{"id":485,"date":"2026-07-10T23:23:02","date_gmt":"2026-07-10T23:23:02","guid":{"rendered":"https:\/\/www.tb-software.ch\/ai\/systemlocker\/restapi\/"},"modified":"2026-07-10T23:23:02","modified_gmt":"2026-07-10T23:23:02","slug":"restapi","status":"publish","type":"page","link":"https:\/\/www.tb-software.ch\/ai\/systemlocker\/restapi\/","title":{"rendered":"SystemLocker, REST-API"},"content":{"rendered":"
\n\n \n
\n
\n

Der Schl\u00fcssel zu Ihrem PC.<\/p>\n

SystemLocker<\/h2>\n

Passwortloser Windows-Login und Datenschutz \u00fcber einen physischen USB-Dongle. Steckt der Dongle, meldet der PC automatisch das richtige Benutzerkonto an, ganz ohne Passworteingabe. Fehlt der Dongle, bleiben Konto und Arbeitsdaten verschl\u00fcsselt und unzug\u00e4nglich.<\/p>\n <\/div>\n

\n \"SystemLocker\n <\/div>\n <\/section>\n\n
\n
\n \"\"\n
Passwortlos & komfortabel<\/strong>
Der Dongle ersetzt die Passworteingabe und w\u00e4hlt das richtige Profil.<\/div>\n <\/div>\n
\n \"\"\n
Rundum verschl\u00fcsselt<\/strong>
System und Arbeitsdaten mit BitLocker gesch\u00fctzt, kein Boot-Passwort n\u00f6tig.<\/div>\n <\/div>\n
\n \"\"\n
Rollenbasiert<\/strong>
Verschiedene Dongles \u00f6ffnen verschiedene Konten und Datenbereiche, kryptografisch getrennt.<\/div>\n <\/div>\n
\n \"\"\n
Sicher gesichert<\/strong>
Zentrale Wiederherstellung der Dongles \u00fcber diese REST-API. Kopien f\u00fcr den Notfall.<\/div>\n <\/div>\n <\/section>\n\n
\n

So funktioniert es in 3 Schritten<\/h3>\n \"Workflow:\n <\/section>\n\n
\n

Screenshots aus der laufenden Anwendung<\/h3>\n
\n
\n \"Assistent:\n
Assistent: Willkommen<\/figcaption>\n <\/figure>\n
\n \"Assistent:\n
Assistent: Dongle-Verwaltung mit Rolle Finanzen, provisioniert<\/figcaption>\n <\/figure>\n
\n \"Simulierter\n
Simulierter Start mit Dongle, Anmeldung erfolgreich<\/figcaption>\n <\/figure>\n
\n \"Simulierter\n
Simulierter Start ohne Dongle, getarnte Fehlermeldung<\/figcaption>\n <\/figure>\n
\n \"Assistent:\n
Assistent: Zusammenfassung<\/figcaption>\n <\/figure>\n <\/div>\n

Alle sichtbaren Werte (Rolle, Konto TB\\tboehme<\/code>, Serial) sind Demo-Daten, keine echten Geheimnisse.<\/p>\n <\/section>\n\n

\n\n

REST-API f\u00fcr den Wizard<\/h2>\n

\n Zentrale REST-API f\u00fcr den SystemLocker-WPF-Wizard<\/strong>. Speichert Dongle-Material\n (clientseitig AES-256-GCM verschl\u00fcsselt), PCs, Metriken, Audit-Log in der Linkwerk-Datenbank.\n Namespace: systemlocker\/v1<\/code>. Basis-URL:\n https:\/\/www.tb-software.ch\/ai\/wp-json\/systemlocker\/v1\/<\/code>.\n <\/p>\n\n

\n JSON UTF-8<\/span>\n HTTPS only<\/span>\n HMAC-Signatur pro Request<\/span>\n Master-Key server-seitig, verschl\u00fcsseltes Escrow<\/span>\n <\/div>\n\n

1. Auth-Modell<\/h2>\n

Zwei Auth-Klassen:<\/p>\n

    \n
  1. Wizard (HMAC)<\/strong>: jeder Request wird mit dem installations-eigenen\n apiKey<\/code> signiert. Kein Token, keine Session. Header:\n X-SL-Installation<\/code>, X-SL-Timestamp<\/code>, X-SL-Nonce<\/code>,\n X-SL-Signature<\/code>.<\/li>\n
  2. Admin<\/strong>: entweder WP-Admin-Login<\/em> mit manage_options<\/code>-Recht\n (Cookies) oder Header X-SL-Admin-Secret<\/code> mit dem Wert aus\n SL_ADMIN_SECRET<\/code> in wp-config.php<\/code>.<\/li>\n <\/ol>\n\n

    1.1 HMAC-Signatur berechnen (zwei Formate parallel unterst\u00fctzt)<\/h3>\n

    Der Server akzeptiert beide Formate. Neue Wizards nutzen v2<\/strong>, \u00e4ltere v1<\/strong>.<\/p>\n\n

    v2 \u2014 Spec 2.0 (empfohlen, entspricht HmacRequestSigner.cs<\/code>)<\/h4>\n
    timestamp = ISO-8601 UTC (\"2026-07-11T00:00:00Z\")\nnonce     = zufaellig, mind. 16 Byte\npath      = \"\/dongles\"                             # ab Namespace\nbody_hex  = hex(SHA256(body))                      # leerer Body: SHA256(\"\")\ncanonical = f\"{METHOD}\\n{path}\\n{timestamp}\\n{nonce}\\n{body_hex}\"\nsignature = base64(HMAC-SHA256(key=apiKey, msg=canonical))\n\nHeaders:\n  X-SL-Installation : <installationId>\n  X-SL-Timestamp    : <timestamp ISO-8601>\n  X-SL-Nonce        : <nonce>\n  X-SL-Signature    : <signature base64>\n<\/code><\/pre>\n\n  
    v1 \u2014 Legacy (dot-format)<\/h4>\n
    timestamp = int(Unix-Sekunden UTC)\nnonce     = hex(random_bytes(16))\ncanonical = f\"{timestamp}.{nonce}.{METHOD}.{fullpath}.{body}\"\n# fullpath = \"\/systemlocker\/v1\/dongles\"  (mit Namespace-Prefix)\n# body     = raw request body (leerer String bei GET)\nsignature = HMAC-SHA256(key=apiKey, msg=canonical).hex()\n<\/code><\/pre>\n\n  
    Server-Verifikation:<\/p>\n  
      \n    
    • |now - timestamp| ≤ 300s<\/code> (Clock-Drift-Toleranz)<\/li>\n    
    • Nonce nicht in Replay-Cache (transient, 5-6 min)<\/li>\n    
    • hash_equals(expected, signature)<\/code><\/li>\n  <\/ul>\n\n  
      2. Endpoint-\u00dcbersicht<\/h2>\n  \n    \n      
      Methode<\/th>Pfad<\/th>Auth<\/th>Zweck<\/th><\/tr><\/thead>\n    
      GET   <\/td>\/version<\/code>                                              <\/td>\u2014     <\/td>Server-Version, HMAC-Formate, Feature-Flags, bekannte Metric-Types<\/td><\/tr>\n      
      POST  <\/td>\/installations<\/code>                                        <\/td>Admin <\/td>Neue Installation anlegen (gibt apiKey<\/em> + restorePassword<\/em> EINMALIG zur\u00fcck)<\/td><\/tr>\n      
      GET   <\/td>\/installations<\/code>                                        <\/td>Admin <\/td>Alle Installationen listen (ohne Secrets)<\/td><\/tr>\n      
      DELETE<\/td>\/installations\/{id}<\/code>                                   <\/td>Admin <\/td>Installation l\u00f6schen (Audit)<\/td><\/tr>\n      
      GET   <\/td>\/installations\/{id}\/restore-password<\/code>                  <\/td>Admin <\/td>Klartext-Passwort abrufen (Audit + Reveal-Warnung)<\/td><\/tr>\n      
      POST  <\/td>\/installations\/{id}\/restore-password\/verify<\/code>           <\/td>HMAC  <\/td>Restore-Passwort verifizieren ohne es preiszugeben<\/td><\/tr>\n      
      POST  <\/td>\/installations\/{id}\/rotate-api-key<\/code>                    <\/td>Admin <\/td>Neuen apiKey generieren, alten invalidieren<\/td><\/tr>\n      
      POST  <\/td>\/pcs<\/code>                                                  <\/td>HMAC  <\/td>PC registrieren\/updaten (pcId = SHA-256 der hardwareId)<\/td><\/tr>\n      
      POST  <\/td>\/dongles<\/code>                                              <\/td>HMAC  <\/td>Dongle-Record speichern (material bereits verschl\u00fcsselt)<\/td><\/tr>\n      
      GET   <\/td>\/dongles<\/code>                                              <\/td>HMAC  <\/td>Dongles der eigenen Installation (Query: pcId, role, withMaterial)<\/td><\/tr>\n      
      GET   <\/td>\/dongles\/{dongleId}<\/code>                                   <\/td>HMAC  <\/td>Einzeldongle inkl. material-Chiffrat laden<\/td><\/tr>\n      
      DELETE<\/td>\/dongles\/{dongleId}<\/code>                                   <\/td>Admin <\/td>Dongle-Record l\u00f6schen (Audit)<\/td><\/tr>\n      
      POST  <\/td>\/metrics<\/code>                                              <\/td>HMAC  <\/td>Metric oder Batch ingesten<\/td><\/tr>\n      
      GET   <\/td>\/metrics<\/code>                                              <\/td>HMAC\/Admin<\/td>Metriken abfragen (pcId, type, fromUtc, toUtc)<\/td><\/tr>\n      
      GET   <\/td>\/audit<\/code>                                                <\/td>Admin <\/td>Audit-Log lesen (Filter: installationId)<\/td><\/tr>\n    <\/tbody>\n  <\/table>\n\n  
      3. Datenmodelle<\/h2>\n\n  
      3.1 Installation<\/h3>\n
      {\n  \"installationId\": \"b3f1a2c4-...\",\n  \"customerName\":   \"Muster AG\",\n  \"createdUtc\":     \"2026-07-09T10:00:00Z\"\n}<\/code><\/pre>\n  
      Beim Create zusaetzlich in der Antwort (EINMALIG, nie wieder abrufbar in Klartext):<\/p>\n
      {\n  \"apiKey\":          \"sl_...\",     \/\/ Wizard-Secret fuer HMAC\n  \"restorePassword\": \"A7fH3...\",   \/\/ 32 Zeichen, wird gebraucht wenn kein DPAPI-Cache\n}<\/code><\/pre>\n\n  
      3.2 PC<\/h3>\n
      Request POST \/pcs:\n{ \"hostname\": \"TBS-PC01\", \"os\": \"Windows 10 19045\",\n  \"machineGuid\": \"...\", \"hardwareId\": \"...\" }\n\nResponse:\n{ \"pcId\": \"sha256-...\" }<\/code><\/pre>\n\n  
      3.3 DongleRecord<\/h3>\n
      {\n  \"dongleId\":     \"d1a2...\",           \/\/ Server-vergeben\n  \"installationId\":\"b3f1...\",\n  \"role\":         \"Main | Backup1 | ...\",\n  \"serialNumber\": 1364915896,\n  \"account\":      { \"userName\": \"timo\", \"domain\": \".\", \"profileId\": \"S-1-5-21-...\" },\n  \"pcId\":         \"sha256-...\",\n  \"sessionId\":    \"...\",\n  \"material\": {\n    \"algo\":       \"AES-256-GCM\",\n    \"kdf\":        \"Argon2id\",\n    \"salt\":       \"base64\",\n    \"nonce\":      \"base64\",\n    \"tag\":        \"base64\",\n    \"ciphertext\": \"base64\"\n  },\n  \"createdUtc\":   \"2026-07-09T10:06:00Z\",\n  \"version\":      1\n}<\/code><\/pre>\n  
      Wichtig:<\/strong> K_d<\/code>, S<\/code> und das Windows-Passwort stecken NUR\n    im material.ciphertext<\/code>, verschl\u00fcsselt mit dem Restore-Key aus\n    Argon2id(restorePassword, salt)<\/code>. Der Server sieht sie NIE im Klartext.<\/p>\n\n  
      3.4 Metric<\/h3>\n
      {\n  \"type\":         \"login_success | login_denied | dongle_removed | heartbeat | custom\",\n  \"value\":        1,\n  \"pcId\":         \"sha256-...\",\n  \"dongleId\":     \"d1a2-... | null\",\n  \"data\":         { \"beliebig\": \"json\" },\n  \"timestampUtc\": \"2026-07-09T10:07:00Z\"\n}<\/code><\/pre>\n\n  
      4. Beispiele<\/h2>\n\n  
      4.1 Installation anlegen (Admin, curl)<\/h3>\n
      curl -X POST \"https:\/\/www.tb-software.ch\/ai\/wp-json\/systemlocker\/v1\/installations\" \\\n     -H \"X-SL-Admin-Secret: $SL_ADMIN_SECRET\" \\\n     -H \"Content-Type: application\/json\" \\\n     -d '{\"customerName\":\"Muster AG\"}'\n\n{\n  \"installationId\": \"b3f1a2c4-...\",\n  \"customerName\":   \"Muster AG\",\n  \"apiKey\":         \"sl_a1b2c3...\",     <- unbedingt sichern\n  \"restorePassword\":\"A7fHmKq2X8...\",    <- unbedingt sichern\n  \"createdUtc\":     \"2026-07-09T10:00:00Z\"\n}<\/code><\/pre>\n\n  
      4.2 Wizard: Dongle speichern (HMAC)<\/h3>\n
      import time, secrets, hmac, hashlib, json, urllib.request\n\ninstallation = \"b3f1a2c4-...\"\napi_key      = \"sl_a1b2c3...\"\nbody_obj     = { \"role\":\"Main\", \"serialNumber\":1364915896, \"account\":{...},\n                 \"pcId\":\"sha256-...\", \"sessionId\":\"...\", \"material\":{...},\n                 \"version\":1 }\nbody = json.dumps(body_obj, separators=(\",\",\":\"))\nts   = str(int(time.time()))\nnonce= secrets.token_hex(16)\npath = \"\/systemlocker\/v1\/dongles\"\ncanonical = f\"{ts}.{nonce}.POST.{path}.{body}\"\nsig  = hmac.new(api_key.encode(), canonical.encode(), hashlib.sha256).hexdigest()\n\nreq = urllib.request.Request(\n    \"https:\/\/www.tb-software.ch\/ai\/wp-json\/systemlocker\/v1\/dongles\",\n    data=body.encode(),\n    headers={\n      \"X-SL-Installation\": installation,\n      \"X-SL-Timestamp\":    ts,\n      \"X-SL-Nonce\":        nonce,\n      \"X-SL-Signature\":    sig,\n      \"Content-Type\":      \"application\/json\",\n    },\n    method=\"POST\",\n)\nprint(urllib.request.urlopen(req).read())\n# -> 201 {\"dongleId\":\"d1a2...\"}<\/code><\/pre>\n\n  
      4.3 Wizard: Restore-Passwort verifizieren (kein Klartext-Reveal)<\/h3>\n
      POST https:\/\/www.tb-software.ch\/ai\/wp-json\/systemlocker\/v1\/installations\/{id}\/restore-password\/verify\nHeaders: X-SL-*\nBody:    { \"restorePassword\":\"A7fHmKq2X8...\" }\nResponse: 200 { \"valid\": true|false }<\/code><\/pre>\n\n  
      4.4 Restore-Passwort abrufen (Admin, mit Audit)<\/h3>\n
      curl \"https:\/\/www.tb-software.ch\/ai\/wp-json\/systemlocker\/v1\/installations\/{id}\/restore-password\" \\\n     -H \"X-SL-Admin-Secret: $SL_ADMIN_SECRET\"\n\n{\n  \"installationId\":  \"b3f1...\",\n  \"restorePassword\": \"A7fHmKq2X8...\",\n  \"issuedUtc\":       \"2026-07-09T10:22:00Z\",\n  \"auditId\":         \"...\"\n}\n<\/code><\/pre>\n\n  
      5. C#-Client (WPF-Wizard)<\/h2>\n  
      Copy-paste-fertige Referenzimplementierung f\u00fcr den .NET-6+\/WPF-Wizard.\n     HMAC via System.Security.Cryptography.HMACSHA256<\/code>, JSON via\n     System.Text.Json<\/code>, keine Fremd-Nugets noetig.<\/p>\n\n  
      5.1 HMAC-Client-Klasse<\/h3>\n
      using System.Net.Http;\nusing System.Net.Http.Headers;\nusing System.Security.Cryptography;\nusing System.Text;\nusing System.Text.Json;\n\npublic sealed class SystemLockerClient\n{\n    private readonly HttpClient _http = new();\n    private readonly string _base;      \/\/ \"https:\/\/tb-software.ch\/ai\/wp-json\/systemlocker\/v1\"\n    private readonly string _installationId;\n    private readonly string _apiKey;\n\n    public SystemLockerClient(string baseUrl, string installationId, string apiKey)\n    {\n        _base = baseUrl.TrimEnd('\/');\n        _installationId = installationId;\n        _apiKey = apiKey;\n    }\n\n    private HttpRequestMessage Sign(HttpMethod method, string routePath, string body = \"\")\n    {\n        \/\/ routePath MUSS mit Namespace-Prefix beginnen: \"\/systemlocker\/v1\/dongles\"\n        var ts    = ((long)(DateTime.UtcNow - DateTime.UnixEpoch).TotalSeconds).ToString();\n        var nonce = Convert.ToHexString(RandomNumberGenerator.GetBytes(16)).ToLower();\n        var canonical = $\"{ts}.{nonce}.{method.Method}.{routePath}.{body}\";\n        using var h = new HMACSHA256(Encoding.UTF8.GetBytes(_apiKey));\n        var sig = Convert.ToHexString(h.ComputeHash(Encoding.UTF8.GetBytes(canonical))).ToLower();\n\n        var req = new HttpRequestMessage(method, _base + routePath.Substring(\"\/systemlocker\/v1\".Length));\n        req.Headers.Add(\"X-SL-Installation\", _installationId);\n        req.Headers.Add(\"X-SL-Timestamp\",    ts);\n        req.Headers.Add(\"X-SL-Nonce\",        nonce);\n        req.Headers.Add(\"X-SL-Signature\",    sig);\n        if (!string.IsNullOrEmpty(body))\n            req.Content = new StringContent(body, Encoding.UTF8, \"application\/json\");\n        return req;\n    }\n\n    public async Task<JsonElement> PostAsync(string route, object payload)\n    {\n        var body = JsonSerializer.Serialize(payload, new JsonSerializerOptions{ WriteIndented = false });\n        using var req = Sign(HttpMethod.Post, route, body);\n        using var r   = await _http.SendAsync(req);\n        var text = await r.Content.ReadAsStringAsync();\n        return JsonDocument.Parse(text).RootElement.Clone();\n    }\n\n    public async Task<JsonElement> GetAsync(string route)\n    {\n        using var req = Sign(HttpMethod.Get, route);\n        using var r   = await _http.SendAsync(req);\n        var text = await r.Content.ReadAsStringAsync();\n        return JsonDocument.Parse(text).RootElement.Clone();\n    }\n}<\/code><\/pre>\n\n  
      5.2 PC registrieren + Dongle speichern<\/h3>\n
      var sl = new SystemLockerClient(\n    \"https:\/\/www.tb-software.ch\/ai\/wp-json\/systemlocker\/v1\",\n    installationId: \"b3f1a2c4-...\",\n    apiKey:         \"sl_a1b2c3...\");\n\n\/\/ PC upsert\nvar pc = await sl.PostAsync(\"\/systemlocker\/v1\/pcs\", new {\n    hostname    = Environment.MachineName,\n    os          = Environment.OSVersion.VersionString,\n    machineGuid = ReadRegistryMachineGuid(),\n    hardwareId  = ComputeHardwareFingerprint(),\n});\nstring pcId = pc.GetProperty(\"pcId\").GetString();\n\n\/\/ Material clientseitig verschluesseln (Argon2id KDF, AES-256-GCM)\n\/\/ -> siehe SystemLocker.Crypto.PackDongleMaterial(...)\nvar material = SystemLocker.Crypto.PackDongleMaterial(\n    Kd, S, account, credentialBlob, restorePassword, installationId, dongleId);\n\n\/\/ Dongle speichern (Server sieht Chiffrat, NIE Klartext)\nvar d = await sl.PostAsync(\"\/systemlocker\/v1\/dongles\", new {\n    role         = \"Main\",\n    serialNumber = donglePcsc.Serial,\n    account      = new { userName = \"timo\", domain = \".\", profileId = \"S-1-5-...\" },\n    pcId         = pcId,\n    sessionId    = Guid.NewGuid().ToString(),\n    material     = material,   \/\/ { algo, kdf, salt, nonce, tag, ciphertext }\n    version      = 1,\n});\nstring dongleId = d.GetProperty(\"dongleId\").GetString();<\/code><\/pre>\n\n  
      5.3 Restore-Passwort verifizieren (kein Klartext-Reveal)<\/h3>\n
      var v = await sl.PostAsync(\n    $\"\/systemlocker\/v1\/installations\/{installationId}\/restore-password\/verify\",\n    new { restorePassword = enteredPassword });\nbool valid = v.GetProperty(\"valid\").GetBoolean();<\/code><\/pre>\n\n  
      5.4 Metrics ingesten (Batch)<\/h3>\n
      await sl.PostAsync(\"\/systemlocker\/v1\/metrics\", new [] {\n    new { type = \"login_success\", value = 1, pcId = pcId, timestampUtc = DateTime.UtcNow.ToString(\"O\") },\n    new { type = \"heartbeat\",     value = 1, pcId = pcId, timestampUtc = DateTime.UtcNow.ToString(\"O\") },\n});<\/code><\/pre>\n\n  
      5.5 Fehlerbehandlung<\/h3>\n
      if (r.StatusCode == HttpStatusCode.Unauthorized) {\n    var err = json.GetProperty(\"error\").GetProperty(\"message\").GetString();\n    \/\/ Moegliche Werte: missing_hmac_headers, bad_timestamp, nonce_reused,\n    \/\/                  bad_signature, unknown_installation, api_key_decrypt_failed\n    throw new SystemLockerAuthException(err);\n}<\/code><\/pre>\n\n  
      6. Sicherheitsmodell (Zusammenfassung)<\/h2>\n  
        \n    
      • Der Server sieht Metadaten<\/strong> im Klartext (Kunde, PC, Rolle, Zeitstempel).<\/li>\n    
      • Der Server sieht Dongle-Material NUR als Chiffrat<\/strong> unter dem clientseitigen Restore-Key.<\/li>\n    
      • Der Server sieht das Restore-Passwort<\/strong> im Klartext beim Create (er hat es generiert)\n        und danach nur noch verschl\u00fcsselt mit SL_MASTER_KEY<\/code>. Der Master-Key liegt in\n        wp-config.php<\/code> ausserhalb der DB.<\/li>\n    
      • Vendor-Escrow (Variante A)<\/strong>: Admin kann Restore-Passw\u00f6rter wiederherstellen.\n        Jede Ausgabe wird auditiert (tb_sl_audit<\/code>).<\/li>\n    
      • Sensible Aktionen laufen \u00fcber X-SL-Admin-Secret<\/code> ODER WP-Admin-Session.<\/li>\n    
      • Alle Wizard-Requests werden HMAC-signiert. Replay-Protection via Nonce-Transient + 5-min-Window.<\/li>\n  <\/ul>\n\n  
        7. Fehlerformat<\/h2>\n
        { \"error\": { \"code\": \"unauthorized\", \"message\": \"bad_signature\" } }<\/code><\/pre>\n  
        HTTP-Codes: 200<\/code> OK · 201<\/code> Created ·\n     202<\/code> Accepted · 204<\/code> No Content ·\n     400<\/code> Bad Request · 401<\/code> Unauthorized ·\n     403<\/code> Forbidden · 404<\/code> Not Found ·\n     409<\/code> Conflict.<\/p>\n<\/article>\n    \n","protected":false},"excerpt":{"rendered":"","protected":false},"author":0,"featured_media":0,"parent":473,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-485","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.tb-software.ch\/ai\/index.php?rest_route=\/wp\/v2\/pages\/485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tb-software.ch\/ai\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.tb-software.ch\/ai\/index.php?rest_route=\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tb-software.ch\/ai\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=485"}],"version-history":[{"count":0,"href":"https:\/\/www.tb-software.ch\/ai\/index.php?rest_route=\/wp\/v2\/pages\/485\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.tb-software.ch\/ai\/index.php?rest_route=\/wp\/v2\/pages\/473"}],"wp:attachment":[{"href":"https:\/\/www.tb-software.ch\/ai\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}