APIBridge Metro

WPF Operator Console for Genetec Security Center
Complete User Manual
Version 0.9.0.0
June 2026
WINK Streaming
Authorized Partner of Genetec Inc.

Table of Contents

Downloads for this release:
Combined Installer (Metro + Console, v0.9.0.0) users.json template USERS-JSON-README.txt WINKSCData Console Manual
WINK-SecurityCenterTools-Setup-0.9.0.0.exe contains both the APIBridge Metro GUI and the WINKSCData console — pick the components you want during setup. For deployment questions email support@wink.co.

What's New in 0.9 v0.9.0.0

Version 0.9 is the largest functional release of APIBridge Metro since the original public build. It introduces a shared credentials file, a combined installer that bundles the GUI and the headless console, a dynamic SDK version display, and an entire new family of Decoder Tools views that move the product from a "browse and rename" utility into an end-to-end commissioning and routing-repair console.

New features

Bug fixes

Compatibility

v0.9 is a fresh install on top of the previous v0.7 builds — there is no in-place upgrade from the standalone console-only installer of earlier releases. The user-edited users.json and the DPAPI-encrypted Windows Service settings are not destroyed by uninstall, so re-installing v0.9 in a different folder preserves both.

1. Introduction

APIBridge Metro is the WPF graphical operator console for the WINK Streaming Security Center toolset. It connects to Genetec Security Center over the official Genetec SDK and gives operators and integrators a single console for browsing entities, fixing decoder/camera bindings, syncing monitor names, exporting Forge XML for downstream WINK products, and configuring an optional WINKSCDataMonitor Windows Service for unattended change-notification.

This manual is written for operators and integrators who already understand Genetec Security Center concepts (cameras, video units, analog monitors, partitions, the SDK login flow) but need a concrete walk-through of how APIBridge Metro fits in. If you are new to Security Center, work through sections 1–8 in order: the Genetec configuration material in section 6 is the prerequisite for everything that follows.

Conventions Used in This Manual

2. Product Overview

Key Capabilities

Target Audience

APIBridge Metro is designed for:

Version Information

ComponentVersion
APIBridge Metro0.9.0.0
WINKSCData (console sibling)0.9.0.0
Target framework.NET Framework 4.8
Genetec SDK shipped with GUI build5.11.x
Genetec SDK shipped with Console build5.9.x
Supported Security Center server versions5.9, 5.10, 5.11, 5.11.3, 5.12

3. Package Architecture

The WINK Security Center Tools package is intentionally structured as two cooperating applications that share state through three contracts:

  1. A shared users.json credentials file (per-user or portable).
  2. A shared Forge XML output format — byte-for-byte identical between GUI Export XML and console --forge.
  3. A shared set of Genetec SDK action calls for routing writes (DisplayOnAnalogMonitor, RemoveFromAnalogMonitor, name changes).
ApplicationAudienceSDK shippedUse case
APIBridge MetroOperators and integrators5.11Interactive browse, fix, rename, configure the Service.
WINKSCData (console)Scripted / scheduled-task / CI use5.9Headless --forge, --comparenames, --applyassociations, --reassociate.
WINKSCDataMonitor (service)Unattended deployments(uses console's 5.9 SDK)Scheduled Forge export every 20 minutes, diff vs previous, email or HTTP POST on change.

The two applications can run simultaneously on the same machine — each opens its own SDK session — and they do not share JSONL caches. The console writes to its current working directory; the GUI writes to %USERPROFILE%\Documents. This intentional separation prevents a long-running console job from invalidating a cache the GUI is reading mid-operation.

Why separate SDK versions? SDK 5.9 supports the broadest range of Security Center server versions; SDK 5.11 adds the Area.AnalogMonitors / Area.AddAnalogMonitor APIs that the Organize Areas view depends on. Splitting the two applications across the two SDK versions lets the console keep working against legacy 5.9 servers while the GUI gets the modern Area APIs against current 5.11+ deployments.

4. System Requirements

Minimum Requirements

ComponentMinimumNotes
Operating systemWindows 10 1809 (build 17763), x64Windows Server 2019 and newer also supported; older OS is no longer tested.
.NET Framework4.8Pre-installed on Windows 10 1809+ and all Windows 11. Older OS needs the Microsoft redistributable.
Visual C++ 2019/2022 Redistributable (x64)LatestRequired by the CefSharp browser embedded in the GUI's snapshot viewer. The installer does not yet chain it.
Disk~350 MBGUI + console + dependencies. JSONL caches and Forge XML in Documents can grow large.
Memory2 GB freeHigher recommended on deployments exceeding 1,000 monitors.
CPUAny x64 dual-coreBulk operations are I/O-bound on the SDK, not CPU-bound.
NetworkTCP 5500 to Security Center serverDefault Genetec SDK port. Extract Archive State also needs TCP 5602.

Recommended for Production

Genetec Security Center Requirements

The Genetec SDK is not required as a separate install. All required Genetec SDK assemblies ship inside the combined installer (SDK 5.11 next to the GUI, SDK 5.9 next to the console). You do not need to download or license the SDK separately. You do need an SDK-enabled Genetec account on the server you are connecting to.

5. Installation Guide

5.1 Combined Installer

Prerequisites

  1. Ensure system requirements (section 4) are met on the target machine.
  2. Obtain administrator privileges on the target machine — the installer needs to write into C:\Program Files and (optionally) register a Windows Service.
  3. Verify network connectivity to the Security Center server: Test-NetConnection -ComputerName <sc-host> -Port 5500 should succeed.
  4. Have the SDK account credentials handy (you'll save them via Save Credentials on first launch).

Installation Steps

  1. Download WINK-SecurityCenterTools-Setup-0.9.0.0.exe from the link at the top of this page (or from wink.co/binaries/).
  2. Right-click → Run as administrator.
  3. Accept the license agreement.
  4. Choose installation directory (default C:\Program Files\WINKStreaming\SecurityCenterTools).
  5. On the Select Components page, tick the apps you want:
    • APIBridge.Metro GUI (Genetec SDK 5.11) — the WPF application this manual covers.
    • WINKSCData console (Genetec SDK 5.9, --forge) — the command-line tool.
    Both are typically installed together; you can install just one if your role only needs one side.
  6. Tick Create a desktop icon if appropriate.
  7. Click Install.
  8. At the end of installation a dialog reminds you about users.json — see section 7.

Post-Installation Verification

  1. Launch APIBridge Metro from the Start menu or desktop shortcut.
  2. Confirm the top-right header shows the application version (Version 0.9.0.0) and the loaded SDK version (e.g. SDK 5.11.0.0).
  3. Open the Settings tab and verify the assembly version, file path, and build date are populated.
  4. Review the Activity Log panel at the bottom — it should show APIBridge.Metro v0.9.0.0 starting up and an SDK initialization line.
  5. Run the Connectivity & Permissions verification (section 8.2) against your Security Center server.

5.2 Files Installed

C:\Program Files\WINKStreaming\SecurityCenterTools\
├── Metro\
│   ├── APIBridge.Metro.exe
│   ├── APIBridge.Metro.exe.config
│   ├── users.json                 (blank by default)
│   ├── Genetec.Sdk.dll            (5.11.x)
│   ├── MahApps.Metro.dll
│   ├── CefSharp.*.dll             (snapshot viewer)
│   └── ... ~315 supporting files
├── Console\
│   ├── WINKSCData.exe
│   ├── WINKSCData.exe.config
│   ├── users.json                 (blank by default)
│   ├── Genetec.Sdk.dll            (5.9.x)
│   └── ... ~155 supporting files
└── USERS-JSON-README.txt

5.3 Genetec SDK Notes

Two distinct Genetec SDK assemblies ship inside the installer — one next to the GUI (SDK 5.11) and one next to the console (SDK 5.9). They cannot share an install folder because Genetec.Sdk.dll is loaded by name from the same directory as the EXE.

This split exists for a reason:

If you connect the GUI to a Security Center 5.9 server, everything except the Organize Areas view works; the Areas view is automatically hidden in that case to avoid confusion.

5.4 Uninstall

Standard Add or Remove Programs entry: WINK Streaming — Security Center Tools 0.9.0.0. Uninstall preserves:

The installed WINKSCDataMonitor service, if present, is stopped and removed during uninstall via sc.exe delete.

6. Genetec Security Center Configuration

Before APIBridge Metro can connect to your Security Center server, three things have to be in place on the Genetec side: an SDK-enabled user account, the right privileges on that account's role, and (optionally but strongly recommended) a partition that scopes what the SDK user can see and modify. This section walks through each step in Config Tool, screenshot by screenshot.

6.1 Creating the SDK User

APIBridge Metro requires a dedicated SDK user account. Do not reuse a Security Desk operator account or an administrative account for SDK access — a dedicated account makes the audit trail clean, lets you rotate the SDK password independently, and lets you revoke SDK access without disrupting normal operations.

Step 1: Open Config Tool

  1. Launch Genetec Config Tool on (or connected to) your Security Center server.
  2. Log in with administrator credentials — you'll need privileges to create users and modify roles.
  3. Navigate to the User Management task.

Step 2: Create the New User

  1. Click Add an entity → User (or right-click in the user tree and select New user).
  2. Enter the following information:
    • Username: winkSDK (recommended) or a name consistent with your organization's conventions.
    • First name: WINK
    • Last name: SDK User
    • Password: Set a strong, unique password. Do not reuse a personal password — this credential will eventually live in users.json in plain text.
    • Email: Optional. Useful for receiving Genetec lockout notifications.
  3. Enable the User can log on using the SDK option. This is the gate — without it, every other privilege is irrelevant.
  4. Set Password never expires if appropriate for your security policy. If your policy enforces rotation, plan to update users.json at the same time the SDK password rotates.
  5. Click Apply.
Creating SDK User in Config Tool
Figure 6.1 — Creating the winkSDK user in Genetec Config Tool. The "User can log on using the SDK" checkbox is the most important field on this dialog.
Naming note: The username "winkSDK" is recommended for clarity but not required. Whatever you choose, document it in your inventory so the person rotating SDK passwords in five years knows which user is the integration account.

Step 3: Verify the Account

Before granting privileges, verify the account itself is usable:

  1. From a Windows host with network reach to the Security Center server, open APIBridge Metro.
  2. Navigate to Setup → Connect to Security Center.
  3. Enter hostname, the new winkSDK username, and the password you set.
  4. Click Test Connection.

At this stage the test should succeed at the connection level but the next sections (browse, decoders, etc.) will be empty because no privileges are granted yet. That is the correct state — proceed to section 6.2.

6.2 Configuring Permissions

The SDK user inherits privileges from its assigned role. The simplest production pattern is to create a dedicated role (e.g. WINK SDK Role) and add the winkSDK user to it, so privilege adjustments do not need to be re-applied per-user as your team scales.

Required Privileges

Permission CategorySpecific PermissionPurpose
GeneralLog on using the SDKRequired for SDK authentication. Without this, nothing else works.
EntitiesView all entity typesAccess cameras, monitors, video units, areas, partitions.
VideoView video unitsRequired for IP and MAC address retrieval. Blank IP/MAC in exports almost always indicates this is missing.
VideoView camerasList and inspect cameras (model, resolution, codec, GPS).
VideoView analog monitorsAccess decoder information. Required for everything in the Decoder Tools section.
VideoModify analog monitor propertiesUpdate monitor Name and Description. Required for Associate Monitors, Sync Decoder Names, Bulk CSV Association.
HardwareView hardware configurationAccess IP and MAC addresses on Video Units. This is the privilege most often missing on restricted SDK accounts.
ActionsDisplay camera on analog monitorRequired for Apply Associations, Reassociate Unit, Bulk CSV Association write paths.
ActionsRemove camera from analog monitorRequired for Reassociate Unit and the "Reassociate" buttons in Apply Associations.
PartitionsAdd member to partitionRequired only for the Add to Partition view.
Custom FieldsView custom fieldsRequired only if you rely on custom attributes in the Forge XML output.
GeographicView geographical locationsRequired for GPS coordinates on map-aware cameras.

Setting Permissions

  1. In Config Tool, navigate to User Management → Roles (or open the role assigned to your winkSDK user).
  2. Open the Privileges tab.
  3. Enable each required permission by checking the appropriate boxes from the table above.
  4. Pay special attention to these often-overlooked toggles:
    • View role properties
    • View role resources
    • View access control unit properties
    • Modify ALPR unit properties (only if you use ALPR cameras)
  5. Click Apply.
  6. Switch to the Resources tab to confirm which entities the role can act on; if you are using partitions (section 6.3) restrict the role's resources to the WINK partition.
Role Permissions Configuration
Figure 6.2 — Configuring role privileges for the SDK user. Use the tree on the left to navigate into Video, Hardware, and Actions categories.
Unit Permissions
Figure 6.3 — Unit-level privileges. "View hardware configuration" on Video Units is the most commonly missing privilege.
Additional Unit Permissions
Figure 6.4 — Additional unit-level privileges to grant for full Decoder Tools functionality.
Camera Permissions
Figure 6.5 — Camera units and cameras privileges. View privileges are read-only; Modify is required for the rename operations.
SDK Privileges
Figure 6.6 — SDK-specific privileges. "Log on using the SDK" is the gate — every other privilege is irrelevant without it.

Verification

Once privileges are applied, re-run APIBridge Metro's Connectivity & Permissions verification (section 8.2). The tool will tell you, per privilege, what the SDK user can and cannot see, which is far faster than guessing from a partial export.

Warning: Insufficient privileges produce silent partial data, not loud errors. If IP addresses appear blank in exports, verify View hardware configuration. If decoder counts come back zero, verify View analog monitors. If the apply-associations write fails with "Permission denied", verify Display camera on analog monitor.

6.3 Setting Up Partitions

For production deployments we strongly recommend creating a dedicated partition for the WINK SDK user. Partitions scope what entities a user can see and act on, and they are the right way to limit blast radius if the SDK credentials are ever compromised or misconfigured.

Creating a Partition

  1. In Config Tool, navigate to System → Partitions.
  2. Click Add Partition (or right-click → New partition).
  3. Configure the partition:
    • Name: winkStreaming
    • Description: WINK Streaming SDK access — scope for APIBridge Metro and WINKSCData
    • Parent partition: Select the appropriate parent (typically the system root or your top-level operational partition).
  4. Save the partition.

Assigning the SDK User to the Partition

  1. Select the winkSDK user.
  2. Navigate to the Partitions tab on the user (or on the user's role).
  3. Add the winkStreaming partition to the user's accessible partitions.
  4. Set appropriate permission levels within the partition (typically Accepted for everything you want the SDK user to manage).
Create Partition
Figure 6.7 — Creating the winkStreaming partition in Config Tool.

Populating the Partition

The partition is empty by default. Move the entities the SDK user should manage into it:

Add Entities to Partition
Figure 6.8 — Adding entities to the winkStreaming partition. The two-list editor mirrors the same pattern as APIBridge Metro's Add to Partition view.

Partition Benefits

Note: Partition configuration is optional but recommended for production. In dev/test environments you may grant access to the root partition for simplicity, but document the intent — "production deployment uses partition winkStreaming" — so it does not get lost during a future audit.

6.4 Configuring Analog Monitors

If you are using analog monitors (virtual decoders, in Genetec parlance), the way you name them in Security Center directly affects how every Decoder Tools view in APIBridge Metro behaves. This section covers the conventions APIBridge Metro is designed around.

Creating Analog Monitors

Analog monitors are created against a Video Unit (archiver) in Config Tool. Each monitor represents one "decoder slot" the archiver can route a camera to.

Create Analog Monitors
Figure 6.9 — Creating analog monitors in Security Center. The UDP port allocated here is the same port APIBridge Metro shows in the List Decoders grid.

Naming Convention

APIBridge Metro's Associate Monitors Evenly, Sync Decoder Names, and Bulk CSV Association views all assume a structured naming convention. The reference pattern used throughout the WINK Forge ecosystem is:

WF###

Where ### is a zero-padded three-digit number (WF001, WF002, … WF999). After APIBridge Metro associates a camera with a monitor, the monitor name takes the canonical form:

{CameraName} - {WF###}-{UdpPort}

For example: Front Entrance - WF301-8001 where 8001 is the monitor's UDP port.

This convention has three benefits:

  1. It is parseable. The trailing WF###-{port} fragment lets the console's --applyassociations mode and the GUI's Apply Associations view rediscover the intended routing from the monitor name alone, even after a routing wipe.
  2. It is human-readable. Operators in Security Desk see a name that tells them both the camera and the destination slot at a glance.
  3. It is sortable. Sorting by name in any list view groups monitors by destination slot.
Monitor Naming Examples
Figure 6.10 — Analog monitor naming convention examples. Note the WF prefix, three-digit slot number, and trailing UDP port.

Renaming Monitors via APIBridge Metro

When you trigger a rename operation in APIBridge Metro (for example via Sync Decoder Names or Associate Monitors Evenly), Security Center may prompt to rename related devices if the monitor is part of a multi-decoder unit. The dialog looks like this:

Rename Confirmation
Figure 6.11 — Confirmation dialog when renaming related devices. Accept this to keep names consistent across the unit.

After the operation completes, the monitor list reflects the new names immediately:

Rename Results
Figure 6.12 — Results after renaming. The monitor's previous name is preserved in the Description field with an "Original:" marker, so the audit trail is never lost.
Description preservation: All rename operations in APIBridge Metro preserve the prior monitor name in the Description field, prefixed with Original:. This means you can always recover the historical name without consulting an external log.

UDP Port Assignment

By convention, monitor UDP ports are assigned sequentially starting at a base (commonly 15000 or 8000) per Video Unit. The deterministic ordering used by Bulk CSV Association is (IP, UDP) ascending — so when CSV input cameras are paired with empty monitors, they go to the lowest-numbered free slot on the lowest-IP unit first. If you want a different ordering, sort the CSV before loading it.

7. Credentials: users.json

Both APIBridge Metro and the WINKSCData console can read a users.json file at startup so operators do not have to retype host, username, and password every launch. The file is shared between the two applications — write it once via the GUI and the console uses it next time you run a scripted job.

7.1 Search Order

The file is searched for in two locations, first match wins:

  1. Same folder as the EXE (portable mode) — useful for per-deployment or USB-stick installs:
    • {install}\Metro\users.json
    • {install}\Console\users.json
  2. Per-user: %APPDATA%\WINKStreaming\users.json — shared by both apps; this is the path the GUI's Save Credentials button writes to.

The two locations are independent. A portable users.json next to the EXE wins over the per-user one — useful when you want to override a saved per-user credential for a specific deployment without disturbing the operator's saved login.

7.2 Schema

{
  "host": "10.18.183.20",
  "username": "YOUR_SDK_USER",
  "password": "YOUR_PASSWORD",
  "useDemoCertificate": false
}
FieldTypeNotes
hoststringIP or DNS name of the Genetec Security Center server.
usernamestringSDK-enabled account (must have Log on using the SDK privilege).
passwordstringPlain text password.
useDemoCertificatebooleantrue for the Genetec demo certificate, false for production.

A blank template ships in this package and in the installer's USERS-JSON-README.txt.

7.3 Saving Credentials from the GUI

  1. Open APIBridge Metro.
  2. Navigate to Setup → Connect to Security Center.
  3. Fill in Hostname, Username, Password, and the Use Demo Certificate checkbox if applicable.
  4. Click Save Credentials.

The credentials are written to %APPDATA%\WINKStreaming\users.json. The current source path is shown under the buttons as Credentials source: <path> so you always know where the prefilled values came from. On the next launch the fields are pre-filled automatically.

7.4 Console Credential Precedence

The console always honors command-line arguments first; users.json only fills in whatever was not passed on the command line. This preserves scripted use — a scheduled job can override a saved credential without disturbing the file.

Command lineusers.jsonEffective values
-h X -u Y -p Z (all three)(anything)Uses CLI values; --democert only if passed.
-h X onlyhas username, password, useDemoCertificateUses CLI host + file user / pass / cert.
(none)completeUses file values.
(none)emptyConsole exits with code 2 and prints the schema example.

7.5 Security

users.json stores credentials in plain text. It inherits NTFS permissions from %APPDATA%, which is per-user by default on standard Windows installations — that is, by default another standard user on the same machine cannot read it, but anyone with administrative privileges can.

If stronger protection is required:

Important: users.json is plain text by design. It is convenient for operators but is not a replacement for DPAPI-encrypted storage in production unattended deployments. The Windows Service uses DPAPI; if you need DPAPI for interactive use, do not save credentials.

8. Getting Started

8.1 First Launch

On first launch, APIBridge Metro presents the main interface with the following components:

Initial Setup Checklist

  1. Verify the loaded Genetec SDK version in the top-right header matches the SDK build you installed (5.11 for the Metro GUI).
  2. Ensure you have Security Center connection details ready:
    • Server hostname or IP address
    • SDK username and password (from section 6.1)
    • Port number (default 5500 — not configurable in the GUI, change only if your Security Center server uses a non-default SDK port)
  3. Confirm network connectivity to the Security Center server: Test-NetConnection -ComputerName <sc-host> -Port 5500.
  4. Review any banner shown at the top of the Connect view — it surfaces SDK initialization warnings and helps catch DLL-blocking issues from downloaded files.
Do not proceed with a write operation (Apply Associations, Bulk CSV Association, Sync Decoder Names) until you have verified all prerequisites and the Connectivity & Permissions check (section 8.2) returns clean.

8.2 Connectivity & Permissions Verification

Before attempting to connect and perform operations, use the Connectivity & Permissions view to ensure the environment is correctly configured. This single view diagnoses 90 % of new-deployment issues before they become support tickets.

Connectivity and Permissions view — v0.9.0.0
Figure 8.1 — Connectivity & Permissions verification view (v0.9.0.0). The top-right pill shows Version 0.9.0.0 and the loaded SDK 5.11.0.0.

Running Connectivity Verification

  1. Click Connectivity & Permissions in the Navigation panel.
  2. Enter your connection details:
    • Server Address: Security Center server hostname or IP.
    • Username: the SDK user (e.g. winkSDK).
    • Password: the SDK user's password.
    • SDK Version: usually leave at auto-detected; override only if you need to force 5.9 vs 5.12 query patterns.
    • Use Domain Authentication: check if your environment uses Windows authentication for SDK access.
    • Use Demo Certificate: check only for dev/test against the Genetec demo cert.
  3. Click Test System (top-right) or Run Verification.
  4. Review the results in the panels that appear (Connection Information, Permission Check Results).
Permission check results
Figure 8.2 — Permission Check Results panel. Basic Permissions are the read privileges; Advanced Permissions cover hardware visibility and entity-type access. Each red X maps to a specific Genetec privilege in section 6.2.

Understanding the Results

Test ItemExpected ResultIf Failed
Connection StatusConnectedCheck server address, network, firewall, port 5500.
View CamerasPermittedGrant View cameras on the SDK user's role.
View Analog MonitorsPermittedGrant View analog monitors. Without it, every Decoder Tools view returns empty.
View Video UnitsPermittedCritical for IP addresses — grant View video units.
View Hardware ConfigurationPermittedRequired for MAC addresses and unit IP retrieval.
Modify Analog MonitorPermittedRequired for monitor association and rename operations.
View All Entity TypesPermittedCovers Areas, Partitions, custom entities used in advanced views.
Warning: If View Video Units is missing, IP addresses come back blank in exports and the List Decoders grid. This is the single most common partial-data scenario on restricted SDK accounts. Fix it before reporting "the export looks empty".

Re-running After Permission Changes

If you adjust privileges in Config Tool after a failed verification, you do not need to restart APIBridge Metro. Click Run Verification again — the SDK rechecks privileges live on the existing session.

8.3 Connecting to Security Center

After verifying connectivity, proceed to the Connect view to establish a full session that the rest of the application can use.

Connect to Security Center Tab
Figure 8.3 — Connect to Security Center. The Save Credentials button (new in v0.9) writes the current fields to %APPDATA%\WINKStreaming\users.json.

Connection Process

  1. Navigate to Setup → Connect to Security Center.
  2. If you have already saved credentials, the fields are pre-filled — the source path is shown under the buttons.
  3. Otherwise enter:
    • Hostname or IP: your Security Center server
    • Username: SDK user credentials
    • Password: SDK user password
    • Use Demo Certificate: only for dev/test environments
  4. Click Test Connection to verify reachability without a full LogOn (optional).
  5. Click Connect to establish the session.
  6. Monitor the Activity Log for connection status — you should see Connecting to <host>:5500… followed by Connected as <user>.
  7. Optional: click Save Credentials to write the current fields to %APPDATA%\WINKStreaming\users.json.

Connection States

Troubleshooting Connection Issues

Error MessagePossible CauseSolution
InvalidCredentialWrong username or passwordVerify in Config Tool. Try once without a domain prefix.
NetworkErrorCannot reach serverCheck network reachability and firewall on port 5500.
SDKNotFoundGenetec SDK assemblies missing or blockedVerify Genetec.Sdk.dll is present next to the EXE; right-click → Properties → Unblock if downloaded.
CertificateErrorLicense or certificate issueVerify the SDK license on the server; contact WINK support if persistent.
DeniedByFirewallSC 5.11.3 per-second LogOn throttleWait 5 minutes; the throttle clears on its own. The tool retries automatically with backoff.
Note: In debug builds, an additional "Use Demo License" checkbox appears for development purposes. This is not exposed in production builds.

9. Browse Views

The four Browse views are read-only — no writes happen here. Use them to inventory the deployment, validate SDK privileges, and identify discrepancies before touching anything with the Decoder Tools.

9.1 List Cameras

The List Cameras view provides a comprehensive grid of all cameras in your Security Center deployment that the SDK user has visibility into.

List Cameras Tab
Figure 9.1 — List Cameras grid. Click column headers to sort; type in the search box to filter rows.

Available Information

Features

Usage Tips

9.2 List Decoders

The List Decoders view displays every analog monitor (virtual decoder) the SDK user can see, with its current camera binding and the parent video unit's network identity.

List Decoders Tab
Figure 9.2 — List Decoders. Each row corresponds to one analog monitor; the Connected Camera column shows what is currently routed to that slot.

Decoder Information

FieldDescription
Monitor NameDisplay name of the analog monitor. Follows the canonical {Camera} - WF###-{port} pattern after Sync Decoder Names runs.
UDP PortNetwork port for the video stream destined to this slot.
Video UnitParent archiver name.
IP AddressNetwork address of the parent video unit (blank if the SDK user lacks View hardware configuration).
MAC AddressHardware address of the parent video unit (same privilege requirement).
Connected CameraCurrently routed camera, or blank for unconnected slots.
StatusOnline / Offline.
Running StateSDK-reported runtime state of the decoder.
Signal StateCurrent signal state (useful for spotting decoders with stuck streams).

Common Use Cases

Note: Blank IP/MAC addresses almost always mean the SDK user lacks View hardware configuration on the Video Unit. Run the Connectivity & Permissions verification to confirm before opening a support case.

9.3 List All Entities

The List All Entities view provides a mixed-entity grid for ad-hoc exploration. Use it when you suspect an entity exists but cannot find it in any of the typed views (cameras, monitors, etc.) — it surfaces orphaned and atypical entities other views filter out.

List Entities Tab
Figure 9.3 — List All Entities. The mixed grid is the fastest way to spot orphaned, misclassified, or otherwise unusual entities.

Entity Types Surfaced

Entity Details

For each entity, the following information is available:

Navigation

9.4 Review Data

The Review Data view provides a tabbed at-a-glance summary across Cameras, Monitors, and Associations. Use it as the single page to validate a deployment before signing off, or to brief a stakeholder on the current state without making them navigate three separate views.

Review Data Tab
Figure 9.4 — Review Data tabbed summary. Each tab shows count + key configuration details.

Review Sections

Cameras Tab

Monitors Tab

Associations Tab

Validation Use Cases

Use this view to:

10. Decoder Tools

Decoder Tools is the operational heart of APIBridge Metro. Every view in this section can modify Security Center configuration. The tab order below mirrors the navigation menu, and the views are grouped roughly by intent: naming → routing → reconciliation → housekeeping.

10.1 Associate Monitors Evenly

Associate Monitors Tab
Figure 10.1 — Associate Monitors Evenly. Preview shows the proposed distribution before any name is written.

Rename-only workflow. Distributes a set of cameras across a set of decoders by name pattern (the WF### convention) and writes the planned name into each AnalogMonitor's Name field. Does NOT actually route video — it just updates the names so an administrator can match them up manually in Security Desk, or so the console's --applyassociations mode (or the GUI's Apply Associations view) can later push the routing.

How It Works

  1. Load current configuration — retrieves all cameras and monitors from the SDK.
  2. Calculate distribution — evenly distributes cameras across the set of decoders matching WF###.
  3. Preview changes — shows proposed monitor → camera pairs before any write.
  4. Apply updates — writes new names to AnalogMonitor.Name and preserves the previous value in Description.

Association Steps

StepActionResult
1Click Preview AssociationsSee the proposed distribution table.
2Review assignmentsVerify each camera/monitor pair is sensible.
3Enable Only WF-prefixed (if needed)Filter to monitors matching the canonical pattern only.
4Click Apply AssociationsUpdates monitor names; original names preserved in Description.

Important Limitations

Rename-only: This view does not route video. It updates names so an operator can match them up in Security Desk, or so Apply Associations can pick up the intent later. To actually push video routing, use Apply Associations (section 10.3) or Bulk CSV Association (section 10.4).

Result Format

After association, monitor names follow the canonical form:

{Camera Name} - {Monitor Prefix}{###}-{UDP Port}

Example: Front Entrance - WF301-8001

10.2 Sync Decoder Names

Finds analog monitors whose name does not match the connected camera and renames them to the canonical form {prefix}{Camera} - VF{N}-{cmdPort}-{udpPort}. Useful after manual routing changes in Security Desk to bring names back in sync with reality.

Workflow

  1. Discover Units — populate the scope dropdown (uses cache if available, otherwise queries SDK).
  2. Pick scope — All Units, IP group, or single VideoUnit.
  3. Analyze — finds monitors with a name/camera mismatch and previews the proposed new names.
  4. Rename Selected or Apply All — writes the new names.

The view is resume-aware: rows already marked Renamed are skipped on re-click, so it survives a mid-run disconnect.

Configurable Options

10.3 Apply Associations

Actually pushes video routing via the SDK's ActionManager.DisplayOnAnalogMonitor and RemoveFromAnalogMonitor calls. Use this view when monitor names already correctly indicate which camera should be displayed, but the actual video stream is not on the monitor — typical after a server restart, a routing wipe, or a migration to new archivers.

Commands

How Camera Resolution Works

Apply Associations parses the monitor name to find the camera fragment — anything before the WF### or VF{N}-{cmdPort}-{udpPort} trailing component. It then searches for a camera in Security Center whose name matches that fragment exactly (case-insensitive). If exactly one match exists, the routing is applied; if zero or multiple matches exist, the row is marked Ambiguous and skipped.

This is why the canonical naming convention from section 6.4 matters — it guarantees the parse is deterministic.

10.4 Bulk CSV Association

Upload a CSV with two columns (NAME, GUID), pick a scope, then walk through validate → preview → run. Designed for new-site commissioning where you have a master inventory from an external source (Excel, asset database, AutoCAD) and need to materialize it as Security Center routing in one sweep.

CSV Format

NAME,GUID
Front Entrance,12345678-1234-1234-1234-123456789012
Parking Lot A,23456789-2345-2345-2345-234567890123
Loading Dock,34567890-3456-3456-3456-345678901234
...

The GUID column is the camera's Security Center GUID. The NAME column is the camera display name (used in the resulting monitor name).

Workflow

  1. Browse CSV — loads the file and validates each row's GUID against Security Center. Invalid GUIDs are flagged so you can fix the CSV before proceeding.
  2. Check Capacity — confirms there are enough empty AnalogMonitors in the chosen scope to receive all CSV cameras.
  3. Preview — pairs each CSV camera with the next empty monitor in deterministic (IP, UDP) order. Shows the planned monitor → camera mapping.
  4. Run — applies the associations and renames monitors to {prefix}{CSV name} - VF{N}-{cmdPort}-{udpPort}.

Cancel/resume aware — rows already marked Done are skipped on re-click. A Refresh invalidated (N) pill appears whenever the SDK reports pending changes and lets you drain only the changed entries without a full re-query.

10.5 Duplicate Detector

Finds analog monitors that are duplicates within the same VideoUnit — multiple monitors with overlapping camera assignments or identical UDP-port-plus-name pairings — and lets you clean them up.

Commands

Each group expands to show the monitors involved with their camera thumbnails so you can confirm before destructive action.

10.6 Reassociate Unit

Per-unit "disassociate then reassociate" sweep. For every AnalogMonitor on the selected unit (or All Units): logs the current camera GUID, calls RemoveFromAnalogMonitor, then immediately calls DisplayOnAnalogMonitor with the same camera.

Use this when the entire unit's routing is out of sync after a network event. The live operation log shows GUID-level activity so you can confirm what is happening in real time. Safer than a manual reboot of the archiver because it preserves the existing camera-to-monitor mapping rather than relying on Security Center to re-derive it.

10.7 Camera Stream Cycler

For each camera in scope: saves the current PreferredConnectionType, switches to BestAvailable (or Unicast if already on BestAvailable), dwells N seconds (configurable, default 5), then restores the original setting. Useful for forcing a renegotiation on cameras whose RTSP stream has stuck.

This is a common remediation for "the camera shows but the video is frozen" — toggling the connection type forces a fresh RTSP DESCRIBE/SETUP/PLAY cycle, which usually clears the stuck-pipeline state without a hard reboot.

10.8 Unconnected Decoders

Unconnected Decoders view
Figure 10.2 — Unconnected Decoders. Empty slots get a deterministic name so operators can spot them in Security Desk.

Lists analog monitors without a connected camera — the "virtual decoder" slots. Renames them to a virtual-decoder format that includes the unit IP, command port, and UDP port, so they are identifiable in Security Desk even when nothing is routed to them.

CSV export available for tracking commissioning progress over time.

10.9 Mismatched Connections

Identifies decoders whose currently displayed camera differs from the camera named in the monitor's Name field. Useful when routing has drifted from documented intent — every row tells you what is named versus what is actually displayed, with both camera details side by side. Read-only — the fix lives in Apply Associations or Reassociate Unit depending on whether one row or many rows are wrong.

10.10 Add to Partition

Two-list (Available / Staged) editor. Adds cameras and the parent VideoUnit of selected AnalogMonitors to a target partition.

SDK 5.9 limitation: Partition.AddMember requires IPartitionSupport, which AnalogMonitor does not implement. The tool transparently substitutes the parent VideoUnit when you stage a monitor — which adds every sibling camera/monitor on that unit too. This is documented per-row in the Result column so there are no surprises.

10.11 Organize Areas SDK 5.11+ only

Bulk-assigns analog monitors into Area entities, optionally creating a nested area hierarchy in the process. The view auto-generates area names from monitor IPs (e.g. Site - 162.249.44.30) so each archiver gets its own area without manual typing.

Hidden on the SDK 5.9 build because Area.AnalogMonitors and Area.AddAnalogMonitor do not exist in SDK 5.9. If the tab is missing from your install, install the SDK 5.11 component via the combined installer.

10.12 Shared Patterns & Scope Picker

Every Decoder Tools view inherits a small set of shared patterns. Learning them once means every new view is immediately familiar.

Discover / Refresh Buttons

Scope Picker

Where applicable, the scope dropdown offers three levels:

11. Export

11.1 Forge & Export Data

Generates GenetecForge_<timestamp>.xml in Documents. Matches the console's --forge format exactly — the downstream WINK Forge and Media Router products consume both interchangeably. Three button groups:

Inspect

Dump JSONL Caches

Export Forge XML

11.2 Extract Archive State

Raw TCP state all query against each discovered decoder unit on port 5602. Per-unit text dumps plus a single appended CSV at Documents\WINKStreaming\ArchiveExtracts\archive_extract_log.csv.

This view bypasses the Genetec SDK entirely (it opens a TCP socket directly), so it keeps working through SDK disconnects. Settings (port, command, timeout, CSV path) are snapshotted at the start of each batch so mid-run edits cannot corrupt the run.

Use it when you need to compare what the archiver reports about itself with what Security Center reports about the archiver — divergence between the two is a common root cause of "the SDK says everything is fine but operators see broken video" tickets.

11.3 Parallel Bulk Export

Spins up multiple independent SDK sessions in parallel (default 4) and distributes the four export jobs (AnalogMonitors / Cameras / VideoUnits / Forge XML) across them. Output goes to separate *_parallel_<ts>.jsonl files so it never collides with the single-session dumps.

Use this for the fastest possible bulk pull on a healthy server. Drop the parallel session count to 2 if you are seeing DeniedByFirewall errors on SC 5.11.3 — the throttle is per-second LogOn frequency, not total session count.

12. Configuration & Windows Service

12.1 Settings View

Settings view
Figure 12.1 — Settings view. Always include this screenshot in support cases.

The Settings view is read-only — it shows you exactly which Genetec SDK assembly is loaded, where it was loaded from on disk, and when it was built. Use it as the first stop when reporting an issue: a screenshot of this view tells support what build of the SDK is actually running, which often diagnoses the problem before any back-and-forth.

Information Displayed

12.2 Windows Service Setup

The optional WINKSCDataMonitor Windows Service performs the same --forge export on a schedule (default every 20 minutes), compares it against the previous run, and sends an email or HTTP POST when entities change. Use it for unattended change-detection in production deployments.

Windows Service Tab
Figure 12.2 — Windows Service configuration tab. All fields persist to DPAPI-encrypted storage at %APPDATA%\WINKStreaming\APIBridge\settings.encrypted.

Service Features

Configuration Steps

  1. APIBridge Metro → Configuration → Windows Service.
  2. Tick Use Windows Service.
  3. Select the delivery method (Email or HTTP POST) and fill in its fields (section 12.3).
  4. Fill in the Security Center credentials the service will use (separate from the GUI's runtime login — the service needs its own copy so it can run when the GUI is closed).
  5. Generate or paste an Authentication Key (128 characters, auto-generated).
  6. Click Install Windows Service.
  7. Approve the UAC prompt — the installer uses sc.exe to register the service with automatic startup.

Service Information

PropertyValue
Service nameWINKSCDataMonitor
Display nameWINK Security Center Data Monitor
Startup typeAutomatic
Run asLocal System (default; configurable post-install via services.msc)
Check interval20 minutes (configurable)
Settings storage%APPDATA%\WINKStreaming\APIBridge\settings.encrypted (DPAPI)
Forge XML output%PROGRAMDATA%\WINKStreaming\Service\ForgeExports\

12.3 Delivery Methods

Email Notifications

Configure email delivery for change notifications:

Email Settings

Default WINK Streaming SMTP Configuration

If you do not have your own SMTP relay, the WINK Streaming default works out of the box:

SettingValue
Servermail.wink.co
Port587
Usernamewinkscdata@wink.co
EncryptionSTARTTLS
CCapifeed@wink.co (so WINK can support you if change-detection misfires)

HTTP POST (Media Router)

Configure HTTP POST delivery to a WINK Media Router endpoint (or any compatible HTTP receiver). This is the standard delivery method for production WINK Forge deployments.

Media Router Settings

POST Request Format

POST /api/genetec HTTP/1.1
Host: your-media-router.example.com
Content-Type: application/xml
X-Auth-Key: [128-character-key]

<?xml version="1.0"?>
<signature>[authentication-key]</signature>
<wink>
    <!-- Genetec data XML — same Forge schema as section 11.1 -->
</wink>

The receiving Media Router validates the signature against its configured key, then accepts or rejects the payload. The full Forge XML body lets the Router rebuild its internal camera registry on every change rather than diffing — simpler and more robust than a delta protocol.

12.4 Service Management

Installing the Service

  1. Configure all settings in the Windows Service tab.
  2. Click Install Windows Service.
  3. Accept the UAC elevation prompt (required — service registration needs admin).
  4. Wait for installation to complete (typically < 5 seconds).
  5. The service starts automatically after installation.

Service Controls

Once installed, the following buttons become available in the same tab:

ButtonFunctionRequirements
Start ServiceStarts the monitoring serviceService must be stopped
Stop ServiceStops the monitoring serviceService must be running
Restart ServiceStops and starts the serviceService must be installed
Uninstall ServiceRemoves the service via sc.exe deleteService must be stopped

Service Status Indicators

Viewing Service Logs

Service activity is logged to the Windows Event Log:

  1. Open Event Viewer (eventvwr.msc).
  2. Navigate to Windows Logs → Application.
  3. Filter by Source: WINKSCDataMonitor.
  4. Review service events, change-detection summaries, delivery results, and errors.

Each cycle also writes a structured run summary to %PROGRAMDATA%\WINKStreaming\Service\Logs\service-<date>.log — text format, useful for sweeping with findstr or grep from PowerShell.

Important: Administrator privileges are required for service install/uninstall and start/stop. The application will prompt for elevation when needed. If UAC is suppressed on your machine (silent-elevation policies), the operation will succeed quietly; if UAC prompts are disabled entirely, the operation fails — re-enable prompts or run as administrator.

13. Permissions Quick Reference

One-page cheat sheet for the privileges APIBridge Metro requires. Use this when handing requirements to a Genetec administrator who does not need the full context of section 6.

PrivilegeRequired for
Log on using the SDKEverything (gate)
View camerasList Cameras, all Decoder Tools, Forge export
View analog monitorsList Decoders, all Decoder Tools, Forge export
View video unitsIP address retrieval, Decoder Tools scope picker
View hardware configurationMAC address retrieval, all unit-level operations
View areasOrganize Areas, List All Entities
View partitionsAdd to Partition, List All Entities
Modify analog monitor name/descriptionAssociate Monitors Evenly, Sync Decoder Names, Bulk CSV Association, Unconnected Decoders rename
Display camera on analog monitorApply Associations, Bulk CSV Association write, Reassociate Unit
Remove camera from analog monitorReassociate Unit, Reassociate Selected/All in Apply Associations
Add member to partitionAdd to Partition
Modify camera (PreferredConnectionType)Camera Stream Cycler

14. Troubleshooting

Connection Problems

IssueSymptomsSolution
Cannot connect to Security Center Connection fails immediately or hangs at "Connecting…"
  • Verify server address and port (5500)
  • Check firewall settings on both ends
  • Test network connectivity with Test-NetConnection -Port 5500
  • Ensure the SDK assembly is present next to the EXE and not blocked
InvalidCredential Authentication fails on Connect
  • Verify username and password in Config Tool
  • Confirm Log on using the SDK is enabled on the account
  • Ensure the account is not locked or password-expired
  • Try the username without a domain prefix first
DeniedByFirewall Retried LogOn attempts fail with throttle error
  • SC 5.11.3 throttles per-second LogOn frequency
  • Wait 5 minutes; the throttle clears on its own
  • The tool retries automatically with 0/30/60/120/300/600 s backoff — look for "Reconnect attempt N/5" lines
CertificateError License validation fails
  • Contact WINK support for a certificate refresh
  • Verify the SDK license is valid on the Security Center server
  • For dev/test, try Use Demo Certificate

Data Issues

IssueSymptomsSolution
Missing IP addresses Blank IP/MAC in decoders or Forge export
  • Enable View hardware configuration privilege on the SDK user's role
  • Confirm the privilege applies to the relevant Video Units (partition scope)
  • Re-run the Connectivity & Permissions verification
No cameras visible Empty camera list
  • Verify View cameras privilege
  • Check partition assignment — the SDK user may be scoped to a partition that contains no cameras
  • Ensure cameras actually exist in the system (verify via Config Tool with an admin account)
Cannot update monitors Association fails or rename rejected
  • Check Modify analog monitor privilege
  • Verify monitors are not locked by Security Desk
  • Ensure proper partition access for the monitors being modified
Bulk Refresh returns a partial list Some monitors missing from the grid after a refresh
  • Some SC deployments tank the bulk path on restricted users (permission cascades return null)
  • Use Refresh (Slow/Thorough) instead — slower but reliably complete
"Organize Areas" tab missing Tab is not visible in the navigation
  • Requires Genetec SDK 5.11+
  • If you installed the SDK 5.9 build, the tab is intentionally hidden
  • Install the SDK 5.11 component via the combined installer
CefSharp / snapshot viewer fails Error opening camera snapshot
  • Install the Visual C++ 2019/2022 Redistributable (x64) from Microsoft
  • Restart APIBridge Metro after installing

Service Issues

IssueSymptomsSolution
Service will not install Installation fails or UAC errors out
  • Re-launch APIBridge Metro as administrator
  • Check for an existing WINKSCDataMonitor service and uninstall it first (sc query WINKSCDataMonitor)
  • Verify .NET Framework 4.8 is installed
  • Review the Event Log for specific install errors
Service stops unexpectedly Status shows Stopped without manual intervention
  • Check the Event Log under Application → WINKSCDataMonitor for the failure reason
  • Verify SDK credentials are still valid (rotated SDK password?)
  • Ensure network connectivity to the Security Center server
  • Check disk space on the volume hosting %PROGRAMDATA%\WINKStreaming\
No email notifications received Changes are happening but no emails arrive
  • Verify SMTP settings (server, port, encryption)
  • Check email credentials are correct
  • Test the SMTP server reachability with telnet
  • Check spam/junk folders
  • Review the service log at %PROGRAMDATA%\WINKStreaming\Service\Logs\ for delivery errors
HTTP POST returns 401 Media Router rejects the change notification
  • Confirm the Authentication Key in APIBridge Metro matches the key configured in the Media Router
  • Verify the X-Auth-Key header is being sent (proxy/firewall may strip headers)

Diagnostic Tools

Activity Log

The Activity Log panel at the bottom of the application provides real-time diagnostic information:

To use it effectively when reproducing an issue:

  1. Enable verbose logging in Settings.
  2. Clear the log before reproducing the issue.
  3. Perform the failing operation.
  4. Click Save on the log panel to export it.
  5. Attach the export to your support case.

Permission Verification

Always run the Connectivity & Permissions test when troubleshooting any read or write failure — most "the export is broken" tickets are missing privileges, and the verification view diagnoses them in seconds.

Settings View Screenshot

A screenshot of the Settings view (section 12.1) is the single most useful diagnostic for SDK-version issues. Include it in every support case.

Support contact: For issues not covered here, contact WINK Streaming support at support@wink.co with the activity log export, a Settings screenshot, and a description of what you were trying to do.

15. Best Practices

Security Best Practices

  1. Use a dedicated SDK account.
    • Create a separate account named winkSDK (or per your conventions).
    • Grant only the privileges enumerated in section 13.
    • Use a strong, unique password — do not reuse a human operator's password.
    • Enable password rotation policies appropriate to your environment.
  2. Secure network communication.
    • Use a VPN for remote SDK connections.
    • Implement firewall rules to scope port 5500 access to the workstations that need it.
    • Monitor SDK connection logs on the Security Center side.
    • Use encrypted email (STARTTLS or SSL/TLS) for service delivery.
  3. Credential management.
    • Never share SDK credentials between humans.
    • Rotate the SDK password quarterly (or per your policy).
    • When you rotate, update users.json at the same time on every machine that has it saved.
    • Treat the Windows Service DPAPI store as the canonical credential for unattended use — re-enter via the Configuration → Windows Service tab after every rotation.
  4. Partition scoping.
    • Create a dedicated winkStreaming partition (section 6.3).
    • Only place entities the integration needs to manage inside it.
    • This is your last line of defense if the SDK credentials are ever compromised.

Operational Best Practices

  1. Regular maintenance.
    • Export Forge XML weekly for archival.
    • Review unconnected monitors monthly.
    • Update to the latest APIBridge Metro release when announced.
    • Clean up old export files quarterly to keep Documents tidy.
  2. Change management.
    • Document all configuration changes in your CMDB or change-tracking system.
    • Test in a non-production environment first when possible.
    • Always use Preview before Apply.
    • Maintain a change log — the Activity Log export captures most of it for you.
  3. Monitoring.
    • Review Windows Service logs daily, or set up email forwarding for change notifications.
    • Set up email alerts for high-volume change events.
    • Monitor for unauthorized modifications by diffing weekly Forge exports.
    • Track entity-count trends — sudden drops are a sign of permission regression or hardware failure.

Performance Optimization

16. File Locations

PathContents
{install}\Metro\GUI executable, dependencies, portable users.json
{install}\Console\Console executable, dependencies, portable users.json
{install}\USERS-JSON-README.txtCredentials file quick reference
%APPDATA%\WINKStreaming\users.jsonPer-user credentials (written by the GUI's Save Credentials)
%APPDATA%\WINKStreaming\APIBridge\settings.encryptedDPAPI-encrypted Windows Service settings
%USERPROFILE%\Documents\GenetecForge_*.xmlForge XML exports
%USERPROFILE%\Documents\AnalogMonitors_*.jsonlJSONL cache of analog monitors
%USERPROFILE%\Documents\Cameras_*.jsonlJSONL cache of cameras
%USERPROFILE%\Documents\VideoUnits_*.jsonlJSONL cache of video units
%USERPROFILE%\Documents\WINKStreaming\ArchiveExtracts\Archive Extractor CSV log + per-unit text dumps
%PROGRAMDATA%\WINKStreaming\Service\ForgeExports\Windows Service Forge exports
%PROGRAMDATA%\WINKStreaming\Service\Logs\Windows Service text logs

17. Performance & Resilience

Batched Queries with Reconnect

Cameras and AnalogMonitors are pulled in batches of 5 by default. After each batch, the SDK session liveness is rechecked; if dead, the tool auto-reconnects using cached credentials with progressive backoff (0 / 30 / 60 / 120 / 300 / 600 seconds) and resumes from the next batch. This is the same logic the console uses, sharing a single retry policy across both applications.

Resume from Partial Runs

Bulk Export and the console's --forge mode cumulatively append to a GenetecForge_progress.jsonl file. If a run dies mid-way, simply re-run — the next invocation reads the progress file as a starting cache and only re-queries entities not yet collected. Successful completion renames the progress file to GenetecForge_completed_<ts>.jsonl.

Expected Wall-Clock Times

For a healthy SC 5.11.3 server with a privileged SDK user:

Inventory sizeFull Forge export
~100 monitors< 30 seconds
~500 monitors~2 minutes
~1,800 monitors~5–10 minutes
~1,800 monitors on a restricted SDK user (permission cascades)20–60 minutes

Use Parallel Bulk Export (section 11.3) to shave additional time on healthy servers — drop the parallel session count to 2 if you start seeing DeniedByFirewall from the throttle.

18. Console Companion (WINKSCData)

APIBridge Metro ships alongside WINKSCData, a headless command-line tool that performs the same reads and (selectively) the same writes from a script, scheduled task, or CI pipeline. Both tools share:

What the console does not share with the GUI:

Both can run at the same time without conflict — each opens its own SDK session.

Read the dedicated WINKSCData Console Manual for the full option reference, scripting cookbook, scheduling guidance (Task Scheduler, CI), and exit codes.

19. Version History

0.9.0.0 Current — 2026-06-28

0.7.3.23 Legacy

20. Appendix

A. Forge XML Schema

The Forge XML export format follows this schema:

<wink report_time="datetime" generation_duration="duration">
    <monitors decoder_count="integer" camera_count="integer">
        <monitor_device ipaddress="string" macaddress="string" guid="guid">
            <monitor_unit commandport="integer">
                <decoder name="string" udpport="integer"
                         IsOnline="boolean" guid="guid">
                    <description><![CDATA[text]]></description>
                    <custom_fields><![CDATA[text]]></custom_fields>
                    <connectedcamera name="string" guid="guid">
                        <!-- 58+ camera attributes -->
                    </connectedcamera>
                </decoder>
            </monitor_unit>
        </monitor_device>
    </monitors>
</wink>

All string fields are XML-escape-safe (&, <, >, ", ' handled) and wrapped in CDATA where appropriate. JSON output (-j on the console) emits the same data with camelCase keys.

B. Camera Attributes

Each <connectedcamera> element in the Forge XML carries these attribute groups:

CategoryAttributes
Basic infoName, Description, GUID, Model, Manufacturer
NetworkIP address, MAC address, port, protocol
VideoResolution, frame rate, codec, bitrate, key-frame interval, quality
PTZHas PTZ, presets, tours, patterns
RecordingMode, quality, retention, schedule
LocationGPS latitude / longitude, building, floor, zone
StatusOnline state, last seen, current signal state, running state, connection type
SecurityEncryption type, is-blocked, is-in-maintenance
OperationalTime zone, monitor group GUID, custom fields

C. Error Codes

CodeDescriptionResolution
1001SDK not foundVerify Genetec.Sdk.dll is next to the EXE and not blocked
2001Invalid credentialsVerify username/password and SDK logon privilege
3001Network timeoutCheck connectivity, firewall, port 5500
4001Permission deniedGrant the required Genetec privilege (section 13)
5001Certificate errorContact WINK support for a certificate refresh

D. Keyboard Shortcuts

ShortcutAction
Ctrl+CCopy selected data
Ctrl+EExport current view
F5Refresh data
Ctrl+FFind in current view
Alt+CConnect to Security Center
Alt+DDisconnect

21. Support

When opening a support case, please include:

© 2026 WINK Streaming. All rights reserved.

APIBridge Metro User Manual — Version 0.9.0.0

WINK Streaming LLC — Authorized Partner of Genetec Inc.