupancy changelog](https://developer.kontakt.io/docs/dev-ctr-loc-occ-api/da742c3fd5f69-changelog)
- No deprecation policy page and no RFC 8594 Sunset/Deprecation header support.

## SDKs

- [iOS SDK](https://github.com/kontaktio/kontakt-ios-sdk) — Swift, 6.2.1 (2025-09-05), via SwiftPM/GitHub releases. The CocoaPods `KontaktSDK` pod is first-party but stale at 3.0.4 (2020-09-23).
- [Android SDK](https://github.com/kontaktio/kontakt-android-sdk) — Maven `io.kontakt.mvn:sdk` 7.2.22 (2025-06-16).
- No first-party server-side client library exists in any language.

## Agent surfaces

- MCP server: https://kontakt.io/wp-json/mcp/mcp-oauth-server — remote, OAuth-gated (scope `mcp`), discoverable via https://kontakt.io/.well-known/oauth-protected-resource and https://kontakt.io/.well-known/oauth-authorization-server. Anonymous `tools/list` returns 401, so the tool set is not public. Mounted on the marketing site, not on Kio Cloud.
- No A2A agent card is served on any Kontakt.io host.
- Mock servers (Stoplight Prism) are callable with any placeholder credential — see sandbox/kontaktio-sandbox.yml.

## Company

- [Website](https://kontakt.io/)
- [Developer Center](https://developer.kontakt.io/)
- [Support](https://support.kontakt.io/hc/en-gb)
- [Blog](https://kontakt.io/resources/content-hub/blog/)
- [Status](https://status.kontakt.io/) — Atlassian Statuspage with per-API components and a v2 API.
- [Trust Center](https://trust.kontakt.io/) — Vanta hosted.
- [Security](https://kontakt.io/legal-documents/security/) — SOC 2 Type II, HIPAA/HITECH, GDPR-aligned. No vulnerability disclosure program and no security.txt.
- [Terms of Sale and Service](https://kontakt.io/legal-documents/terms-of-sale-and-service/)
- [Privacy Policy](https://kontakt.io/legal-documents/privacy-policy/)
- [GitHub](https://github.com/kontaktio)
- No public pricing page; enterprise/quote only.