Built for agents, not just browsers.

The REST API and MCP server are live. Authenticate with an API key — created in your account under Settings → Developer — or with OAuth 2.1: Brollvia runs its own authorization server, which is how ChatGPT and Claude connectors sign in (no key pasting). Both credential kinds share the same scopes, plan quotas and licence receipts as the website. Errors use one envelope: {"error": {"code": "…", "message": "…"}}, and every response carries X-RateLimit-* headers.

REST API — endpoints

EndpointScopeWhat it does
GET /api/v1/searchreadSearch with all web filters (natural language is parsed). Cursor pagination via meta.next_cursor.
GET /api/v1/assets/curated · /assets/trendingreadCurated and most-downloaded lists.
GET /api/v1/assets/{id} · /assets/{id}/similarreadFull metadata and similar assets.
POST /api/v1/assets/{id}/downloaddownloadLicence-checked download → signed 15-minute URL + licence record. Plan rules enforced (caps, HD vs original, Pro library).
GET /api/v1/licences/{id}readLicence certificate data; add ?format=pdf for the PDF.
GET/POST /api/v1/collections · GET /collections/{id}read / collections:writeYour collections and shot lists.
POST /collections/{id}/assets · DELETE /collections/{id}/assets/{asset_id}collections:writeAdd or remove assets.
GET /api/v1/topics · /contributors/{id} · /me · /me/usagereadTopics, contributor stats, your account + plan, usage counters.

OpenAPI 3 spec (JSON) Join free, then get a key

Webhooks (v1.4)

Register an HTTPS endpoint in Settings → Developer → Webhooks (site admins can also register global ones) and Brollvia POSTs a signed JSON event when things happen to your assets. Events: asset.approved (your upload passed moderation), download.created (someone licensed one of your assets), payout.sent (a contributor payout was transferred to you). Deliveries retry up to 3 times with backoff via the cron queue and every attempt is logged on the Developer page.

Payload

POST /your-endpoint
X-Brollvia-Event: download.created
X-Brollvia-Delivery: 1234
X-Brollvia-Signature: sha256=9f86d0…

{
  "event": "download.created",
  "created_at": "2026-01-15T10:30:00Z",
  "data": {
    "asset_id": 42,
    "asset_title": "Rainy Tokyo alley",
    "licence_code": "BV-2026-XXXXXX",
    "plan": "Pro"
  }
}

Verify the signature (PHP)

$secret = "whsec_…"; // shown once when you add the webhook
$body = file_get_contents("php://input");
$expected = "sha256=" . hash_hmac("sha256", $body, $secret);
if (!hash_equals($expected, $_SERVER["HTTP_X_BROLLVIA_SIGNATURE"] ?? "")) {
    http_response_code(401); exit;
}
$event = json_decode($body, true);

Answer with any 2xx within ~10 seconds. Use the Test ping button on the Developer page to see a live webhook.test delivery. Keep the secret private — anyone holding it can forge events that look like ours.

The same call, four languages

cURL

curl "https://brollvia.com/api/v1/search?q=rainy+tokyo+alley+at+night&type=video" \
  -H "Authorization: Bearer bv_live_YOUR_KEY"

PHP

$ch = curl_init("https://brollvia.com/api/v1/search?q=ocean&type=video");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer bv_live_YOUR_KEY"],
]);
$data = json_decode(curl_exec($ch), true);
foreach ($data["data"] as $asset) echo $asset["title"], "\n";

JavaScript

const res = await fetch("https://brollvia.com/api/v1/search?q=ocean&type=video", {
  headers: { Authorization: "Bearer bv_live_YOUR_KEY" },
});
const { data, meta } = await res.json();

Python

import requests
r = requests.get("https://brollvia.com/api/v1/search",
                 params={"q": "ocean", "type": "video"},
                 headers={"Authorization": "Bearer bv_live_YOUR_KEY"})
for asset in r.json()["data"]:
    print(asset["id"], asset["title"])

MCP server — connect your assistant

Server URL: https://brollvia.com/mcp · Streamable HTTP, stateless — no local install, no daemon. Discovery: https://brollvia.com/.well-known/mcp

ChatGPT

  1. Settings → Connectors → Add custom MCP server, name it Brollvia.
  2. Server URL: https://brollvia.com/mcp
  3. Authentication: OAuth — ChatGPT discovers our OAuth endpoints automatically and sends you here to sign in and approve. No key to paste.

Claude

  1. Settings → Connectors → Add custom connector.
  2. Remote MCP server URL: https://brollvia.com/mcp
  3. Connect with OAuth — you'll approve the requested scopes on this site, and can revoke any time under Connected apps in your Developer settings.

Cursor / Claude Code (API key)

{
  "mcpServers": {
    "brollvia": {
      "url": "https://brollvia.com/mcp",
      "headers": { "Authorization": "Bearer bv_live_YOUR_KEY" }
    }
  }
}

Config-file clients send a static header, so they use an API key. Your account page generates this config with a fresh key filled in.

OAuth 2.1 endpoints

Protected resource metadata: https://brollvia.com/.well-known/oauth-protected-resource
Authorization server metadata: https://brollvia.com/.well-known/oauth-authorization-server
Dynamic client registration: POST https://brollvia.com/oauth/register · Authorize: https://brollvia.com/oauth/authorize · Token: POST https://brollvia.com/oauth/token

Authorization code flow with PKCE (S256) is required; access tokens are opaque, expire after 1 hour, and refresh tokens rotate (reuse revokes the chain). Scopes: read, download, collections:write.

Tools the model can call

search_assets get_asset find_similar list_collections get_collection create_shotlist add_to_shotlist download_asset get_licence suggest_broll_for_script Pro get_trending list_topics

Scopes gate tools just like endpoints; plan gating is identical to the web — a Free account can search everything but downloads follow Free rules, and suggest_broll_for_script needs Pro. Every call is audit-logged against the credential (key or connected app) and visible in your Developer page usage.

SDKs (v1.6)

Thin, dependency-light wrappers over the REST API — the same licence-checked download flow, plan quotas and error envelope, without hand-rolling HTTP. Both SDKs are versioned with the site (SDK 1.6.0, API v1) and are free to use in your projects.

Download the JavaScript SDK (.zip) Download the Python SDK (.zip)

JavaScript — brollvia.mjs (ESM, Node 18+)

import { BrollviaClient } from "./brollvia.mjs";

const bv = new BrollviaClient({
  baseUrl: "https://brollvia.com",
  apiKey: "bv_live_YOUR_KEY",
});

const { assets } = await bv.search({ q: "ocean at dawn", type: "video" });
const saved = await bv.download(assets[0].id, { to: "./shot.mp4" });
console.log(saved.path, saved.licence.code); // licence record included

Python — stdlib only (urllib)

from brollvia import BrollviaClient

bv = BrollviaClient(base_url="https://brollvia.com",
                    api_key="bv_live_YOUR_KEY")

res = bv.search(q="ocean at dawn", type="video")
saved = bv.download(res["assets"][0]["id"], to="./shot.mp4")
print(saved["path"], saved["licence"]["code"])

Writes from the SDKs (collections) need a key with the collections:write scope; downloads need download. Keys are scoped, quota'd and revocable — create and manage them under Settings → Developer. Editing inside Premiere Pro or DaVinci Resolve? See the editor panels. Building an agent or app on Brollvia? List it in the agent gallery.

Licences an agent can prove.

Every download — by a person, a script or a model — writes the same licence record with the asset hash and timestamp. When a client asks “are we cleared to use this shot?”, the answer is a certificate, not a shrug.