WHIP protocol

TiRTC WHIP is based on IETF RFC 9725. The current integration uses non-trickle ICE: the device exchanges complete SDP in one HTTP POST and then carries media over WebRTC.

Create a resource:

POST /whip HTTP/1.1
Authorization: Bearer <token>
Content-Type: application/sdp

<SDP Offer>

Successful response:

HTTP/1.1 201 Created
Content-Type: application/sdp
Location: /resource/4f57...

<SDP Answer>

Location must uniquely identify the session. A relative URI works well behind an ingress proxy.

End a session with DELETE <Location>. The request does not carry Authorization. Generate the session-id with at least 128 bits of cryptographic randomness and never include a device ID or another predictable value. Return 204 No Content whether the resource was just removed or was already absent.

Treat the random ID as a bearer capability: keep it out of routine access logs and rate-limit the endpoint. Use HTTP or HTTPS according to device capabilities. With HTTP, tokens and random IDs are not protected by transport encryption; enable it only when required by the device and the network path is controlled. The service must also clean up when the TiRTC connection disconnects, even if the device sends no DELETE.

Capability	Status
SDP Offer/Answer over POST	Supported
Location session resource	Supported
Session termination with DELETE	Implement in the service
Trickle ICE / PATCH	Not currently supported
ICE, DTLS, and SRTP	Handled by the TiRTC SDK

Use 201, 400, 401, 403, 405, 415, and 500 according to standard HTTP semantics. Never expose keys, tokens, internal addresses, or stack traces in error bodies.