Uniview LAPI Research Toolkit

Standalone command-line toolkit for authorized research against Uniview and OEM devices that expose /LAPI/... HTTP endpoints.

This toolkit was extracted from Digital Ally ThermoVu DTM-600 research and generalized so it can be released separately. It is not limited to the DTM-600, but endpoint availability varies by model, firmware branch, license, and OEM branding.

What It Contains

• lapi_toolkit.py - generic LAPI endpoint browser and request client.
• profiles/generic-uniview.json - baseline endpoint profile for common Uniview/OEM LAPI surfaces.
• profiles/dtm600-validated.json - small validation profile for the Digital Ally ThermoVu DTM-600 / Uniview OET-213H-NB research target.
• tests/test_lapi_toolkit.py - offline checks for profile loading and write-safety behavior.
• requirements.txt - Python dependency list.

Safety Model

The toolkit defaults to safe behavior:

• No hard-coded target address.
• No hard-coded default credentials.
• GET requests work by default.
• POST, PUT, and DELETE require --allow-write.
• High-risk write endpoints require both --allow-write and --yes.
• The default read audit only requests endpoints with risk <= 1.

Risk values are encoded in the profile:

• 0 - passive identification
• 1 - low-risk read
• 2 - sensitive read or diagnostic action
• 3 - configuration change or service exposure
• 4 - destructive or physical/security-impacting action

Install

python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install -r requirements.txt

Usage

List bundled profiles:

python3 lapi_toolkit.py profiles

List low-risk endpoints:

python3 lapi_toolkit.py list --max-risk 1

Fingerprint an authorized target:

python3 lapi_toolkit.py fingerprint -t 192.0.2.10 -u admin --prompt-password

Call a known endpoint:

python3 lapi_toolkit.py call -t 192.0.2.10 system.device_basic_info

Call a raw endpoint path:

python3 lapi_toolkit.py call -t 192.0.2.10 /LAPI/V1.0/System/DeviceBasicInfo

Run a read-only audit of low-risk endpoints:

python3 lapi_toolkit.py audit-read -t 192.0.2.10 --max-risk 1

Run a write request only when explicitly authorized:

python3 lapi_toolkit.py call -t 192.0.2.10 debug.telnet \
  --method PUT \
  --data '{"Enable": 0}' \
  --allow-write \
  --yes

Profile Format

Profiles are JSON files with an endpoints array. Each endpoint has:

• id - stable command-line identifier.
• path - LAPI HTTP path.
• methods - allowed HTTP methods.
• category - grouping used by list and audit-read.
• description - short operator-facing description.
• risk - risk value from 0 to 4.

Use a custom profile by passing either a bundled profile name or a file path:

python3 lapi_toolkit.py --profile ./my-device.json list

Scope

Use only on devices and networks where you have authorization. LAPI endpoints can expose configuration, credentials, biometric/access-control metadata, camera media, debug toggles, firmware update paths, and physical relay actions.

The dtm600-validated profile documents the original research target. The generic-uniview profile is a starting point for other Uniview/OEM devices, not a guarantee that every endpoint exists everywhere.