From 9d1384a9dfaadfad504a1109151fc22e09f7b0cb Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 19:33:55 +0000
Subject: [PATCH 1/9] api: fix cancel-drink returning a 500

- Drink.cancel_drink deletes the record and returns nothing, but the
  view tried to serialize its return value; serialize the drink before
  canceling instead
---
 pykeg/web/api/views.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pykeg/web/api/views.py b/pykeg/web/api/views.py
index 87f3c0fb..a7789db8 100644
--- a/pykeg/web/api/views.py
+++ b/pykeg/web/api/views.py
@@ -698,9 +698,11 @@ def cancel_drink(request):
     if not form.is_valid():
         raise kbapi.BadRequestError(_form_errors(form))
     cd = form.cleaned_data
-    drink = models.Drink.objects.get(id=cd["id"])
-    res = drink.cancel_drink(spilled=cd.get("spilled", False))
-    return protolib.ToProto(res, full=True)
+    drink = get_object_or_404(models.Drink, id=cd["id"])
+    # Serialize before canceling: cancel_drink deletes the record.
+    result = protolib.ToDict(drink, full=True)
+    drink.cancel_drink(spilled=cd.get("spilled", False))
+    return result
 
 
 @require_http_methods(["POST"])

From b106f8f38f066f09c3453edf12f8b8c25e39f63f Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 19:33:55 +0000
Subject: [PATCH 2/9] api: add pycore contract tests

- pins the exact legacy-api surface kegbot-pycore (and the fullscreen
  page) depend on, ahead of deprecating everything else
---
 pykeg/web/api/pycore_contract_test.py | 167 ++++++++++++++++++++++++++
 1 file changed, 167 insertions(+)
 create mode 100644 pykeg/web/api/pycore_contract_test.py

diff --git a/pykeg/web/api/pycore_contract_test.py b/pykeg/web/api/pycore_contract_test.py
new file mode 100644
index 00000000..de7ad758
--- /dev/null
+++ b/pykeg/web/api/pycore_contract_test.py
@@ -0,0 +1,167 @@
+"""Contract tests for the legacy API surface kegbot-pycore depends on.
+
+kegbot-pycore's WebBackend (via the old kegbot.api kbapi client) calls
+exactly these endpoints and reads the asserted fields. The kegweb
+fullscreen page additionally polls the events endpoint. This is the
+compatibility contract for the deprecated v1 API: these tests must keep
+passing until pycore moves to its replacement protocol.
+"""
+
+from django.test import TestCase
+
+from pykeg.core import defaults, models
+from pykeg.util import kbjson
+
+METER_NAME = "kegboard.flow0"
+API_KEY = "123"
+
+
+class PycoreContractTestCase(TestCase):
+    def setUp(self):
+        self.site = defaults.set_defaults(set_is_setup=True, create_controller=True)
+        self.admin = models.User.objects.create(username="admin", is_staff=True)
+        self.apikey = models.ApiKey.objects.create(user=self.admin, key=API_KEY)
+
+    def get(self, subpath, data={}):
+        data = dict(data, api_key=API_KEY)
+        response = self.client.get(f"/api/{subpath}", data=data)
+        return response, kbjson.loads(response.content)
+
+    def post(self, subpath, data={}):
+        data = dict(data, api_key=API_KEY)
+        response = self.client.post(f"/api/{subpath}", data=data)
+        return response, kbjson.loads(response.content)
+
+    def start_keg(self):
+        return models.Keg.start_keg(
+            METER_NAME,
+            beverage_name="Test Beer",
+            beverage_type="beer",
+            producer_name="Test Producer",
+            style_name="Test Style",
+        )
+
+    def test_get_status(self):
+        response, data = self.get("status")
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+
+        status = data.object
+        self.assertIn("site_info", status)
+        self.assertIn("title", status.site_info)
+        self.assertIn("server_version", status.site_info)
+
+        # pycore syncs taps from status: meter_name, ml_per_tick, relay_name.
+        self.assertEqual(2, len(status.taps))
+        for tap in status.taps:
+            self.assertIn("meter_name", tap)
+            self.assertIn("ml_per_tick", tap)
+            self.assertIn("relay_name", tap)
+
+    def test_get_taps(self):
+        response, data = self.get("taps")
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+
+        taps = data.objects
+        self.assertEqual(2, len(taps))
+        self.assertEqual(METER_NAME, taps[0].meter_name)
+        tap = models.KegTap.get_from_meter_name(METER_NAME)
+        meter = tap.current_meter()
+        self.assertAlmostEqual(1 / meter.ticks_per_ml, taps[0].ml_per_tick, places=4)
+        toggle = tap.current_toggle()
+        expected_relay = toggle.toggle_name() if toggle else ""
+        self.assertEqual(expected_relay, taps[0].relay_name)
+
+    def test_record_and_cancel_drink(self):
+        self.start_keg()
+
+        response, data = self.post(f"taps/{METER_NAME}", data={"ticks": 2200})
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+
+        drink = data.object
+        self.assertIn("id", drink)
+        meter = models.KegTap.get_from_meter_name(METER_NAME).current_meter()
+        self.assertAlmostEqual(2200 / meter.ticks_per_ml, drink.volume_ml, places=3)
+        self.assertIn("session_id", drink)
+        self.assertIn("time", drink)
+
+        response, data = self.post("cancel-drink", data={"id": drink.id, "spilled": True})
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+        self.assertEqual(0, models.Drink.objects.count())
+
+    def test_record_drink_unknown_meter_is_not_found(self):
+        response, data = self.post("taps/unknown.meter", data={"ticks": 100})
+        self.assertEqual(404, response.status_code)
+        self.assertEqual("error", data.meta.result)
+        self.assertEqual("NotFoundError", data.error.code)
+
+    def test_log_sensor_reading(self):
+        response, data = self.post("thermo-sensors/kegboard.thermo0", data={"temp_c": 4.5})
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+
+        log = data.object
+        self.assertAlmostEqual(4.5, log.temperature_c, places=3)
+        self.assertIn("sensor_id", log)
+        self.assertIn("time", log)
+
+    def test_get_auth_token(self):
+        response, data = self.get("auth-tokens/core.rfid/deadbeef")
+        self.assertEqual(404, response.status_code)
+        self.assertEqual("error", data.meta.result)
+        self.assertEqual("NotFoundError", data.error.code)
+
+        token = models.AuthenticationToken.create_auth_token(
+            "core.rfid", "deadbeef", username=self.admin.username
+        )
+        token.enabled = True
+        token.save()
+
+        response, data = self.get("auth-tokens/core.rfid/deadbeef")
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+
+        obj = data.object
+        self.assertEqual("core.rfid", obj.auth_device)
+        self.assertEqual("deadbeef", obj.token_value)
+        self.assertEqual(self.admin.username, obj.username)
+        self.assertTrue(obj.enabled)
+
+    def test_create_controller_and_meters(self):
+        response, data = self.post(
+            "controllers",
+            data={"name": "kegboard2", "model_name": "unknown", "serial_number": "unknown"},
+        )
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+
+        controller = data.object
+        self.assertIn("id", controller)
+        self.assertEqual("kegboard2", controller.name)
+
+        response, data = self.post(
+            "flow-meters",
+            data={"controller": controller.id, "port_name": "flow0", "ticks_per_ml": 2.2},
+        )
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+
+        meter = data.object
+        self.assertIn("id", meter)
+        self.assertEqual("kegboard2.flow0", meter.name)
+
+    def test_get_events(self):
+        # The kegweb fullscreen page polls events and reads objects[0].id.
+        self.start_keg()
+
+        response, data = self.get("events/")
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("ok", data.meta.result)
+        self.assertTrue(len(data.objects) > 0)
+        self.assertIn("id", data.objects[0])
+        # Newest first.
+        ids = [e.id for e in data.objects]
+        self.assertEqual(sorted(ids, reverse=True), ids)

From b347c457f079f6a3e538618388fbd355f0885e58 Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 19:37:01 +0000
Subject: [PATCH 3/9] api: stop using protocol buffers

- legacy responses are now built as plain dicts (pykeg.web.api.serialize)
  with the same field names and presence rules the proto encoding
  produced; fields the old encoding marked deprecated are dropped
- api exceptions move to pykeg.web.api.exceptions; pykeg.proto is gone
  and the protobuf dependency (and last tie to kegbot-api) with it
---
 pykeg/contrib/webhook/plugin.py        |   4 +-
 pykeg/proto/Makefile                   |   8 -
 pykeg/proto/README.md                  |  15 -
 pykeg/proto/__init__.py                |   0
 pykeg/proto/api.proto                  | 144 ------
 pykeg/proto/api_pb2.py                 |  97 ----
 pykeg/proto/kbapi.py                   |  31 --
 pykeg/proto/models.proto               | 620 -------------------------
 pykeg/proto/models_pb2.py              | 343 --------------
 pykeg/proto/protolib.py                | 493 --------------------
 pykeg/proto/protoutil.py               |  50 --
 pykeg/proto/util.py                    |  25 -
 pykeg/{proto => web/api}/exceptions.py |  17 +-
 pykeg/web/api/serialize.py             | 404 ++++++++++++++++
 pykeg/web/api/util.py                  |  24 +-
 pykeg/web/api/views.py                 | 115 +++--
 pyproject.toml                         |   3 -
 uv.lock                                |  17 -
 18 files changed, 476 insertions(+), 1934 deletions(-)
 delete mode 100644 pykeg/proto/Makefile
 delete mode 100644 pykeg/proto/README.md
 delete mode 100644 pykeg/proto/__init__.py
 delete mode 100644 pykeg/proto/api.proto
 delete mode 100644 pykeg/proto/api_pb2.py
 delete mode 100644 pykeg/proto/kbapi.py
 delete mode 100644 pykeg/proto/models.proto
 delete mode 100644 pykeg/proto/models_pb2.py
 delete mode 100644 pykeg/proto/protolib.py
 delete mode 100644 pykeg/proto/protoutil.py
 delete mode 100644 pykeg/proto/util.py
 rename pykeg/{proto => web/api}/exceptions.py (73%)
 create mode 100644 pykeg/web/api/serialize.py

diff --git a/pykeg/contrib/webhook/plugin.py b/pykeg/contrib/webhook/plugin.py
index 2a58b171..f3d9fd7e 100644
--- a/pykeg/contrib/webhook/plugin.py
+++ b/pykeg/contrib/webhook/plugin.py
@@ -2,7 +2,7 @@
 
 from pykeg.core.util import SuppressTaskErrors
 from pykeg.plugin import plugin
-from pykeg.proto import protolib
+from pykeg.web.api import serialize
 
 from . import forms, tasks, views
 
@@ -27,7 +27,7 @@ def handle_event(self, event):
         self.logger.info(f"Handling new event: {event.id}")
         settings = self.get_site_settings()
         urls = settings.get("webhook_urls", "").strip().split()
-        event_dict = protolib.ToDict(event, full=True)
+        event_dict = serialize.to_dict(event, full=True)
         for url in urls:
             with SuppressTaskErrors(self.logger):
                 tasks.webhook_post.delay(url, event_dict)
diff --git a/pykeg/proto/Makefile b/pykeg/proto/Makefile
deleted file mode 100644
index da881f35..00000000
--- a/pykeg/proto/Makefile
+++ /dev/null
@@ -1,8 +0,0 @@
-all: python
-
-python:
-	protoc --python_out=. *.proto
-
-.PHONY: python
-
-# vim: noet
diff --git a/pykeg/proto/README.md b/pykeg/proto/README.md
deleted file mode 100644
index b203ee38..00000000
--- a/pykeg/proto/README.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# Kegbot `proto` files
-
-Ages ago, we selected [Protocol
-Buffers](https://developers.google.com/protocol-buffers) to define Kegbot's
-core models and aspects of the rest API. This directory stores the proto
-definitions and the python generated code.
-
-This code has been migrated from the [kegbot-api
-repo](https://github.com/kegbot/kegbot-api) which is now deprecated.
-
-## Other clients
-
-At time of writing, the [Kegbot Android
-App](https://github.com/kegbot/kegbot-android) also uses these protobuf
-definitions.
diff --git a/pykeg/proto/__init__.py b/pykeg/proto/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/pykeg/proto/api.proto b/pykeg/proto/api.proto
deleted file mode 100644
index 7154e945..00000000
--- a/pykeg/proto/api.proto
+++ /dev/null
@@ -1,144 +0,0 @@
-syntax = "proto2";
-option java_package = "org.kegbot.proto";
-option optimize_for = CODE_SIZE;
-
-import "models.proto";
-
-// Common
-
-message Meta {
-
-  // The total number of records available for this request.
-  optional uint32 total = 1;
-
-  // The maximum number of records returned in this request.
-  optional uint32 limit = 2;
-
-  // The position of the first record returned, among "total".
-  optional uint32 pos = 3;
-}
-
-// Requests
-
-message UserRegistrationRequest {
-
-  // Desired username.
-  required string username = 1;
-
-  // User's e-mail address.
-  required string email = 2;
-
-  // Initial password for logging in.  If unspecified, the account will be
-  // registered with a random password, which can be e-mailed to the user.
-  optional string password = 3;
-
-  // One of "male", "female".
-  optional string gender = 4;
-
-  // Twitter username.
-  optional string twitter_name = 5;
-}
-
-// Message used for recording a new drink on the backend.
-message RecordDrinkRequest {
-
-  // Name of the tap on which this drink was poured.  This information is
-  // required, but this field may be omitted when the tap name is given
-  // elsewhere.  (In the Kegweb API, the tap_name is part of the URL receiving
-  // the POST.)
-  optional string tap_name = 1;
-
-  // The number of ticks, as reported by the flowmeter.  Required.
-  required uint32 ticks = 2;
-
-  // The volume of the pour.  If unspecified, the backend will use the current
-  // tap configuration to compute the pour's volume based on the value of
-  // "ticks".
-  optional float volume_ml = 3;
-
-  // The username responsible for the pour.  If unspecified, this pour is
-  // treated as an anonymous pour.
-  optional string username = 4;
-
-  // The date and time of the pour, in seconds before "now", where "now" is the
-  // current time on the backend at the time the request is processed.  If this
-  // field is unspecified, a default value of "0" (meaning "now") is assumed.
-  // This value is ignored if "record_date" is specified.
-  optional uint32 seconds_ago = 5 [default = 0];
-
-  // The absolute date and time of the pour, as an ISO8061 UTC timestamp.  If
-  // specified and valid, this value supercedes any value given for
-  // "seconds_ago", which will be ignored.
-  optional string record_date = 6;
-
-  // The time taken, in seconds, to complete the pour.
-  optional uint32 duration_seconds = 7;
-
-  // The authentication token used to pour the drink.
-  optional string auth_token = 8;
-
-  // If true, the pour is recorded as "spilled": no drink record will be
-  // generated, and all fields other than "tap_name" and the volume ("ticks", or
-  // "volume_ml" if given) are ignored.  The volume will be added to the
-  // spilled total for the tap’s current keg.
-  optional bool spilled = 9;
-
-  // Optional message from the user about the pour.
-  optional string shout = 10;
-
-  // See Drink model.
-  optional string tick_time_series = 11;
-}
-
-// Message used for recording a temperature sensor reading on the backend.
-message RecordTemperatureRequest {
-
-  // The name of the sensor, as stored in the backend.
-  required string sensor_name = 1;
-
-  // The observed temperature, in degress centigrade.
-  required float temp_c = 2;
-
-  // The date of the reading, as an ISO8601 UTC timestamp.  If this field is
-  // unspecified, the record_date will be the current time on the backend at the
-  // time the request is processed.
-  optional string record_date = 3;
-}
-
-// Responses
-
-message SyncResponse {
-  // All configured controllers.
-  repeated Controller controllers = 1;
-
-  // Recently-poured drinks.
-  repeated Drink drinks = 2;
-
-  // Recent system events.
-  repeated SystemEvent events = 3;
-
-  // Kegs on tap.
-  repeated Keg active_kegs = 4;
-
-  // All configured meters.
-  repeated FlowMeter meters = 5;
-
-  // Site info.
-  optional SiteInfo site_info = 6;
-
-  // Sound events.
-  repeated SoundEvent sound_events = 7;
-
-  // All taps.
-  repeated KegTap taps = 8;
-
-  // All toggles.
-  repeated FlowToggle toggles = 9;
-
-  // Current session (if there is one).
-  optional Session active_session = 10;
-
-  // Currently-active users (if any).
-  repeated User active_users = 11;
-
-}
diff --git a/pykeg/proto/api_pb2.py b/pykeg/proto/api_pb2.py
deleted file mode 100644
index 303dea20..00000000
--- a/pykeg/proto/api_pb2.py
+++ /dev/null
@@ -1,97 +0,0 @@
-# -*- coding: utf-8 -*-
-# Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: api.proto
-"""Generated protocol buffer code."""
-from google.protobuf import descriptor as _descriptor
-from google.protobuf import descriptor_pool as _descriptor_pool
-from google.protobuf import message as _message
-from google.protobuf import reflection as _reflection
-from google.protobuf import symbol_database as _symbol_database
-
-# @@protoc_insertion_point(imports)
-
-_sym_db = _symbol_database.Default()
-
-
-from . import models_pb2 as models__pb2
-
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
-    b'\n\tapi.proto\x1a\x0cmodels.proto"1\n\x04Meta\x12\r\n\x05total\x18\x01 \x01(\r\x12\r\n\x05limit\x18\x02 \x01(\r\x12\x0b\n\x03pos\x18\x03 \x01(\r"r\n\x17UserRegistrationRequest\x12\x10\n\x08username\x18\x01 \x02(\t\x12\r\n\x05\x65mail\x18\x02 \x02(\t\x12\x10\n\x08password\x18\x03 \x01(\t\x12\x0e\n\x06gender\x18\x04 \x01(\t\x12\x14\n\x0ctwitter_name\x18\x05 \x01(\t"\xef\x01\n\x12RecordDrinkRequest\x12\x10\n\x08tap_name\x18\x01 \x01(\t\x12\r\n\x05ticks\x18\x02 \x02(\r\x12\x11\n\tvolume_ml\x18\x03 \x01(\x02\x12\x10\n\x08username\x18\x04 \x01(\t\x12\x16\n\x0bseconds_ago\x18\x05 \x01(\r:\x01\x30\x12\x13\n\x0brecord_date\x18\x06 \x01(\t\x12\x18\n\x10\x64uration_seconds\x18\x07 \x01(\r\x12\x12\n\nauth_token\x18\x08 \x01(\t\x12\x0f\n\x07spilled\x18\t \x01(\x08\x12\r\n\x05shout\x18\n \x01(\t\x12\x18\n\x10tick_time_series\x18\x0b \x01(\t"T\n\x18RecordTemperatureRequest\x12\x13\n\x0bsensor_name\x18\x01 \x02(\t\x12\x0e\n\x06temp_c\x18\x02 \x02(\x02\x12\x13\n\x0brecord_date\x18\x03 \x01(\t"\xd2\x02\n\x0cSyncResponse\x12 \n\x0b\x63ontrollers\x18\x01 \x03(\x0b\x32\x0b.Controller\x12\x16\n\x06\x64rinks\x18\x02 \x03(\x0b\x32\x06.Drink\x12\x1c\n\x06\x65vents\x18\x03 \x03(\x0b\x32\x0c.SystemEvent\x12\x19\n\x0b\x61\x63tive_kegs\x18\x04 \x03(\x0b\x32\x04.Keg\x12\x1a\n\x06meters\x18\x05 \x03(\x0b\x32\n.FlowMeter\x12\x1c\n\tsite_info\x18\x06 \x01(\x0b\x32\t.SiteInfo\x12!\n\x0csound_events\x18\x07 \x03(\x0b\x32\x0b.SoundEvent\x12\x15\n\x04taps\x18\x08 \x03(\x0b\x32\x07.KegTap\x12\x1c\n\x07toggles\x18\t \x03(\x0b\x32\x0b.FlowToggle\x12 \n\x0e\x61\x63tive_session\x18\n \x01(\x0b\x32\x08.Session\x12\x1b\n\x0c\x61\x63tive_users\x18\x0b \x03(\x0b\x32\x05.UserB\x14\n\x10org.kegbot.protoH\x02'
-)
-
-
-_META = DESCRIPTOR.message_types_by_name["Meta"]
-_USERREGISTRATIONREQUEST = DESCRIPTOR.message_types_by_name["UserRegistrationRequest"]
-_RECORDDRINKREQUEST = DESCRIPTOR.message_types_by_name["RecordDrinkRequest"]
-_RECORDTEMPERATUREREQUEST = DESCRIPTOR.message_types_by_name["RecordTemperatureRequest"]
-_SYNCRESPONSE = DESCRIPTOR.message_types_by_name["SyncResponse"]
-Meta = _reflection.GeneratedProtocolMessageType(
-    "Meta",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _META,
-        "__module__": "api_pb2"
-        # @@protoc_insertion_point(class_scope:Meta)
-    },
-)
-_sym_db.RegisterMessage(Meta)
-
-UserRegistrationRequest = _reflection.GeneratedProtocolMessageType(
-    "UserRegistrationRequest",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _USERREGISTRATIONREQUEST,
-        "__module__": "api_pb2"
-        # @@protoc_insertion_point(class_scope:UserRegistrationRequest)
-    },
-)
-_sym_db.RegisterMessage(UserRegistrationRequest)
-
-RecordDrinkRequest = _reflection.GeneratedProtocolMessageType(
-    "RecordDrinkRequest",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _RECORDDRINKREQUEST,
-        "__module__": "api_pb2"
-        # @@protoc_insertion_point(class_scope:RecordDrinkRequest)
-    },
-)
-_sym_db.RegisterMessage(RecordDrinkRequest)
-
-RecordTemperatureRequest = _reflection.GeneratedProtocolMessageType(
-    "RecordTemperatureRequest",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _RECORDTEMPERATUREREQUEST,
-        "__module__": "api_pb2"
-        # @@protoc_insertion_point(class_scope:RecordTemperatureRequest)
-    },
-)
-_sym_db.RegisterMessage(RecordTemperatureRequest)
-
-SyncResponse = _reflection.GeneratedProtocolMessageType(
-    "SyncResponse",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _SYNCRESPONSE,
-        "__module__": "api_pb2"
-        # @@protoc_insertion_point(class_scope:SyncResponse)
-    },
-)
-_sym_db.RegisterMessage(SyncResponse)
-
-if _descriptor._USE_C_DESCRIPTORS == False:
-
-    DESCRIPTOR._options = None
-    DESCRIPTOR._serialized_options = b"\n\020org.kegbot.protoH\002"
-    _META._serialized_start = 27
-    _META._serialized_end = 76
-    _USERREGISTRATIONREQUEST._serialized_start = 78
-    _USERREGISTRATIONREQUEST._serialized_end = 192
-    _RECORDDRINKREQUEST._serialized_start = 195
-    _RECORDDRINKREQUEST._serialized_end = 434
-    _RECORDTEMPERATUREREQUEST._serialized_start = 436
-    _RECORDTEMPERATUREREQUEST._serialized_end = 520
-    _SYNCRESPONSE._serialized_start = 523
-    _SYNCRESPONSE._serialized_end = 861
-# @@protoc_insertion_point(module_scope)
diff --git a/pykeg/proto/kbapi.py b/pykeg/proto/kbapi.py
deleted file mode 100644
index fbff9816..00000000
--- a/pykeg/proto/kbapi.py
+++ /dev/null
@@ -1,31 +0,0 @@
-"""Kegweb API exceptions.
-
-These are re-exported here so server code can `from pykeg.proto import kbapi`
-and reference e.g. `kbapi.NoAuthTokenError`. The old gflags-based HTTP client
-lived here too; it was unused by the server and now lives in the kegbot-api
-project.
-"""
-
-from .exceptions import (
-    BadApiKeyError,
-    BadRequestError,
-    Error,
-    ErrorCodeToException,
-    NoAuthTokenError,
-    NotFoundError,
-    PermissionDeniedError,
-    RequestError,
-    ServerError,
-)
-
-__all__ = [
-    "BadApiKeyError",
-    "BadRequestError",
-    "Error",
-    "ErrorCodeToException",
-    "NoAuthTokenError",
-    "NotFoundError",
-    "PermissionDeniedError",
-    "RequestError",
-    "ServerError",
-]
diff --git a/pykeg/proto/models.proto b/pykeg/proto/models.proto
deleted file mode 100644
index b6071bae..00000000
--- a/pykeg/proto/models.proto
+++ /dev/null
@@ -1,620 +0,0 @@
-syntax = "proto2";
-option java_package = "org.kegbot.proto";
-option optimize_for = CODE_SIZE;
-
-// An authentication token, which a drinker uses to authenticate to the system.
-message AuthenticationToken {
-  // The unique identifier for this token.
-  required uint32 id = 1;
-
-  // The name of the auth device that owns this token, such as ``core.onewire``
-  // or ``contrib.phidget.rfid``.
-  required string auth_device = 2;
-
-  // The unique key.
-  required string token_value = 3;
-
-  // The user owning the token.
-  optional string username = 4;
-
-  // An optional human-readable name for this token.
-  optional string nice_name = 5;
-
-  // True if the token is enabled.
-  optional bool enabled = 6;
-
-  // The date the token was created, as an ISO8061 UTC timestamp.
-  required string created_time = 7;
-
-  // The date after which the token is invalid, as an ISO8061 UTC timestamp.
-  // Only available to admin users.
-  optional string expire_time = 8;
-
-  // The token's pin, if any.
-  // Only available to admin users.
-  optional string pin = 9;
-
-  optional User user = 10;
-}
-
-// A beverage production company or brand.
-message BeverageProducer {
-
-  // The unique identifier for this producer.
-  required uint32 id = 1;
-
-  // The name of the brewer or production company.
-  required string name = 2;
-
-  // Country of origin.
-  optional string country = 3;
-
-  // State of origin.
-  optional string origin_state = 4;
-
-  // City of origin.
-  optional string origin_city = 5;
-
-  // True if this is a home producer.
-  optional bool is_homebrew = 6;
-
-  // URL for producer.
-  optional string url = 7;
-
-  // Free-form description.
-  optional string description = 8;
-
-  // Image.
-  optional Image picture = 9;
-
-}
-
-// A type of beer, coffee, wine, or other beverage.
-message Beverage {
-
-  // Unique id for this beverage.
-  required uint32 id = 1;
-
-  // Beverage name.
-  required string name = 2;
-
-  // Producer.
-  required BeverageProducer producer = 3;
-
-  // Type of beverage.
-  required string beverage_type = 4;
-
-  // Beverage style.
-  optional string style = 5;
-
-  // Free-form description.
-  optional string description = 6;
-
-  // Logo or other image.
-  optional Image picture = 7;
-
-  // Vintage.
-  optional uint32 vintage_year = 8;
-
-  // Alcohol by volume (0.0-100.0).
-  optional double abv_percent = 9;
-
-  // Calories.
-  optional double calories_per_ml = 10;
-
-  // Carbohydrates.
-  optional double carbs_per_ml = 11;
-
-  // Original gravity.
-  optional double original_gravity = 12;
-
-  // Specific gravity.
-  optional double specific_gravity = 13;
-
-  // Untappd id (for beers only).
-  optional string untappd_id = 14;
-
-  // Beverage backend.
-  optional string beverage_backend = 15;
-
-  // Id within beverage backend.
-  optional string beverage_backend_id = 16;
-
-  // v1.1 fields
-
-  optional string color_hex = 17;
-  optional double srm = 18;
-  optional double ibu = 19;
-  optional double star_rating = 20;
-
-}
-
-// A named beer style of beer, such as "India Pale Ale".
-message BeerStyle {
-
-  // The unique identifier for this beer style.
-  required uint32 id = 1;
-
-  // The name of the beer style.
-  required string name = 2;
-
-}
-
-// A specific kind of beer: describes the beer's name, style, and brewer.
-message BeerType {
-
-  // The unique identifier for this beer type.
-  required string id = 1;
-
-  // The brand name of the beer.
-  required string name = 2;
-
-  // Brewer information for the beer.  May refer to an 'unknown' or generic
-  // brewer record.
-  required string brewer_id = 3;
-
-  // Style information for the beer.  May refer to an 'unknown' or generic beer
-  // style.
-  required string style_id = 4;
-
-  // For seasonal or special edition beers, the year or other edition name.
-  optional string edition = 6;
-
-  // Alcohol by volume, as a percentage of the total volume.
-  optional double abv = 7;
-
-  // Number of calories per ounce of beverage.
-  optional double calories_oz = 8;
-
-  // Number of carbohydrates per ounce of beverage.
-  optional double carbs_oz = 9;
-
-  // Specific/final gravity of the beer, if known.
-  optional double specific_gravity = 10;
-
-  // Original gravity of the beer, if known.
-  optional double original_gravity = 11;
-
-  // Image for this beer.
-  optional Image image = 12;
-
-}
-
-// A specific producer of our favorite beverage.
-message Brewer {
-
-  // The unique identifier for this beer type.
-  required string id = 1;
-
-  // The name of the brewer.
-  required string name = 2;
-
-  // The country of the brewer's headquarters.
-  optional string country = 3 [default = ''];
-
-  // The state of the brewer's headquarters.
-  optional string origin_state = 4 [default = ''];
-
-  // The city of the brewer's headquarters.
-  optional string origin_city = 5 [default = ''];
-
-  // Type of production (usually either 'retail' or 'homebrew').
-  optional string production = 6 [default = ''];
-
-  // URL of brewer.
-  optional string url = 7 [default = ''];
-
-  // Free-form description.
-  optional string description = 8 [default = ''];
-
-  // Image or logo for this brewer.
-  optional Image image = 9;
-
-}
-
-// Describes a single recorded pour from the Kegbot.
-message Drink {
-
-  // The unique identifier for this drink.
-  required uint32 id = 1;
-
-  // The number of meter ticks recorded for the drink.
-  required uint32 ticks = 2;
-
-  // The volume of the drink, in milliliters.
-  required double volume_ml = 3;
-
-  // The session this drink belongs to.
-  required uint32 session_id = 4;
-
-  // UTC time when the drink was poured, as an ISO8061 UTC timestamp.
-  required string time = 5;
-
-  // Duration, in seconds, of the pour.
-  optional uint32 duration = 6;
-
-  // The Keg from which the drink was poured.  May be unset if the drink was
-  // not associated with a keg.
-  optional uint32 keg_id = 8;
-
-  // The User that poured the drink.  Snset if the drinker was unknown
-  // (anonymous pour).
-  optional string user_id = 9;
-
-  // Auth token value used to pour the drink, if known.
-  optional uint32 auth_token_id = 10;
-
-  // Canonical URL for this object.
-  optional string url = 11;
-
-  // Comment from the drinker at the time of the pour.
-  optional string shout = 12;
-
-  optional User user = 13;
-  optional Keg keg = 14;
-  optional Session session = 15;
-  repeated Image images = 16;
-
-  // Vector of tick updates. Format is: "<time>:<amount> [<time>:<amount> ...]",
-  // where "time" is the delta (in ms) from the previous reading, and "amount"
-  // is the delta in ticks from the previous reading.
-  optional string tick_time_series = 17;
-}
-
-// Describes an image.
-message Image {
-
-  // The default URL of this image.
-  required string url = 1;
-
-  // The width of the image in pixels.
-  optional uint32 width = 2;
-
-  // The height of the image in pixels.
-  optional uint32 height = 3;
-
-  // The date the picture was created.
-  optional string time = 4;
-
-  // The caption, if any.
-  optional string caption = 5;
-
-  // The user associated with this picture, if any.
-  optional string user_id = 6;
-
-  // The keg associated with this picture, if any.
-  optional uint32 keg_id = 7;
-
-  // The session associated with this picture, if any.
-  optional uint32 session_id = 8;
-
-  // The drink associated with this picture, if any.
-  optional uint32 drink_id = 9;
-
-  optional string thumbnail_url = 10;
-
-  optional string original_url = 11;
-
-  optional string small_resized_url = 13;
-}
-
-// A single instance of a Keg that was attached to the Kegbot.
-message Keg {
-
-  // The unique identifier for this keg.
-  required uint32 id = 1;
-
-  // Shell type.
-  required string keg_type = 2;
-
-  // Volume remaining in the keg, in milliliters.
-  required double remaining_volume_ml = 3;
-
-  // Initial volume.
-  required double full_volume_ml = 4;
-
-  // Served volume.
-  required double served_volume_ml = 5;
-
-  // Total portion of the original volume that was spoiled, in milliliters.
-  // Spilled volume is not attributed to any drink, but deducts from the keg
-  // total.
-  required double spilled_volume_ml = 6;
-
-  // Percentage of the keg that remains, as a value between 0 and 100.
-  required double percent_full = 7;
-
-  // UTC time when the keg was started or tapped, as an ISO8061 UTC timestamp.
-  optional string start_time = 8;
-
-  // Local time when the keg was completed, as an ISO8061 UTC timestamp.  This
-  // should be no sooner than the time of the most recent drink.  If the keg's
-  // `status` is not 'offline', this value is undefined.
-  optional string end_time = 9;
-
-  // True if the Keg is currently online.
-  optional bool online = 10;
-
-  // The adminstrator's description of this keg.
-  optional string description = 11;
-
-  // Beverage type.
-  optional Beverage beverage = 12;
-
-  optional string illustration_url = 21;
-  optional string illustration_thumbnail_url = 22;
-
-  optional BeerType type = 13 [deprecated = true];
-  optional string type_id = 14 [deprecated = true];
-  optional uint32 size_id = 15 [deprecated = true];
-  optional KegSize size = 16 [deprecated = true];
-  optional string size_name = 17 [deprecated = true];
-  optional double size_volume_ml = 18 [deprecated = true];
-  optional double volume_ml_remain = 19 [deprecated = true];
-  optional double spilled_ml = 20 [deprecated = true];
-
-}
-
-// A common keg size.
-message KegSize {
-
-  // The unique identifier for this keg size.
-  required uint32 id = 1;
-
-  // The name of the size ("Half Barrel", "Pony keg", ...)
-  required string name = 2;
-
-  // The volume of the size, in milliliters.
-  required double volume_ml = 3;
-
-}
-
-// Describes a hardware controller
-message Controller {
-  required uint32 id = 1;
-  required string name = 2;
-
-  optional string model_name = 3;
-  optional string serial_number = 4;
-}
-
-message FlowMeter {
-  required uint32 id = 1;
-  required string name = 2;
-  required string port_name = 3;
-  required double ticks_per_ml = 4;
-
-  optional Controller controller = 5;
-}
-
-message FlowToggle {
-  required uint32 id = 1;
-  required string name = 2;
-  required string port_name = 3;
-
-  optional Controller controller = 4;
-}
-
-// Describes a tap which is available for pouring beer.
-message KegTap {
-
-  // The unique identifier for this tap.
-  required uint32 id = 1;
-
-  // The name of the tap, a free-form string ("Main tap", "Wet bar", ...)
-  required string name = 2;
-
-  // The name of the flow meter assigned to this tap.
-  // Deprecated in favor of 'meter'
-  optional string meter_name = 3 [deprecated = true];
-
-  // The currently-connected meter, if any.
-  optional FlowMeter meter = 12;
-
-  // The currently-connected toggle, if any.
-  optional FlowToggle toggle = 13;
-
-  // The currently-connected temperature sensor, if any.
-  optional ThermoSensor thermo_sensor = 14;
-
-  // The relay name of the tap.
-  optional string relay_name = 4;
-
-  // Size of each flowmeter tick, in milliliters.
-  optional double ml_per_tick = 5;
-
-  // A longer description of the tap.
-  optional string description = 6;
-
-  // The temperature sensor for the tap, if any.
-  optional uint32 thermo_sensor_id = 8;
-
-  // The last temperature log, if any.
-  optional ThermoLog last_temperature = 9;
-
-  // The Keg currently assigned to the tap.  May be unset if there is no keg
-  // configured.
-  optional uint32 current_keg_id = 10;
-  optional Keg current_keg = 11;
-
-  optional uint32 sort_order = 15 [default = 0];
-}
-
-// A session is a group of drinks occuring within the same time window.  Every
-// poured drink will be associated with exactly one session.
-message Session {
-
-  // The unique identifier for this session.
-  required uint32 id = 1;
-
-  // The time this session was started, as an ISO8061 UTC timestamp.
-  required string start_time = 2;
-
-  // The time this session ended, as an ISO8061 UTC timestamp.
-  required string end_time = 3;
-
-  // Total volume poured during this session, in milliliters.
-  required double volume_ml = 4;
-
-  // A name for this session.
-  optional string name = 5;
-
-  // The slugified name of this session.
-  optional string slug = 6 [deprecated = true];
-
-  // Canonical URL for this object.
-  optional string url = 7;
-
-  // True if session is currently active.
-  optional bool is_active = 8;
-}
-
-// A log entry for a temperature sensor.
-message ThermoLog {
-
-  // The unique identifier for this log entry.
-  required uint32 id = 1;
-
-  // The sensor id that produced this log entry.
-  required uint32 sensor_id = 2;
-
-  // The temperature, in degrees C.
-  required double temperature_c = 3;
-
-  // The recording date, as an ISO8061 UTC timestamp.
-  required string time = 4;
-}
-
-// A temperature sensor configured in the system.
-message ThermoSensor {
-
-  // The unique identifier for this temperature sensor.
-  required uint32 id = 1;
-
-  // The raw/unique name of the sensor.
-  required string sensor_name = 2;
-
-  // The friendly name for the sensor.
-  optional string nice_name = 3;
-
-  // The most recent recording for this sensor.
-  optional ThermoLog last_log = 6;
-
-  optional double last_temp = 4 [deprecated = true];
-  optional string last_time = 5 [deprecated = true];
-}
-
-// A drinker registered in the kegbot system.
-message User {
-
-  // The user's unique username.
-  required string username = 1;
-
-  // A non-unique "display" name, if available.
-  optional string display_name = 13;
-
-  // The profile picture of the user.  May be unset if the user does not have a
-  // profile picture.
-  optional Image image = 2;
-
-  // True if the user is active.  This value will be false for accounts which
-  // have been disabled by the admin.
-  required bool is_active = 3 [default = true];
-
-  // The first name of the user.
-  // Not currently used.
-  optional string first_name = 4;
-
-  // The last name of the user.
-  // Not currently used.
-  optional string last_name = 5;
-
-  // The email address of the user.
-  // Only available to admin users.
-  optional string email = 6;
-
-  // The password of the user.
-  // Only available to admin users.
-  optional string password = 7;
-
-  // True if the user is a member of the system's staff.
-  // Only available to admin users.
-  optional bool is_staff = 8;
-
-  // True if the user is an administrator.
-  // Only available to admin users.
-  optional bool is_superuser = 9;
-
-  // UTC time for the user's last login, as ISO8061 string.
-  // Only available to admin users.
-  optional string last_login = 10;
-
-  // UTC time for the user's registration, as ISO8061 string.
-  // Only available to admin users.
-  optional string date_joined = 11;
-
-  // Canonical URL for this object.
-  optional string url = 12;
-}
-
-// Site information.
-
-message SiteInfo {
-  optional string title = 1;
-  optional string server_version = 2;
-}
-
-// Describes various events that happen in the system.
-message SystemEvent {
-
-  // The unqiue identifier for this event.
-  required uint32 id = 1;
-
-  // The kind of the event being reported. Current values: ``drink_poured``,
-  // ``session_started``, ``session_joined``, ``keg_tapped``, ``keg_ended``.
-  required string kind = 2;
-
-  // The time of this event, as an ISO8061 UTC timestamp.
-  required string time = 3;
-
-  // If a drink caused this event (as in ``drink_poured``, ``session_started``,
-  // and ``session_joined``), this field gives its id.
-  optional uint32 drink_id = 4;
-
-  // If this event relates to a specific keg (as in most events), this field
-  // gives its id.
-  optional uint32 keg_id = 5;
-
-  // If this event relates to a specific session (as in ``drink_poured``,
-  // ``session_started``, and ``session_joined``), this field gives its id.
-  optional uint32 session_id = 6;
-
-  // If this event relates to a specific user (as in ``drink_poured``,
-  // ``session_started``, and ``session_joined`` when the user is not
-  // anonymous), this field gives the user's id.
-  optional string user_id = 7;
-
-  optional Image image = 8;
-  optional User user = 9;
-  optional Drink drink = 10;
-  optional Keg keg = 11;
-  optional Session session = 12;
-}
-
-// An administrator-defined sound file to play for certain pour events.
-message SoundEvent {
-
-  // The name of this event.
-  required string event_name = 1;
-
-  // The predicate for the event.
-  // Not currently used.
-  optional string event_predicate = 2;
-
-  // The URL for the sound file to play during this event.
-  required string sound_url = 3;
-
-  // A specific username that this event applies to.
-  // Not currently used.
-  optional string user = 4;
-}
diff --git a/pykeg/proto/models_pb2.py b/pykeg/proto/models_pb2.py
deleted file mode 100644
index e9f9672e..00000000
--- a/pykeg/proto/models_pb2.py
+++ /dev/null
@@ -1,343 +0,0 @@
-# -*- coding: utf-8 -*-
-# Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: models.proto
-"""Generated protocol buffer code."""
-from google.protobuf import descriptor as _descriptor
-from google.protobuf import descriptor_pool as _descriptor_pool
-from google.protobuf import message as _message
-from google.protobuf import reflection as _reflection
-from google.protobuf import symbol_database as _symbol_database
-
-# @@protoc_insertion_point(imports)
-
-_sym_db = _symbol_database.Default()
-
-
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
-    b'\n\x0cmodels.proto"\xce\x01\n\x13\x41uthenticationToken\x12\n\n\x02id\x18\x01 \x02(\r\x12\x13\n\x0b\x61uth_device\x18\x02 \x02(\t\x12\x13\n\x0btoken_value\x18\x03 \x02(\t\x12\x10\n\x08username\x18\x04 \x01(\t\x12\x11\n\tnice_name\x18\x05 \x01(\t\x12\x0f\n\x07\x65nabled\x18\x06 \x01(\x08\x12\x14\n\x0c\x63reated_time\x18\x07 \x02(\t\x12\x13\n\x0b\x65xpire_time\x18\x08 \x01(\t\x12\x0b\n\x03pin\x18\t \x01(\t\x12\x13\n\x04user\x18\n \x01(\x0b\x32\x05.User"\xb8\x01\n\x10\x42\x65verageProducer\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04name\x18\x02 \x02(\t\x12\x0f\n\x07\x63ountry\x18\x03 \x01(\t\x12\x14\n\x0corigin_state\x18\x04 \x01(\t\x12\x13\n\x0borigin_city\x18\x05 \x01(\t\x12\x13\n\x0bis_homebrew\x18\x06 \x01(\x08\x12\x0b\n\x03url\x18\x07 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x08 \x01(\t\x12\x17\n\x07picture\x18\t \x01(\x0b\x32\x06.Image"\xb8\x03\n\x08\x42\x65verage\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04name\x18\x02 \x02(\t\x12#\n\x08producer\x18\x03 \x02(\x0b\x32\x11.BeverageProducer\x12\x15\n\rbeverage_type\x18\x04 \x02(\t\x12\r\n\x05style\x18\x05 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x06 \x01(\t\x12\x17\n\x07picture\x18\x07 \x01(\x0b\x32\x06.Image\x12\x14\n\x0cvintage_year\x18\x08 \x01(\r\x12\x13\n\x0b\x61\x62v_percent\x18\t \x01(\x01\x12\x17\n\x0f\x63\x61lories_per_ml\x18\n \x01(\x01\x12\x14\n\x0c\x63\x61rbs_per_ml\x18\x0b \x01(\x01\x12\x18\n\x10original_gravity\x18\x0c \x01(\x01\x12\x18\n\x10specific_gravity\x18\r \x01(\x01\x12\x12\n\nuntappd_id\x18\x0e \x01(\t\x12\x18\n\x10\x62\x65verage_backend\x18\x0f \x01(\t\x12\x1b\n\x13\x62\x65verage_backend_id\x18\x10 \x01(\t\x12\x11\n\tcolor_hex\x18\x11 \x01(\t\x12\x0b\n\x03srm\x18\x12 \x01(\x01\x12\x0b\n\x03ibu\x18\x13 \x01(\x01\x12\x13\n\x0bstar_rating\x18\x14 \x01(\x01"%\n\tBeerStyle\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04name\x18\x02 \x02(\t"\xd9\x01\n\x08\x42\x65\x65rType\x12\n\n\x02id\x18\x01 \x02(\t\x12\x0c\n\x04name\x18\x02 \x02(\t\x12\x11\n\tbrewer_id\x18\x03 \x02(\t\x12\x10\n\x08style_id\x18\x04 \x02(\t\x12\x0f\n\x07\x65\x64ition\x18\x06 \x01(\t\x12\x0b\n\x03\x61\x62v\x18\x07 \x01(\x01\x12\x13\n\x0b\x63\x61lories_oz\x18\x08 \x01(\x01\x12\x10\n\x08\x63\x61rbs_oz\x18\t \x01(\x01\x12\x18\n\x10specific_gravity\x18\n \x01(\x01\x12\x18\n\x10original_gravity\x18\x0b \x01(\x01\x12\x15\n\x05image\x18\x0c \x01(\x0b\x32\x06.Image"\xb7\x01\n\x06\x42rewer\x12\n\n\x02id\x18\x01 \x02(\t\x12\x0c\n\x04name\x18\x02 \x02(\t\x12\x11\n\x07\x63ountry\x18\x03 \x01(\t:\x00\x12\x16\n\x0corigin_state\x18\x04 \x01(\t:\x00\x12\x15\n\x0borigin_city\x18\x05 \x01(\t:\x00\x12\x14\n\nproduction\x18\x06 \x01(\t:\x00\x12\r\n\x03url\x18\x07 \x01(\t:\x00\x12\x15\n\x0b\x64\x65scription\x18\x08 \x01(\t:\x00\x12\x15\n\x05image\x18\t \x01(\x0b\x32\x06.Image"\xb2\x02\n\x05\x44rink\x12\n\n\x02id\x18\x01 \x02(\r\x12\r\n\x05ticks\x18\x02 \x02(\r\x12\x11\n\tvolume_ml\x18\x03 \x02(\x01\x12\x12\n\nsession_id\x18\x04 \x02(\r\x12\x0c\n\x04time\x18\x05 \x02(\t\x12\x10\n\x08\x64uration\x18\x06 \x01(\r\x12\x0e\n\x06keg_id\x18\x08 \x01(\r\x12\x0f\n\x07user_id\x18\t \x01(\t\x12\x15\n\rauth_token_id\x18\n \x01(\r\x12\x0b\n\x03url\x18\x0b \x01(\t\x12\r\n\x05shout\x18\x0c \x01(\t\x12\x13\n\x04user\x18\r \x01(\x0b\x32\x05.User\x12\x11\n\x03keg\x18\x0e \x01(\x0b\x32\x04.Keg\x12\x19\n\x07session\x18\x0f \x01(\x0b\x32\x08.Session\x12\x16\n\x06images\x18\x10 \x03(\x0b\x32\x06.Image\x12\x18\n\x10tick_time_series\x18\x11 \x01(\t"\xe1\x01\n\x05Image\x12\x0b\n\x03url\x18\x01 \x02(\t\x12\r\n\x05width\x18\x02 \x01(\r\x12\x0e\n\x06height\x18\x03 \x01(\r\x12\x0c\n\x04time\x18\x04 \x01(\t\x12\x0f\n\x07\x63\x61ption\x18\x05 \x01(\t\x12\x0f\n\x07user_id\x18\x06 \x01(\t\x12\x0e\n\x06keg_id\x18\x07 \x01(\r\x12\x12\n\nsession_id\x18\x08 \x01(\r\x12\x10\n\x08\x64rink_id\x18\t \x01(\r\x12\x15\n\rthumbnail_url\x18\n \x01(\t\x12\x14\n\x0coriginal_url\x18\x0b \x01(\t\x12\x19\n\x11small_resized_url\x18\r \x01(\t"\x95\x04\n\x03Keg\x12\n\n\x02id\x18\x01 \x02(\r\x12\x10\n\x08keg_type\x18\x02 \x02(\t\x12\x1b\n\x13remaining_volume_ml\x18\x03 \x02(\x01\x12\x16\n\x0e\x66ull_volume_ml\x18\x04 \x02(\x01\x12\x18\n\x10served_volume_ml\x18\x05 \x02(\x01\x12\x19\n\x11spilled_volume_ml\x18\x06 \x02(\x01\x12\x14\n\x0cpercent_full\x18\x07 \x02(\x01\x12\x12\n\nstart_time\x18\x08 \x01(\t\x12\x10\n\x08\x65nd_time\x18\t \x01(\t\x12\x0e\n\x06online\x18\n \x01(\x08\x12\x13\n\x0b\x64\x65scription\x18\x0b \x01(\t\x12\x1b\n\x08\x62\x65verage\x18\x0c \x01(\x0b\x32\t.Beverage\x12\x18\n\x10illustration_url\x18\x15 \x01(\t\x12"\n\x1aillustration_thumbnail_url\x18\x16 \x01(\t\x12\x1b\n\x04type\x18\r \x01(\x0b\x32\t.BeerTypeB\x02\x18\x01\x12\x13\n\x07type_id\x18\x0e \x01(\tB\x02\x18\x01\x12\x13\n\x07size_id\x18\x0f \x01(\rB\x02\x18\x01\x12\x1a\n\x04size\x18\x10 \x01(\x0b\x32\x08.KegSizeB\x02\x18\x01\x12\x15\n\tsize_name\x18\x11 \x01(\tB\x02\x18\x01\x12\x1a\n\x0esize_volume_ml\x18\x12 \x01(\x01\x42\x02\x18\x01\x12\x1c\n\x10volume_ml_remain\x18\x13 \x01(\x01\x42\x02\x18\x01\x12\x16\n\nspilled_ml\x18\x14 \x01(\x01\x42\x02\x18\x01"6\n\x07KegSize\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04name\x18\x02 \x02(\t\x12\x11\n\tvolume_ml\x18\x03 \x02(\x01"Q\n\nController\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04name\x18\x02 \x02(\t\x12\x12\n\nmodel_name\x18\x03 \x01(\t\x12\x15\n\rserial_number\x18\x04 \x01(\t"o\n\tFlowMeter\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04name\x18\x02 \x02(\t\x12\x11\n\tport_name\x18\x03 \x02(\t\x12\x14\n\x0cticks_per_ml\x18\x04 \x02(\x01\x12\x1f\n\ncontroller\x18\x05 \x01(\x0b\x32\x0b.Controller"Z\n\nFlowToggle\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04name\x18\x02 \x02(\t\x12\x11\n\tport_name\x18\x03 \x02(\t\x12\x1f\n\ncontroller\x18\x04 \x01(\x0b\x32\x0b.Controller"\xe0\x02\n\x06KegTap\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04name\x18\x02 \x02(\t\x12\x16\n\nmeter_name\x18\x03 \x01(\tB\x02\x18\x01\x12\x19\n\x05meter\x18\x0c \x01(\x0b\x32\n.FlowMeter\x12\x1b\n\x06toggle\x18\r \x01(\x0b\x32\x0b.FlowToggle\x12$\n\rthermo_sensor\x18\x0e \x01(\x0b\x32\r.ThermoSensor\x12\x12\n\nrelay_name\x18\x04 \x01(\t\x12\x13\n\x0bml_per_tick\x18\x05 \x01(\x01\x12\x13\n\x0b\x64\x65scription\x18\x06 \x01(\t\x12\x18\n\x10thermo_sensor_id\x18\x08 \x01(\r\x12$\n\x10last_temperature\x18\t \x01(\x0b\x32\n.ThermoLog\x12\x16\n\x0e\x63urrent_keg_id\x18\n \x01(\r\x12\x19\n\x0b\x63urrent_keg\x18\x0b \x01(\x0b\x32\x04.Keg\x12\x15\n\nsort_order\x18\x0f \x01(\r:\x01\x30"\x8e\x01\n\x07Session\x12\n\n\x02id\x18\x01 \x02(\r\x12\x12\n\nstart_time\x18\x02 \x02(\t\x12\x10\n\x08\x65nd_time\x18\x03 \x02(\t\x12\x11\n\tvolume_ml\x18\x04 \x02(\x01\x12\x0c\n\x04name\x18\x05 \x01(\t\x12\x10\n\x04slug\x18\x06 \x01(\tB\x02\x18\x01\x12\x0b\n\x03url\x18\x07 \x01(\t\x12\x11\n\tis_active\x18\x08 \x01(\x08"O\n\tThermoLog\x12\n\n\x02id\x18\x01 \x02(\r\x12\x11\n\tsensor_id\x18\x02 \x02(\r\x12\x15\n\rtemperature_c\x18\x03 \x02(\x01\x12\x0c\n\x04time\x18\x04 \x02(\t"\x8e\x01\n\x0cThermoSensor\x12\n\n\x02id\x18\x01 \x02(\r\x12\x13\n\x0bsensor_name\x18\x02 \x02(\t\x12\x11\n\tnice_name\x18\x03 \x01(\t\x12\x1c\n\x08last_log\x18\x06 \x01(\x0b\x32\n.ThermoLog\x12\x15\n\tlast_temp\x18\x04 \x01(\x01\x42\x02\x18\x01\x12\x15\n\tlast_time\x18\x05 \x01(\tB\x02\x18\x01"\x84\x02\n\x04User\x12\x10\n\x08username\x18\x01 \x02(\t\x12\x14\n\x0c\x64isplay_name\x18\r \x01(\t\x12\x15\n\x05image\x18\x02 \x01(\x0b\x32\x06.Image\x12\x17\n\tis_active\x18\x03 \x02(\x08:\x04true\x12\x12\n\nfirst_name\x18\x04 \x01(\t\x12\x11\n\tlast_name\x18\x05 \x01(\t\x12\r\n\x05\x65mail\x18\x06 \x01(\t\x12\x10\n\x08password\x18\x07 \x01(\t\x12\x10\n\x08is_staff\x18\x08 \x01(\x08\x12\x14\n\x0cis_superuser\x18\t \x01(\x08\x12\x12\n\nlast_login\x18\n \x01(\t\x12\x13\n\x0b\x64\x61te_joined\x18\x0b \x01(\t\x12\x0b\n\x03url\x18\x0c \x01(\t"1\n\x08SiteInfo\x12\r\n\x05title\x18\x01 \x01(\t\x12\x16\n\x0eserver_version\x18\x02 \x01(\t"\xed\x01\n\x0bSystemEvent\x12\n\n\x02id\x18\x01 \x02(\r\x12\x0c\n\x04kind\x18\x02 \x02(\t\x12\x0c\n\x04time\x18\x03 \x02(\t\x12\x10\n\x08\x64rink_id\x18\x04 \x01(\r\x12\x0e\n\x06keg_id\x18\x05 \x01(\r\x12\x12\n\nsession_id\x18\x06 \x01(\r\x12\x0f\n\x07user_id\x18\x07 \x01(\t\x12\x15\n\x05image\x18\x08 \x01(\x0b\x32\x06.Image\x12\x13\n\x04user\x18\t \x01(\x0b\x32\x05.User\x12\x15\n\x05\x64rink\x18\n \x01(\x0b\x32\x06.Drink\x12\x11\n\x03keg\x18\x0b \x01(\x0b\x32\x04.Keg\x12\x19\n\x07session\x18\x0c \x01(\x0b\x32\x08.Session"Z\n\nSoundEvent\x12\x12\n\nevent_name\x18\x01 \x02(\t\x12\x17\n\x0f\x65vent_predicate\x18\x02 \x01(\t\x12\x11\n\tsound_url\x18\x03 \x02(\t\x12\x0c\n\x04user\x18\x04 \x01(\tB\x14\n\x10org.kegbot.protoH\x02'
-)
-
-
-_AUTHENTICATIONTOKEN = DESCRIPTOR.message_types_by_name["AuthenticationToken"]
-_BEVERAGEPRODUCER = DESCRIPTOR.message_types_by_name["BeverageProducer"]
-_BEVERAGE = DESCRIPTOR.message_types_by_name["Beverage"]
-_BEERSTYLE = DESCRIPTOR.message_types_by_name["BeerStyle"]
-_BEERTYPE = DESCRIPTOR.message_types_by_name["BeerType"]
-_BREWER = DESCRIPTOR.message_types_by_name["Brewer"]
-_DRINK = DESCRIPTOR.message_types_by_name["Drink"]
-_IMAGE = DESCRIPTOR.message_types_by_name["Image"]
-_KEG = DESCRIPTOR.message_types_by_name["Keg"]
-_KEGSIZE = DESCRIPTOR.message_types_by_name["KegSize"]
-_CONTROLLER = DESCRIPTOR.message_types_by_name["Controller"]
-_FLOWMETER = DESCRIPTOR.message_types_by_name["FlowMeter"]
-_FLOWTOGGLE = DESCRIPTOR.message_types_by_name["FlowToggle"]
-_KEGTAP = DESCRIPTOR.message_types_by_name["KegTap"]
-_SESSION = DESCRIPTOR.message_types_by_name["Session"]
-_THERMOLOG = DESCRIPTOR.message_types_by_name["ThermoLog"]
-_THERMOSENSOR = DESCRIPTOR.message_types_by_name["ThermoSensor"]
-_USER = DESCRIPTOR.message_types_by_name["User"]
-_SITEINFO = DESCRIPTOR.message_types_by_name["SiteInfo"]
-_SYSTEMEVENT = DESCRIPTOR.message_types_by_name["SystemEvent"]
-_SOUNDEVENT = DESCRIPTOR.message_types_by_name["SoundEvent"]
-AuthenticationToken = _reflection.GeneratedProtocolMessageType(
-    "AuthenticationToken",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _AUTHENTICATIONTOKEN,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:AuthenticationToken)
-    },
-)
-_sym_db.RegisterMessage(AuthenticationToken)
-
-BeverageProducer = _reflection.GeneratedProtocolMessageType(
-    "BeverageProducer",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _BEVERAGEPRODUCER,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:BeverageProducer)
-    },
-)
-_sym_db.RegisterMessage(BeverageProducer)
-
-Beverage = _reflection.GeneratedProtocolMessageType(
-    "Beverage",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _BEVERAGE,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:Beverage)
-    },
-)
-_sym_db.RegisterMessage(Beverage)
-
-BeerStyle = _reflection.GeneratedProtocolMessageType(
-    "BeerStyle",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _BEERSTYLE,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:BeerStyle)
-    },
-)
-_sym_db.RegisterMessage(BeerStyle)
-
-BeerType = _reflection.GeneratedProtocolMessageType(
-    "BeerType",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _BEERTYPE,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:BeerType)
-    },
-)
-_sym_db.RegisterMessage(BeerType)
-
-Brewer = _reflection.GeneratedProtocolMessageType(
-    "Brewer",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _BREWER,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:Brewer)
-    },
-)
-_sym_db.RegisterMessage(Brewer)
-
-Drink = _reflection.GeneratedProtocolMessageType(
-    "Drink",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _DRINK,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:Drink)
-    },
-)
-_sym_db.RegisterMessage(Drink)
-
-Image = _reflection.GeneratedProtocolMessageType(
-    "Image",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _IMAGE,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:Image)
-    },
-)
-_sym_db.RegisterMessage(Image)
-
-Keg = _reflection.GeneratedProtocolMessageType(
-    "Keg",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _KEG,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:Keg)
-    },
-)
-_sym_db.RegisterMessage(Keg)
-
-KegSize = _reflection.GeneratedProtocolMessageType(
-    "KegSize",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _KEGSIZE,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:KegSize)
-    },
-)
-_sym_db.RegisterMessage(KegSize)
-
-Controller = _reflection.GeneratedProtocolMessageType(
-    "Controller",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _CONTROLLER,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:Controller)
-    },
-)
-_sym_db.RegisterMessage(Controller)
-
-FlowMeter = _reflection.GeneratedProtocolMessageType(
-    "FlowMeter",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _FLOWMETER,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:FlowMeter)
-    },
-)
-_sym_db.RegisterMessage(FlowMeter)
-
-FlowToggle = _reflection.GeneratedProtocolMessageType(
-    "FlowToggle",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _FLOWTOGGLE,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:FlowToggle)
-    },
-)
-_sym_db.RegisterMessage(FlowToggle)
-
-KegTap = _reflection.GeneratedProtocolMessageType(
-    "KegTap",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _KEGTAP,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:KegTap)
-    },
-)
-_sym_db.RegisterMessage(KegTap)
-
-Session = _reflection.GeneratedProtocolMessageType(
-    "Session",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _SESSION,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:Session)
-    },
-)
-_sym_db.RegisterMessage(Session)
-
-ThermoLog = _reflection.GeneratedProtocolMessageType(
-    "ThermoLog",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _THERMOLOG,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:ThermoLog)
-    },
-)
-_sym_db.RegisterMessage(ThermoLog)
-
-ThermoSensor = _reflection.GeneratedProtocolMessageType(
-    "ThermoSensor",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _THERMOSENSOR,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:ThermoSensor)
-    },
-)
-_sym_db.RegisterMessage(ThermoSensor)
-
-User = _reflection.GeneratedProtocolMessageType(
-    "User",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _USER,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:User)
-    },
-)
-_sym_db.RegisterMessage(User)
-
-SiteInfo = _reflection.GeneratedProtocolMessageType(
-    "SiteInfo",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _SITEINFO,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:SiteInfo)
-    },
-)
-_sym_db.RegisterMessage(SiteInfo)
-
-SystemEvent = _reflection.GeneratedProtocolMessageType(
-    "SystemEvent",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _SYSTEMEVENT,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:SystemEvent)
-    },
-)
-_sym_db.RegisterMessage(SystemEvent)
-
-SoundEvent = _reflection.GeneratedProtocolMessageType(
-    "SoundEvent",
-    (_message.Message,),
-    {
-        "DESCRIPTOR": _SOUNDEVENT,
-        "__module__": "models_pb2"
-        # @@protoc_insertion_point(class_scope:SoundEvent)
-    },
-)
-_sym_db.RegisterMessage(SoundEvent)
-
-if _descriptor._USE_C_DESCRIPTORS == False:
-
-    DESCRIPTOR._options = None
-    DESCRIPTOR._serialized_options = b"\n\020org.kegbot.protoH\002"
-    _KEG.fields_by_name["type"]._options = None
-    _KEG.fields_by_name["type"]._serialized_options = b"\030\001"
-    _KEG.fields_by_name["type_id"]._options = None
-    _KEG.fields_by_name["type_id"]._serialized_options = b"\030\001"
-    _KEG.fields_by_name["size_id"]._options = None
-    _KEG.fields_by_name["size_id"]._serialized_options = b"\030\001"
-    _KEG.fields_by_name["size"]._options = None
-    _KEG.fields_by_name["size"]._serialized_options = b"\030\001"
-    _KEG.fields_by_name["size_name"]._options = None
-    _KEG.fields_by_name["size_name"]._serialized_options = b"\030\001"
-    _KEG.fields_by_name["size_volume_ml"]._options = None
-    _KEG.fields_by_name["size_volume_ml"]._serialized_options = b"\030\001"
-    _KEG.fields_by_name["volume_ml_remain"]._options = None
-    _KEG.fields_by_name["volume_ml_remain"]._serialized_options = b"\030\001"
-    _KEG.fields_by_name["spilled_ml"]._options = None
-    _KEG.fields_by_name["spilled_ml"]._serialized_options = b"\030\001"
-    _KEGTAP.fields_by_name["meter_name"]._options = None
-    _KEGTAP.fields_by_name["meter_name"]._serialized_options = b"\030\001"
-    _SESSION.fields_by_name["slug"]._options = None
-    _SESSION.fields_by_name["slug"]._serialized_options = b"\030\001"
-    _THERMOSENSOR.fields_by_name["last_temp"]._options = None
-    _THERMOSENSOR.fields_by_name["last_temp"]._serialized_options = b"\030\001"
-    _THERMOSENSOR.fields_by_name["last_time"]._options = None
-    _THERMOSENSOR.fields_by_name["last_time"]._serialized_options = b"\030\001"
-    _AUTHENTICATIONTOKEN._serialized_start = 17
-    _AUTHENTICATIONTOKEN._serialized_end = 223
-    _BEVERAGEPRODUCER._serialized_start = 226
-    _BEVERAGEPRODUCER._serialized_end = 410
-    _BEVERAGE._serialized_start = 413
-    _BEVERAGE._serialized_end = 853
-    _BEERSTYLE._serialized_start = 855
-    _BEERSTYLE._serialized_end = 892
-    _BEERTYPE._serialized_start = 895
-    _BEERTYPE._serialized_end = 1112
-    _BREWER._serialized_start = 1115
-    _BREWER._serialized_end = 1298
-    _DRINK._serialized_start = 1301
-    _DRINK._serialized_end = 1607
-    _IMAGE._serialized_start = 1610
-    _IMAGE._serialized_end = 1835
-    _KEG._serialized_start = 1838
-    _KEG._serialized_end = 2371
-    _KEGSIZE._serialized_start = 2373
-    _KEGSIZE._serialized_end = 2427
-    _CONTROLLER._serialized_start = 2429
-    _CONTROLLER._serialized_end = 2510
-    _FLOWMETER._serialized_start = 2512
-    _FLOWMETER._serialized_end = 2623
-    _FLOWTOGGLE._serialized_start = 2625
-    _FLOWTOGGLE._serialized_end = 2715
-    _KEGTAP._serialized_start = 2718
-    _KEGTAP._serialized_end = 3070
-    _SESSION._serialized_start = 3073
-    _SESSION._serialized_end = 3215
-    _THERMOLOG._serialized_start = 3217
-    _THERMOLOG._serialized_end = 3296
-    _THERMOSENSOR._serialized_start = 3299
-    _THERMOSENSOR._serialized_end = 3441
-    _USER._serialized_start = 3444
-    _USER._serialized_end = 3704
-    _SITEINFO._serialized_start = 3706
-    _SITEINFO._serialized_end = 3755
-    _SYSTEMEVENT._serialized_start = 3758
-    _SYSTEMEVENT._serialized_end = 3995
-    _SOUNDEVENT._serialized_start = 3997
-    _SOUNDEVENT._serialized_end = 4087
-# @@protoc_insertion_point(module_scope)
diff --git a/pykeg/proto/protolib.py b/pykeg/proto/protolib.py
deleted file mode 100644
index f0b4ea86..00000000
--- a/pykeg/proto/protolib.py
+++ /dev/null
@@ -1,493 +0,0 @@
-"""Routines from converting data to and from Protocol Buffer format."""
-
-from addict import Dict
-
-from pykeg.core import models
-
-from . import api_pb2, models_pb2, protoutil
-
-_CONVERSION_MAP = {}
-
-
-def converts(kind):
-    def decorate(f):
-        global _CONVERSION_MAP
-        _CONVERSION_MAP[kind] = f
-        return f
-
-    return decorate
-
-
-def datestr(dt):
-    return dt.isoformat()
-
-
-def ToProto(obj, full=False):
-    """Converts the object to protocol format."""
-    if obj is None:
-        return None
-    kind = obj.__class__
-    if hasattr(obj, "__iter__"):
-        return [ToProto(item, full) for item in obj]
-    elif kind in _CONVERSION_MAP:
-        return _CONVERSION_MAP[kind](obj, full)
-    else:
-        raise ValueError(f"Unknown object type: {kind}")
-
-
-def ToDict(obj, full=False):
-    res = ToProto(obj, full)
-    if hasattr(res, "__iter__"):
-        return [Dict(protoutil.ProtoMessageToDict(m)) for m in res]
-    else:
-        return Dict(protoutil.ProtoMessageToDict(res))
-
-
-# Model conversions
-
-
-@converts(models.AuthenticationToken)
-def AuthTokenToProto(record, full=False):
-    ret = models_pb2.AuthenticationToken()
-    ret.id = record.id
-    ret.auth_device = record.auth_device
-    ret.token_value = record.token_value
-    if record.user_id:
-        ret.username = str(record.user.username)
-        ret.user.MergeFrom(ToProto(record.user))
-    if record.nice_name:
-        ret.nice_name = record.nice_name
-    ret.created_time = datestr(record.created_time)
-    ret.enabled = record.enabled
-    if record.expire_time:
-        ret.expire_time = datestr(record.expire_time)
-    if record.pin:
-        ret.pin = record.pin
-    return ret
-
-
-@converts(models.Picture)
-def PictureToProto(record, full=False, use_png=False):
-    ret = models_pb2.Image()
-    if use_png:
-        ret.url = record.resized_png.url
-        ret.thumbnail_url = record.thumbnail_png.url
-    else:
-        ret.url = record.resized.url
-        ret.thumbnail_url = record.thumbnail.url
-    ret.original_url = record.image.url
-    # TODO(mikey): This can be expensive depending on the storage backend
-    # (attempts to fetch image).
-    # try:
-    #  ret.width = record.image.width
-    #  ret.height = record.image.height
-    # except IOError:
-    #  pass
-    if record.time:
-        ret.time = datestr(record.time)
-    if record.caption:
-        ret.caption = record.caption
-    if record.user_id:
-        ret.user_id = record.user.username
-    if record.keg_id:
-        ret.keg_id = record.keg_id
-    if record.session_id:
-        ret.session_id = record.session_id
-    return ret
-
-
-def BeverageToBeerType(beverage, full=False):
-    """Deprecated."""
-    ret = models_pb2.BeerType()
-    ret.id = str(beverage.id)
-    ret.name = beverage.name
-    ret.brewer_id = str(beverage.producer_id)
-    ret.style_id = "0"
-    abv = beverage.abv_percent or 0.0
-    ret.abv = max(min(abv, 100.0), 0.0)
-    if beverage.specific_gravity is not None:
-        ret.specific_gravity = beverage.specific_gravity
-    if beverage.original_gravity is not None:
-        ret.original_gravity = beverage.original_gravity
-    if beverage.picture:
-        ret.image.MergeFrom(ToProto(beverage.picture))
-    return ret
-
-
-def ProducerToBrewer(producer, full=False):
-    """Deprecated."""
-    ret = models_pb2.Brewer()
-    ret.id = str(producer.id)
-    ret.name = producer.name
-    if producer.country is not None:
-        ret.country = producer.country
-    if producer.origin_state is not None:
-        ret.origin_state = producer.origin_state
-    if producer.origin_city is not None:
-        ret.origin_city = producer.origin_city
-    if producer.production is not None:
-        ret.production = "commercial"
-    if producer.url is not None:
-        ret.url = producer.url
-    if producer.description is not None:
-        ret.description = producer.description
-    if producer.picture:
-        ret.image.MergeFrom(ToProto(producer.picture))
-    return ret
-
-
-@converts(models.Beverage)
-def BeverageToProto(beverage, full=False):
-    ret = models_pb2.Beverage()
-    ret.id = beverage.id
-    ret.name = beverage.name
-    ret.producer.MergeFrom(ToProto(beverage.producer, full))
-    ret.beverage_type = beverage.beverage_type
-
-    if beverage.style:
-        ret.style = beverage.style
-    if beverage.description:
-        ret.description = beverage.description
-
-    if beverage.picture:
-        # Use PNG for beverages.
-        ret.picture.MergeFrom(PictureToProto(beverage.picture, full=full, use_png=True))
-
-    if beverage.vintage_year:
-        ret.vintage_year = beverage.vintage_year.year
-
-    if beverage.abv_percent is not None:
-        ret.abv_percent = beverage.abv_percent
-    if beverage.calories_per_ml is not None:
-        ret.calories_per_ml = beverage.calories_per_ml
-    if beverage.carbs_per_ml is not None:
-        ret.carbs_per_ml = beverage.carbs_per_ml
-
-    if beverage.original_gravity is not None:
-        ret.original_gravity = beverage.original_gravity
-    if beverage.specific_gravity is not None:
-        ret.specific_gravity = beverage.specific_gravity
-    if beverage.untappd_beer_id is not None:
-        ret.untappd_id = str(beverage.untappd_beer_id)
-    if beverage.color_hex:
-        ret.color_hex = beverage.color_hex
-    if beverage.srm:
-        ret.srm = beverage.srm
-    if beverage.ibu:
-        ret.ibu = beverage.ibu
-    if beverage.star_rating is not None:
-        ret.star_rating = beverage.star_rating
-
-    if beverage.beverage_backend is not None:
-        ret.beverage_backend = beverage.beverage_backend
-    if beverage.beverage_backend_id is not None:
-        ret.beverage_backend_id = beverage.beverage_backend_id
-
-    return ret
-
-
-@converts(models.BeverageProducer)
-def ProducerToProto(producer, full=False):
-    ret = models_pb2.BeverageProducer()
-    ret.id = producer.id
-    ret.name = producer.name
-    if producer.country is not None:
-        ret.country = producer.country
-    if producer.origin_state is not None:
-        ret.origin_state = producer.origin_state
-    if producer.origin_city is not None:
-        ret.origin_city = producer.origin_city
-    ret.is_homebrew = bool(producer.is_homebrew)
-    if producer.url is not None:
-        ret.url = producer.url
-    if producer.description is not None:
-        ret.description = producer.description
-    if producer.picture:
-        ret.picture.MergeFrom(ToProto(producer.picture))
-    return ret
-
-
-@converts(models.Controller)
-def ControllerToProto(controller, full=False):
-    ret = models_pb2.Controller()
-    ret.id = controller.id
-    ret.name = controller.name
-    if controller.model_name:
-        ret.model_name = controller.model_name
-    if controller.serial_number:
-        ret.serial_number = controller.serial_number
-    return ret
-
-
-@converts(models.FlowMeter)
-def FlowMeterToProto(flow_meter, full=False):
-    ret = models_pb2.FlowMeter()
-    ret.id = flow_meter.id
-    ret.name = flow_meter.meter_name()
-    ret.controller.MergeFrom(ToProto(flow_meter.controller))
-    ret.port_name = flow_meter.port_name
-    ret.ticks_per_ml = flow_meter.ticks_per_ml
-    return ret
-
-
-@converts(models.FlowToggle)
-def FlowToggleToProto(flow_toggle, full=False):
-    ret = models_pb2.FlowToggle()
-    ret.id = flow_toggle.id
-    ret.name = flow_toggle.toggle_name()
-    ret.controller.MergeFrom(ToProto(flow_toggle.controller))
-    ret.port_name = flow_toggle.port_name
-    return ret
-
-
-@converts(models.Drink)
-def DrinkToProto(drink, full=False):
-    ret = models_pb2.Drink()
-    ret.id = drink.id
-    ret.url = str(drink.get_absolute_url())
-    ret.ticks = drink.ticks
-    ret.volume_ml = drink.volume_ml
-    ret.session_id = drink.session_id
-    ret.time = datestr(drink.time)
-    ret.duration = drink.duration
-    if drink.keg:
-        ret.keg_id = drink.keg_id
-    if drink.user_id:
-        ret.user_id = drink.user.username
-    if drink.shout:
-        ret.shout = drink.shout
-    if drink.tick_time_series:
-        ret.tick_time_series = drink.tick_time_series
-
-    if full:
-        if drink.user_id:
-            ret.user.MergeFrom(ToProto(drink.user))
-        if drink.keg:
-            ret.keg.MergeFrom(ToProto(drink.keg))
-        if drink.session:
-            ret.session.MergeFrom(ToProto(drink.session))
-        if drink.picture:
-            ret.images.add().MergeFrom(ToProto(drink.picture))
-    return ret
-
-
-@converts(models.Keg)
-def KegToProto(keg, full=False):
-    ret = models_pb2.Keg()
-    ret.id = keg.id
-    ret.keg_type = keg.keg_type
-
-    ret.remaining_volume_ml = float(keg.remaining_volume_ml())
-    ret.full_volume_ml = keg.full_volume_ml
-    ret.served_volume_ml = keg.served_volume_ml
-    ret.spilled_volume_ml = keg.spilled_ml
-    ret.percent_full = keg.percent_full()
-
-    ret.start_time = datestr(keg.start_time)
-    ret.end_time = datestr(keg.end_time)
-    ret.online = keg.is_on_tap()
-    if keg.description is not None:
-        ret.description = keg.description
-
-    ret.beverage.MergeFrom(ToProto(keg.type))
-
-    ret.illustration_url = keg.get_illustration(thumbnail=False)
-    ret.illustration_thumbnail_url = keg.get_illustration(thumbnail=True)
-
-    # Deprecated fields.
-    ret.size_id = 0
-    ret.type_id = str(keg.type_id)
-    ret.size_name = keg.keg_type
-    ret.size_volume_ml = keg.full_volume_ml
-    ret.volume_ml_remain = ret.remaining_volume_ml
-    ret.spilled_ml = ret.spilled_volume_ml
-
-    ret.type.MergeFrom(BeverageToBeerType(keg.type))
-    s = models_pb2.KegSize()
-    s.id = 0
-    s.name = ret.size_name
-    s.volume_ml = ret.size_volume_ml
-    ret.size.MergeFrom(s)
-
-    return ret
-
-
-@converts(models.KegTap)
-def KegTapToProto(tap, full=False):
-    ret = models_pb2.KegTap()
-    ret.id = tap.id
-    ret.name = tap.name
-    ret.sort_order = tap.sort_order
-    meter = tap.current_meter()
-
-    if meter:
-        ret.meter_name = meter.meter_name()
-        ret.ml_per_tick = 1 / meter.ticks_per_ml
-        ret.meter.MergeFrom(ToProto(meter))
-    else:
-        # TODO(mikey): Remove compatibility.
-        ret.meter_name = f"unknown.{tap.id}"
-        ret.ml_per_tick = 0
-
-    toggle = tap.current_toggle()
-    if toggle:
-        ret.relay_name = toggle.toggle_name()
-        ret.toggle.MergeFrom(ToProto(toggle))
-    else:
-        ret.relay_name = ""
-
-    if tap.current_keg:
-        ret.current_keg_id = tap.current_keg_id
-        if full:
-            ret.current_keg.MergeFrom(ToProto(tap.current_keg, full=True))
-
-    if tap.temperature_sensor:
-        ret.thermo_sensor.MergeFrom(ToProto(tap.temperature_sensor))
-        ret.thermo_sensor_id = tap.temperature_sensor_id
-        log = tap.temperature_sensor.LastLog()
-        if log:
-            ret.last_temperature.MergeFrom(ToProto(log))
-    return ret
-
-
-@converts(models.DrinkingSession)
-def SessionToProto(record, full=False):
-    ret = models_pb2.Session()
-    ret.id = record.id
-    ret.url = str(record.get_absolute_url())
-    ret.start_time = datestr(record.start_time)
-    ret.end_time = datestr(record.end_time)
-    ret.volume_ml = record.volume_ml
-    ret.name = record.name or ""
-
-    if full:
-        # ret.stats.MergeFrom(record.get_stats())
-        ret.is_active = record.IsActiveNow()
-    return ret
-
-
-@converts(models.Thermolog)
-def ThermoLogToProto(record, full=False):
-    ret = models_pb2.ThermoLog()
-    ret.id = record.id
-    ret.sensor_id = record.sensor_id
-    ret.temperature_c = record.temp
-    ret.time = datestr(record.time)
-    return ret
-
-
-@converts(models.ThermoSensor)
-def ThermoSensorToProto(record, full=False):
-    ret = models_pb2.ThermoSensor()
-    ret.id = record.id
-    log = record.LastLog()
-    if log:
-        ret.last_log.MergeFrom(ToProto(log))
-
-    # Deprecated
-    ret.sensor_name = record.raw_name
-    ret.nice_name = record.nice_name
-    return ret
-
-
-@converts(models.User)
-def UserToProto(user, full=False):
-    ret = models_pb2.User()
-    ret.username = user.username
-    ret.url = str(user.get_absolute_url())
-    ret.is_active = user.is_active
-    ret.display_name = user.get_full_name()
-    if full:
-        ret.email = user.email
-        ret.is_staff = user.is_staff
-        ret.is_active = user.is_active
-        ret.is_superuser = user.is_superuser
-        ret.last_login = datestr(user.last_login or user.date_joined)
-        ret.date_joined = datestr(user.date_joined)
-    if user.mugshot_id:
-        ret.image.MergeFrom(ToProto(user.mugshot))
-    return ret
-
-
-@converts(models.Stats)
-def StatsToProto(record, full=False):
-    return protoutil.DictToProtoMessage(record.stats, models_pb2.Stats())
-
-
-@converts(models.SystemEvent)
-def SystemEventToProto(record, full=False):
-    ret = models_pb2.SystemEvent()
-    ret.id = record.id
-    ret.kind = record.kind
-    ret.time = datestr(record.time)
-
-    if record.drink_id:
-        ret.drink_id = record.drink_id
-        if full:
-            ret.drink.MergeFrom(ToProto(record.drink, full=True))
-    if record.keg_id:
-        ret.keg_id = record.keg_id
-        if full:
-            ret.keg.MergeFrom(ToProto(record.keg, full=True))
-    if record.session_id:
-        ret.session_id = record.session_id
-        if full:
-            ret.session.MergeFrom(ToProto(record.session, full=True))
-    if record.user_id:
-        ret.user_id = str(record.user.username)
-        if full:
-            ret.user.MergeFrom(ToProto(record.user, full=True))
-
-    image = None
-    if record.kind in ("drink_poured", "session_started", "session_joined") and record.user:
-        image = record.user.mugshot
-    elif record.kind in ("keg_tapped", "keg_ended"):
-        if record.keg.type and record.keg.type.picture:
-            image = record.keg.type.picture
-    if image:
-        ret.image.MergeFrom(ToProto(image))
-
-    return ret
-
-
-# Composite messages
-
-
-def GetSyncResponse(
-    active_kegs=[],
-    active_session=[],
-    active_users=[],
-    controllers=[],
-    drinks=[],
-    events=[],
-    meters=[],
-    site_title="",
-    server_version="",
-    sound_events=[],
-    taps=[],
-    toggles=[],
-):
-    ret = api_pb2.SyncResponse()
-    if active_session:
-        ret.active_session.MergeFrom(ToProto(active_session))
-
-    ret.site_info.title = site_title
-    ret.site_info.server_version = server_version
-
-    for obj in active_kegs:
-        ret.active_kegs.add().MergeFrom(ToProto(obj))
-    for obj in active_users:
-        ret.active_users.add().MergeFrom(ToProto(obj))
-    for obj in controllers:
-        ret.controllers.add().MergeFrom(ToProto(obj))
-    for obj in drinks:
-        ret.drinks.add().MergeFrom(ToProto(obj))
-    for obj in events:
-        ret.events.add().MergeFrom(ToProto(obj))
-    for obj in meters:
-        ret.meters.add().MergeFrom(ToProto(obj))
-    for obj in taps:
-        ret.taps.add().MergeFrom(ToProto(obj))
-    for obj in toggles:
-        ret.toggles.add().MergeFrom(ToProto(obj))
-    return ret
diff --git a/pykeg/proto/protoutil.py b/pykeg/proto/protoutil.py
deleted file mode 100644
index ac1e8e13..00000000
--- a/pykeg/proto/protoutil.py
+++ /dev/null
@@ -1,50 +0,0 @@
-"""Miscellaneous protobuf-related utils."""
-
-import datetime
-
-
-def ProtoMessageToDict(message):
-    ret = {}
-    # if not message.IsInitialized():
-    #  raise ValueError, 'Message not initialized'
-    for descriptor, value in message.ListFields():
-        if descriptor.is_repeated:
-            if descriptor.type == descriptor.TYPE_MESSAGE:
-                ret[descriptor.name] = [ProtoMessageToDict(v) for v in value]
-            else:
-                ret[descriptor.name] = [v for v in value]
-        else:
-            if descriptor.type == descriptor.TYPE_MESSAGE:
-                ret[descriptor.name] = ProtoMessageToDict(value)
-            else:
-                ret[descriptor.name] = value
-    return ret
-
-
-def DictToProtoMessage(values, out_message):
-    for name, field in out_message.DESCRIPTOR.fields_by_name.items():
-        if name not in values:
-            if field.is_required:
-                raise ValueError(f"Missing required field {name}")
-            continue
-
-        value = values.get(name)
-        if field.type == field.TYPE_MESSAGE:
-            inner_message = getattr(out_message, name)
-            if field.is_repeated:
-                for subval in value:
-                    DictToProtoMessage(subval, inner_message.add())
-            else:
-                DictToProtoMessage(value, inner_message)
-        else:
-            if field.is_repeated:
-                out = getattr(out_message, name)
-                for v in value:
-                    if isinstance(v, datetime.datetime):
-                        v = v.isoformat()
-                    out.append(v)
-            else:
-                if isinstance(value, datetime.datetime):
-                    value = value.isoformat()
-                setattr(out_message, name, value)
-    return out_message
diff --git a/pykeg/proto/util.py b/pykeg/proto/util.py
deleted file mode 100644
index 418ffb95..00000000
--- a/pykeg/proto/util.py
+++ /dev/null
@@ -1,25 +0,0 @@
-class AttrDict(dict):
-    """Dict that exposes items as attributes.
-
-    Source: https://stackoverflow.com/a/48806603
-    """
-
-    def __init__(self, mapping=None):
-        super().__init__()
-        if mapping is not None:
-            for key, value in mapping.items():
-                self.__setitem__(key, value)
-
-    def __setitem__(self, key, value):
-        if isinstance(value, dict):
-            value = AttrDict(value)
-        super().__setitem__(key, value)
-        self.__dict__[key] = value  # for code completion in editors
-
-    def __getattr__(self, item):
-        try:
-            return self.__getitem__(item)
-        except KeyError:
-            raise AttributeError(item)
-
-    __setattr__ = __setitem__
diff --git a/pykeg/proto/exceptions.py b/pykeg/web/api/exceptions.py
similarity index 73%
rename from pykeg/proto/exceptions.py
rename to pykeg/web/api/exceptions.py
index 7227d16c..c79e7e21 100644
--- a/pykeg/proto/exceptions.py
+++ b/pykeg/web/api/exceptions.py
@@ -1,3 +1,6 @@
+"""Exception types for the legacy API, mapped to HTTP error responses."""
+
+
 class Error(Exception):
     """An error occurred."""
 
@@ -10,7 +13,7 @@ def Message(self):
         if self.message:
             return self.message
         m = self.__class__.__doc__
-        m = m.split('\n', 1)[0]
+        m = m.split("\n", 1)[0]
         return m
 
 
@@ -20,10 +23,6 @@ class NotFoundError(Error):
     HTTP_CODE = 404
 
 
-class RequestError(Error):
-    """There was an error fufilling the request."""
-
-
 class ServerError(Error):
     """The server had a problem fulfilling your request."""
 
@@ -52,11 +51,3 @@ class PermissionDeniedError(Error):
     """The api_key given does not have permission for this resource."""
 
     HTTP_CODE = 401
-
-
-MAP_NAME_TO_EXCEPTION = dict((c.__name__, c) for c in Error.__subclasses__())
-
-
-def ErrorCodeToException(code, message=ServerError):
-    cls = MAP_NAME_TO_EXCEPTION.get(code, Error)
-    return cls(message)
diff --git a/pykeg/web/api/serialize.py b/pykeg/web/api/serialize.py
new file mode 100644
index 00000000..88943dc0
--- /dev/null
+++ b/pykeg/web/api/serialize.py
@@ -0,0 +1,404 @@
+"""Serializes model objects for legacy API responses.
+
+Replaces the old protobuf round-trip (``pykeg.proto.protolib``): each
+converter builds a plain dict with the same field names and presence
+rules the protobuf encoding produced. Fields the old encoding marked
+deprecated are omitted.
+"""
+
+from addict import Dict
+
+from pykeg.core import models
+
+_CONVERSION_MAP = {}
+
+
+def converts(kind):
+    def decorate(f):
+        _CONVERSION_MAP[kind] = f
+        return f
+
+    return decorate
+
+
+def datestr(dt):
+    return dt.isoformat()
+
+
+def to_dict(obj, full=False):
+    """Converts a model instance (or iterable of them) to a response dict."""
+    if obj is None:
+        return None
+    if isinstance(obj, dict):
+        return Dict(obj)
+    if hasattr(obj, "__iter__"):
+        return [to_dict(item, full) for item in obj]
+    kind = obj.__class__
+    if kind in _CONVERSION_MAP:
+        return Dict(_CONVERSION_MAP[kind](obj, full))
+    raise ValueError(f"Unknown object type: {kind}")
+
+
+@converts(models.AuthenticationToken)
+def auth_token_to_dict(record, full=False):
+    ret = {
+        "id": record.id,
+        "auth_device": record.auth_device,
+        "token_value": record.token_value,
+        "created_time": datestr(record.created_time),
+        "enabled": record.enabled,
+    }
+    if record.user_id:
+        ret["username"] = str(record.user.username)
+        ret["user"] = to_dict(record.user)
+    if record.nice_name:
+        ret["nice_name"] = record.nice_name
+    if record.expire_time:
+        ret["expire_time"] = datestr(record.expire_time)
+    if record.pin:
+        ret["pin"] = record.pin
+    return ret
+
+
+@converts(models.Picture)
+def picture_to_dict(record, full=False, use_png=False):
+    if use_png:
+        ret = {
+            "url": record.resized_png.url,
+            "thumbnail_url": record.thumbnail_png.url,
+        }
+    else:
+        ret = {
+            "url": record.resized.url,
+            "thumbnail_url": record.thumbnail.url,
+        }
+    ret["original_url"] = record.image.url
+    if record.time:
+        ret["time"] = datestr(record.time)
+    if record.caption:
+        ret["caption"] = record.caption
+    if record.user_id:
+        ret["user_id"] = record.user.username
+    if record.keg_id:
+        ret["keg_id"] = record.keg_id
+    if record.session_id:
+        ret["session_id"] = record.session_id
+    return ret
+
+
+@converts(models.Beverage)
+def beverage_to_dict(beverage, full=False):
+    ret = {
+        "id": beverage.id,
+        "name": beverage.name,
+        "producer": to_dict(beverage.producer, full),
+        "beverage_type": beverage.beverage_type,
+    }
+    if beverage.style:
+        ret["style"] = beverage.style
+    if beverage.description:
+        ret["description"] = beverage.description
+    if beverage.picture:
+        # Use PNG for beverages.
+        ret["picture"] = picture_to_dict(beverage.picture, full=full, use_png=True)
+    if beverage.vintage_year:
+        ret["vintage_year"] = beverage.vintage_year.year
+    if beverage.abv_percent is not None:
+        ret["abv_percent"] = beverage.abv_percent
+    if beverage.calories_per_ml is not None:
+        ret["calories_per_ml"] = beverage.calories_per_ml
+    if beverage.carbs_per_ml is not None:
+        ret["carbs_per_ml"] = beverage.carbs_per_ml
+    if beverage.original_gravity is not None:
+        ret["original_gravity"] = beverage.original_gravity
+    if beverage.specific_gravity is not None:
+        ret["specific_gravity"] = beverage.specific_gravity
+    if beverage.untappd_beer_id is not None:
+        ret["untappd_id"] = str(beverage.untappd_beer_id)
+    if beverage.color_hex:
+        ret["color_hex"] = beverage.color_hex
+    if beverage.srm:
+        ret["srm"] = beverage.srm
+    if beverage.ibu:
+        ret["ibu"] = beverage.ibu
+    if beverage.star_rating is not None:
+        ret["star_rating"] = beverage.star_rating
+    if beverage.beverage_backend is not None:
+        ret["beverage_backend"] = beverage.beverage_backend
+    if beverage.beverage_backend_id is not None:
+        ret["beverage_backend_id"] = beverage.beverage_backend_id
+    return ret
+
+
+@converts(models.BeverageProducer)
+def producer_to_dict(producer, full=False):
+    ret = {
+        "id": producer.id,
+        "name": producer.name,
+        "is_homebrew": bool(producer.is_homebrew),
+    }
+    if producer.country is not None:
+        ret["country"] = producer.country
+    if producer.origin_state is not None:
+        ret["origin_state"] = producer.origin_state
+    if producer.origin_city is not None:
+        ret["origin_city"] = producer.origin_city
+    if producer.url is not None:
+        ret["url"] = producer.url
+    if producer.description is not None:
+        ret["description"] = producer.description
+    if producer.picture:
+        ret["picture"] = to_dict(producer.picture)
+    return ret
+
+
+@converts(models.Controller)
+def controller_to_dict(controller, full=False):
+    ret = {
+        "id": controller.id,
+        "name": controller.name,
+    }
+    if controller.model_name:
+        ret["model_name"] = controller.model_name
+    if controller.serial_number:
+        ret["serial_number"] = controller.serial_number
+    return ret
+
+
+@converts(models.FlowMeter)
+def flow_meter_to_dict(flow_meter, full=False):
+    return {
+        "id": flow_meter.id,
+        "name": flow_meter.meter_name(),
+        "controller": to_dict(flow_meter.controller),
+        "port_name": flow_meter.port_name,
+        "ticks_per_ml": flow_meter.ticks_per_ml,
+    }
+
+
+@converts(models.FlowToggle)
+def flow_toggle_to_dict(flow_toggle, full=False):
+    return {
+        "id": flow_toggle.id,
+        "name": flow_toggle.toggle_name(),
+        "controller": to_dict(flow_toggle.controller),
+        "port_name": flow_toggle.port_name,
+    }
+
+
+@converts(models.Drink)
+def drink_to_dict(drink, full=False):
+    ret = {
+        "id": drink.id,
+        "url": str(drink.get_absolute_url()),
+        "ticks": drink.ticks,
+        "volume_ml": drink.volume_ml,
+        "session_id": drink.session_id,
+        "time": datestr(drink.time),
+        "duration": drink.duration,
+    }
+    if drink.keg:
+        ret["keg_id"] = drink.keg_id
+    if drink.user_id:
+        ret["user_id"] = drink.user.username
+    if drink.shout:
+        ret["shout"] = drink.shout
+    if drink.tick_time_series:
+        ret["tick_time_series"] = drink.tick_time_series
+
+    if full:
+        if drink.user_id:
+            ret["user"] = to_dict(drink.user)
+        if drink.keg:
+            ret["keg"] = to_dict(drink.keg)
+        if drink.session:
+            ret["session"] = to_dict(drink.session)
+        if drink.picture:
+            ret["images"] = [to_dict(drink.picture)]
+    return ret
+
+
+@converts(models.Keg)
+def keg_to_dict(keg, full=False):
+    ret = {
+        "id": keg.id,
+        "keg_type": keg.keg_type,
+        "remaining_volume_ml": float(keg.remaining_volume_ml()),
+        "full_volume_ml": keg.full_volume_ml,
+        "served_volume_ml": keg.served_volume_ml,
+        "spilled_volume_ml": keg.spilled_ml,
+        "percent_full": keg.percent_full(),
+        "start_time": datestr(keg.start_time),
+        "end_time": datestr(keg.end_time),
+        "online": keg.is_on_tap(),
+        "beverage": to_dict(keg.type),
+        "illustration_url": keg.get_illustration(thumbnail=False),
+        "illustration_thumbnail_url": keg.get_illustration(thumbnail=True),
+    }
+    if keg.description is not None:
+        ret["description"] = keg.description
+    return ret
+
+
+@converts(models.KegTap)
+def keg_tap_to_dict(tap, full=False):
+    ret = {
+        "id": tap.id,
+        "name": tap.name,
+        "sort_order": tap.sort_order,
+    }
+    meter = tap.current_meter()
+    if meter:
+        ret["meter_name"] = meter.meter_name()
+        ret["ml_per_tick"] = 1 / meter.ticks_per_ml
+        ret["meter"] = to_dict(meter)
+    else:
+        ret["meter_name"] = f"unknown.{tap.id}"
+        ret["ml_per_tick"] = 0
+
+    toggle = tap.current_toggle()
+    if toggle:
+        ret["relay_name"] = toggle.toggle_name()
+        ret["toggle"] = to_dict(toggle)
+    else:
+        ret["relay_name"] = ""
+
+    if tap.current_keg:
+        ret["current_keg_id"] = tap.current_keg_id
+        if full:
+            ret["current_keg"] = to_dict(tap.current_keg, full=True)
+
+    if tap.temperature_sensor:
+        ret["thermo_sensor"] = to_dict(tap.temperature_sensor)
+        ret["thermo_sensor_id"] = tap.temperature_sensor_id
+        log = tap.temperature_sensor.LastLog()
+        if log:
+            ret["last_temperature"] = to_dict(log)
+    return ret
+
+
+@converts(models.DrinkingSession)
+def session_to_dict(record, full=False):
+    ret = {
+        "id": record.id,
+        "url": str(record.get_absolute_url()),
+        "start_time": datestr(record.start_time),
+        "end_time": datestr(record.end_time),
+        "volume_ml": record.volume_ml,
+        "name": record.name or "",
+    }
+    if full:
+        ret["is_active"] = record.IsActiveNow()
+    return ret
+
+
+@converts(models.Thermolog)
+def thermo_log_to_dict(record, full=False):
+    return {
+        "id": record.id,
+        "sensor_id": record.sensor_id,
+        "temperature_c": record.temp,
+        "time": datestr(record.time),
+    }
+
+
+@converts(models.ThermoSensor)
+def thermo_sensor_to_dict(record, full=False):
+    ret = {
+        "id": record.id,
+        "sensor_name": record.raw_name,
+        "nice_name": record.nice_name,
+    }
+    log = record.LastLog()
+    if log:
+        ret["last_log"] = to_dict(log)
+    return ret
+
+
+@converts(models.User)
+def user_to_dict(user, full=False):
+    ret = {
+        "username": user.username,
+        "url": str(user.get_absolute_url()),
+        "is_active": user.is_active,
+        "display_name": user.get_full_name(),
+    }
+    if full:
+        ret["email"] = user.email
+        ret["is_staff"] = user.is_staff
+        ret["is_superuser"] = user.is_superuser
+        ret["last_login"] = datestr(user.last_login or user.date_joined)
+        ret["date_joined"] = datestr(user.date_joined)
+    if user.mugshot_id:
+        ret["image"] = to_dict(user.mugshot)
+    return ret
+
+
+@converts(models.SystemEvent)
+def system_event_to_dict(record, full=False):
+    ret = {
+        "id": record.id,
+        "kind": record.kind,
+        "time": datestr(record.time),
+    }
+    if record.drink_id:
+        ret["drink_id"] = record.drink_id
+        if full:
+            ret["drink"] = to_dict(record.drink, full=True)
+    if record.keg_id:
+        ret["keg_id"] = record.keg_id
+        if full:
+            ret["keg"] = to_dict(record.keg, full=True)
+    if record.session_id:
+        ret["session_id"] = record.session_id
+        if full:
+            ret["session"] = to_dict(record.session, full=True)
+    if record.user_id:
+        ret["user_id"] = str(record.user.username)
+        if full:
+            ret["user"] = to_dict(record.user, full=True)
+
+    image = None
+    if record.kind in ("drink_poured", "session_started", "session_joined") and record.user:
+        image = record.user.mugshot
+    elif record.kind in ("keg_tapped", "keg_ended"):
+        if record.keg.type and record.keg.type.picture:
+            image = record.keg.type.picture
+    if image:
+        ret["image"] = to_dict(image)
+    return ret
+
+
+def sync_dict(
+    active_kegs=[],
+    active_session=None,
+    active_users=[],
+    controllers=[],
+    drinks=[],
+    events=[],
+    meters=[],
+    site_title="",
+    server_version="",
+    taps=[],
+    toggles=[],
+):
+    """Builds the composite status ("sync") response."""
+    ret = Dict(
+        {
+            "site_info": {
+                "title": site_title,
+                "server_version": server_version,
+            },
+            "active_kegs": [to_dict(o) for o in active_kegs],
+            "active_users": [to_dict(o) for o in active_users],
+            "controllers": [to_dict(o) for o in controllers],
+            "drinks": [to_dict(o) for o in drinks],
+            "events": [to_dict(o) for o in events],
+            "meters": [to_dict(o) for o in meters],
+            "taps": [to_dict(o) for o in taps],
+            "toggles": [to_dict(o) for o in toggles],
+        }
+    )
+    if active_session:
+        ret["active_session"] = to_dict(active_session)
+    return ret
diff --git a/pykeg/web/api/util.py b/pykeg/web/api/util.py
index cc2a078d..e4e40507 100644
--- a/pykeg/web/api/util.py
+++ b/pykeg/web/api/util.py
@@ -4,15 +4,13 @@
 import sys
 import traceback
 
-from addict import Dict
 from django.conf import settings
 from django.db.models.query import QuerySet
 from django.http import Http404, HttpResponse
-from google.protobuf.message import Message
 
 from pykeg.core import models
-from pykeg.proto import kbapi, protolib, protoutil
 from pykeg.util import kbjson
+from pykeg.web.api import exceptions, serialize
 
 from . import validate_jsonp
 
@@ -39,7 +37,7 @@ def check_api_key(request):
     if not keystr:
         keystr = request.POST.get("api_key", request.GET.get("api_key", None))
     if not keystr:
-        raise kbapi.NoAuthTokenError('The parameter "api_key" is required')
+        raise exceptions.NoAuthTokenError('The parameter "api_key" is required')
 
     shared_key = settings.KEGBOT["KEGBOT_INSECURE_SHARED_API_KEY"]
     if shared_key and keystr == shared_key:
@@ -48,26 +46,26 @@ def check_api_key(request):
     try:
         api_key = models.ApiKey.objects.get(key=keystr)
     except models.ApiKey.DoesNotExist:
-        raise kbapi.BadApiKeyError("API key does not exist")
+        raise exceptions.BadApiKeyError("API key does not exist")
 
     if not api_key.is_active():
-        raise kbapi.BadApiKeyError("Key and/or user is inactive")
+        raise exceptions.BadApiKeyError("Key and/or user is inactive")
 
     # TODO: remove me.
     if api_key.user and (not api_key.user.is_staff and not api_key.user.is_superuser):
-        raise kbapi.PermissionDeniedError("User is not staff/superuser")
+        raise exceptions.PermissionDeniedError("User is not staff/superuser")
 
 
 def to_json_error(e, exc_info):
     """Converts an exception to an API error response."""
-    # Wrap some common exception types into kbapi types
+    # Wrap some common exception types into API error types
     if isinstance(e, Http404):
-        e = kbapi.NotFoundError(str(e))
+        e = exceptions.NotFoundError(str(e))
     elif isinstance(e, ValueError):
-        e = kbapi.BadRequestError(str(e))
+        e = exceptions.BadRequestError(str(e))
 
     # Now determine the response based on the exception type.
-    if isinstance(e, kbapi.Error):
+    if isinstance(e, exceptions.Error):
         code = e.__class__.__name__
         http_code = e.HTTP_CODE
         message = e.Message()
@@ -117,9 +115,7 @@ def prepare_data(data, inner=False):
 
 
 def to_dict(data):
-    if not isinstance(data, Message):
-        data = protolib.ToProto(data, full=True)
-    return Dict(protoutil.ProtoMessageToDict(data))
+    return serialize.to_dict(data, full=True)
 
 
 def wrap_exception(request, exception):
diff --git a/pykeg/web/api/views.py b/pykeg/web/api/views.py
index a7789db8..26f4843b 100644
--- a/pykeg/web/api/views.py
+++ b/pykeg/web/api/views.py
@@ -15,8 +15,7 @@
 
 from pykeg.core import keg_sizes, models
 from pykeg.core import util as core_util
-from pykeg.proto import kbapi, protolib
-from pykeg.web.api import devicelink, forms, util
+from pykeg.web.api import devicelink, exceptions, forms, serialize, util
 from pykeg.web.auth import UserExistsException
 from pykeg.web.kegadmin.forms import (
     ChangeKegForm,
@@ -79,12 +78,12 @@ def last_drink(request):
     drinks = models.Drink.objects.all().order_by("-id")
     if not drinks:
         raise Http404
-    return protolib.ToProto(drinks[0], full=True)
+    return serialize.to_dict(drinks[0], full=True)
 
 
 def get_drink(request, drink_id):
     drink = get_object_or_404(models.Drink, id=drink_id)
-    return protolib.ToProto(drink, full=True)
+    return serialize.to_dict(drink, full=True)
 
 
 @csrf_exempt
@@ -96,7 +95,7 @@ def all_controllers(request):
             return form.save()
         else:
             errors = _form_errors(form)
-            raise kbapi.BadRequestError(errors)
+            raise exceptions.BadRequestError(errors)
 
     return models.Controller.objects.all()
 
@@ -116,9 +115,9 @@ def get_controller(request, controller_id):
             controller = form.save()
         else:
             errors = _form_errors(form)
-            raise kbapi.BadRequestError(errors)
+            raise exceptions.BadRequestError(errors)
 
-    return protolib.ToProto(controller, full=True)
+    return serialize.to_dict(controller, full=True)
 
 
 @csrf_exempt
@@ -130,7 +129,7 @@ def all_flow_meters(request):
             return form.save()
         else:
             errors = _form_errors(form)
-            raise kbapi.BadRequestError(errors)
+            raise exceptions.BadRequestError(errors)
 
     return models.FlowMeter.objects.all()
 
@@ -150,9 +149,9 @@ def get_flow_meter(request, flow_meter_id):
             meter = form.save()
         else:
             errors = _form_errors(form)
-            raise kbapi.BadRequestError(errors)
+            raise exceptions.BadRequestError(errors)
 
-    return protolib.ToProto(meter, full=True)
+    return serialize.to_dict(meter, full=True)
 
 
 @csrf_exempt
@@ -164,7 +163,7 @@ def all_flow_toggles(request):
             return form.save()
         else:
             errors = _form_errors(form)
-            raise kbapi.BadRequestError(errors)
+            raise exceptions.BadRequestError(errors)
 
     return models.FlowToggle.objects.all()
 
@@ -184,9 +183,9 @@ def get_flow_toggle(request, flow_toggle_id):
             toggle = form.save()
         else:
             errors = _form_errors(form)
-            raise kbapi.BadRequestError(errors)
+            raise exceptions.BadRequestError(errors)
 
-    return protolib.ToProto(toggle, full=True)
+    return serialize.to_dict(toggle, full=True)
 
 
 @csrf_exempt
@@ -197,7 +196,7 @@ def pictures(request):
     pic = models.Picture.objects.create(
         image=request.FILES["photo"],
     )
-    return protolib.ToProto(pic, full=True)
+    return serialize.to_dict(pic, full=True)
 
 
 @csrf_exempt
@@ -207,7 +206,7 @@ def add_drink_photo(request, drink_id):
         raise Http404("Method not supported")
     drink = get_object_or_404(models.Drink, id=drink_id)
     pic = _save_pour_pic(request, drink)
-    return protolib.ToProto(pic, full=True)
+    return serialize.to_dict(pic, full=True)
 
 
 def _save_pour_pic(request, drink):
@@ -223,7 +222,7 @@ def _save_pour_pic(request, drink):
 
 def get_session(request, session_id):
     session = get_object_or_404(models.DrinkingSession, id=session_id)
-    return protolib.ToProto(session, full=True)
+    return serialize.to_dict(session, full=True)
 
 
 def get_session_stats(request, session_id):
@@ -243,7 +242,6 @@ def get_status(request):
     events = models.SystemEvent.objects.all()[:5]
     kegs = models.Keg.objects.all().filter(status=models.Keg.STATUS_ON_TAP)
     meters = models.FlowMeter.objects.all()
-    sound_events = []  # deprecated
     taps = models.KegTap.objects.all()
     toggles = models.FlowToggle.objects.all()
 
@@ -257,7 +255,7 @@ def get_status(request):
     title = models.KegbotSite.get().title
     version = core_util.get_version()
 
-    response = protolib.GetSyncResponse(
+    response = serialize.sync_dict(
         active_kegs=kegs,
         active_session=session,
         active_users=current_users,
@@ -267,7 +265,6 @@ def get_status(request):
         meters=meters,
         site_title=title,
         server_version=version,
-        sound_events=sound_events,
         taps=taps,
         toggles=toggles,
     )
@@ -280,7 +277,7 @@ def get_version(request):
 
 def get_keg(request, keg_id):
     keg = get_object_or_404(models.Keg, id=keg_id)
-    return protolib.ToProto(keg, full=True)
+    return serialize.to_dict(keg, full=True)
 
 
 def get_keg_drinks(request, keg_id):
@@ -317,7 +314,7 @@ def get_keg_sizes(request):
 def end_keg(request, keg_id):
     keg = get_object_or_404(models.Keg, id=keg_id)
     keg.end_keg()
-    return protolib.ToProto(keg, full=True)
+    return serialize.to_dict(keg, full=True)
 
 
 def all_sessions(request):
@@ -339,7 +336,7 @@ def all_events(request):
     events = models.SystemEvent.objects.all().order_by("-id")
     events = apply_since(request, events)
     events = events[:10]
-    return [protolib.ToProto(e, full=True) for e in events]
+    return [serialize.to_dict(e, full=True) for e in events]
 
 
 def apply_since(request, query):
@@ -387,7 +384,7 @@ def create_tap(request):
     form = forms.TapCreateForm(request.POST)
     if form.is_valid():
         return models.KegTap.create_tap(name=form.cleaned_data["name"])
-    raise kbapi.BadRequestError(_form_errors(form))
+    raise exceptions.BadRequestError(_form_errors(form))
 
 
 @auth_required
@@ -397,7 +394,7 @@ def user_list(request):
 
 def get_user(request, username):
     user = get_object_or_404(models.User, username=username)
-    return protolib.ToProto(user, full=True)
+    return serialize.to_dict(user, full=True)
 
 
 def get_user_drinks(request, username):
@@ -427,18 +424,18 @@ def get_auth_token(request, auth_device, token_value):
 @auth_required
 def assign_auth_token(request, auth_device, token_value):
     if not request.POST:
-        raise kbapi.BadRequestError("POST required.")
+        raise exceptions.BadRequestError("POST required.")
 
     form = forms.AssignTokenForm(request.POST)
     if not form.is_valid():
         errors = _form_errors(form)
-        raise kbapi.BadRequestError(errors)
+        raise exceptions.BadRequestError(errors)
 
     username = form.cleaned_data["username"]
 
     user = models.User.objects.filter(username=username).first()
     if not user:
-        raise kbapi.BadRequestError("User does not exist")
+        raise exceptions.BadRequestError("User does not exist")
 
     tok = models.AuthenticationToken.objects.filter(
         auth_device=auth_device, token_value=token_value
@@ -450,7 +447,7 @@ def assign_auth_token(request, auth_device, token_value):
 
     if tok.user != user:
         if tok.user:
-            raise kbapi.BadRequestError("Token is already bound to a user")
+            raise exceptions.BadRequestError("Token is already bound to a user")
         tok.user = user
         tok.save()
     return tok
@@ -500,7 +497,7 @@ def _thermo_sensor_get(request, sensor_name):
 def _thermo_sensor_post(request, sensor_name):
     form = forms.ThermoPostForm(request.POST)
     if not form.is_valid():
-        raise kbapi.BadRequestError(_form_errors(form))
+        raise exceptions.BadRequestError(_form_errors(form))
     cd = form.cleaned_data
     sensor, _ = models.ThermoSensor.objects.get_or_create(raw_name=sensor_name)
     # TODO(mikey): use form fields to compute `when`
@@ -535,11 +532,11 @@ def tap_detail(request, meter_name_or_id):
         tap.delete()
         return RESULT_OK
 
-    raise kbapi.BadRequestError("Method not supported")
+    raise exceptions.BadRequestError("Method not supported")
 
 
 def _tap_detail_get(request, tap):
-    return protolib.ToProto(tap, full=True)
+    return serialize.to_dict(tap, full=True)
 
 
 @csrf_exempt
@@ -551,7 +548,7 @@ def tap_calibrate(request, meter_name_or_id):
     tap = get_tap_from_meter_name_or_404(meter_name_or_id)
     meter = tap.current_meter()
     if not meter:
-        raise kbapi.BadRequestError("Tap does not have a meter!")
+        raise exceptions.BadRequestError("Tap does not have a meter!")
 
     form = forms.CalibrateTapForm(request.POST)
     if form.is_valid():
@@ -559,8 +556,8 @@ def tap_calibrate(request, meter_name_or_id):
         meter.save()
         tap = get_tap_from_meter_name_or_404(meter_name_or_id)
     else:
-        raise kbapi.BadRequestError(_form_errors(form))
-    return protolib.ToProto(tap, full=True)
+        raise exceptions.BadRequestError(_form_errors(form))
+    return serialize.to_dict(tap, full=True)
 
 
 @csrf_exempt
@@ -568,14 +565,14 @@ def tap_calibrate(request, meter_name_or_id):
 def tap_spill(request, meter_name_or_id):
     tap = get_tap_from_meter_name_or_404(meter_name_or_id)
     if not tap.current_keg:
-        raise kbapi.BadRequestError("No keg on tap.")
+        raise exceptions.BadRequestError("No keg on tap.")
     form = forms.TapSpillForm(request.POST)
     if form.is_valid():
         tap.current_keg.spilled_ml += form.cleaned_data["volume_ml"]
         tap.current_keg.save()
     else:
-        raise kbapi.BadRequestError(_form_errors(form))
-    return protolib.ToProto(tap, full=True)
+        raise exceptions.BadRequestError(_form_errors(form))
+    return serialize.to_dict(tap, full=True)
 
 
 @csrf_exempt
@@ -586,8 +583,8 @@ def tap_activate(request, meter_name_or_id):
     if form.is_valid():
         form.save(tap)
     else:
-        raise kbapi.BadRequestError(_form_errors(form))
-    return protolib.ToProto(tap, full=True)
+        raise exceptions.BadRequestError(_form_errors(form))
+    return serialize.to_dict(tap, full=True)
 
 
 @require_http_methods(["POST"])
@@ -599,8 +596,8 @@ def tap_connect_meter(request, meter_name_or_id):
     if form.is_valid():
         tap.connect_meter(form.cleaned_data["meter"])
     else:
-        raise kbapi.BadRequestError(_form_errors(form))
-    return protolib.ToProto(tap, full=True)
+        raise exceptions.BadRequestError(_form_errors(form))
+    return serialize.to_dict(tap, full=True)
 
 
 @require_http_methods(["POST"])
@@ -609,7 +606,7 @@ def tap_connect_meter(request, meter_name_or_id):
 def tap_disconnect_meter(request, meter_name_or_id):
     tap = get_tap_from_meter_name_or_404(meter_name_or_id)
     tap.connect_meter(None)
-    return protolib.ToProto(tap, full=True)
+    return serialize.to_dict(tap, full=True)
 
 
 @require_http_methods(["POST"])
@@ -621,8 +618,8 @@ def tap_connect_toggle(request, meter_name_or_id):
     if form.is_valid():
         tap.connect_toggle(form.cleaned_data["toggle"])
     else:
-        raise kbapi.BadRequestError(_form_errors(form))
-    return protolib.ToProto(tap, full=True)
+        raise exceptions.BadRequestError(_form_errors(form))
+    return serialize.to_dict(tap, full=True)
 
 
 @require_http_methods(["POST"])
@@ -631,7 +628,7 @@ def tap_connect_toggle(request, meter_name_or_id):
 def tap_disconnect_toggle(request, meter_name_or_id):
     tap = get_tap_from_meter_name_or_404(meter_name_or_id)
     tap.connect_toggle(None)
-    return protolib.ToProto(tap, full=True)
+    return serialize.to_dict(tap, full=True)
 
 
 @require_http_methods(["POST"])
@@ -643,8 +640,8 @@ def tap_connect_thermo(request, meter_name_or_id):
     if form.is_valid():
         tap.connect_thermo(form.cleaned_data["thermo"])
     else:
-        raise kbapi.BadRequestError(_form_errors(form))
-    return protolib.ToProto(tap, full=True)
+        raise exceptions.BadRequestError(_form_errors(form))
+    return serialize.to_dict(tap, full=True)
 
 
 @require_http_methods(["POST"])
@@ -653,14 +650,14 @@ def tap_connect_thermo(request, meter_name_or_id):
 def tap_disconnect_thermo(request, meter_name_or_id):
     tap = get_tap_from_meter_name_or_404(meter_name_or_id)
     tap.connect_thermo(None)
-    return protolib.ToProto(tap, full=True)
+    return serialize.to_dict(tap, full=True)
 
 
 @auth_required
 def _tap_detail_post(request, tap):
     form = forms.DrinkPostForm(request.POST)
     if not form.is_valid():
-        raise kbapi.BadRequestError(_form_errors(form))
+        raise exceptions.BadRequestError(_form_errors(form))
     cd = form.cleaned_data
     if cd.get("record_date"):
         pour_time = datetime.datetime.fromisoformat(cd.get("record_date"))
@@ -686,21 +683,21 @@ def _tap_detail_post(request, tap):
         tick_time_series=cd.get("tick_time_series"),
         photo=request.FILES.get("photo", None),
     )
-    return protolib.ToProto(drink, full=True)
+    return serialize.to_dict(drink, full=True)
 
 
 @csrf_exempt
 @auth_required
 def cancel_drink(request):
     if request.method != "POST":
-        raise kbapi.BadRequestError("POST required")
+        raise exceptions.BadRequestError("POST required")
     form = forms.CancelDrinkForm(request.POST)
     if not form.is_valid():
-        raise kbapi.BadRequestError(_form_errors(form))
+        raise exceptions.BadRequestError(_form_errors(form))
     cd = form.cleaned_data
     drink = get_object_or_404(models.Drink, id=cd["id"])
     # Serialize before canceling: cancel_drink deletes the record.
-    result = protolib.ToDict(drink, full=True)
+    result = serialize.to_dict(drink, full=True)
     drink.cancel_drink(spilled=cd.get("spilled", False))
     return result
 
@@ -715,7 +712,7 @@ def login(request):
             request.session.delete_test_cookie()
         return RESULT_OK
     else:
-        raise kbapi.PermissionDeniedError("Login failed.")
+        raise exceptions.PermissionDeniedError("Login failed.")
 
 
 def logout(request):
@@ -727,7 +724,7 @@ def logout(request):
 @auth_required
 def register(request):
     if not request.POST:
-        raise kbapi.BadRequestError("POST required.")
+        raise exceptions.BadRequestError("POST required.")
     form = forms.RegisterForm(request.POST)
     errors = {}
     if not form.is_valid():
@@ -741,12 +738,12 @@ def register(request):
             user = models.User.create_new_user(
                 username, email=email, password=password, photo=photo
             )
-            return protolib.ToProto(user, full=True)
+            return serialize.to_dict(user, full=True)
         except UserExistsException:
             user_errs = errors.get("username", [])
             user_errs.append("Username not available.")
             errors["username"] = user_errs
-    raise kbapi.BadRequestError(errors)
+    raise exceptions.BadRequestError(errors)
 
 
 @csrf_exempt
@@ -769,7 +766,7 @@ def get_user_photo(request, user):
 def post_user_photo(request, user):
     photo_file = request.FILES.get("photo")
     if not photo_file:
-        raise kbapi.BadRequestError('The file "photo" is required.')
+        raise exceptions.BadRequestError('The file "photo" is required.')
 
     pic = models.Picture.objects.create(user=user)
     pic.image.save(photo_file.name, photo_file)
@@ -777,7 +774,7 @@ def post_user_photo(request, user):
 
     user.mugshot = pic
     user.save()
-    return protolib.ToProto(pic)
+    return serialize.to_dict(pic)
 
 
 @csrf_exempt
diff --git a/pyproject.toml b/pyproject.toml
index 1cd80f43..e2d26828 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,7 +24,6 @@ dependencies = [
     "mysqlclient",
     "packaging",
     "Pillow",
-    "protobuf>=5,<7",
     "psycopg2",
     "PyYAML",
     "redis",
@@ -70,8 +69,6 @@ exclude = [
     "build",
     "dist",
     "migrations",
-    # Generated protobuf code (regenerated from kegbot-api .proto sources).
-    "pykeg/proto/*_pb2.py",
 ]
 
 [tool.ruff.format]
diff --git a/uv.lock b/uv.lock
index 38e7cc24..5a418d3f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -502,7 +502,6 @@ dependencies = [
     { name = "mysqlclient" },
     { name = "packaging" },
     { name = "pillow" },
-    { name = "protobuf" },
     { name = "psycopg2" },
     { name = "pyyaml" },
     { name = "redis" },
@@ -549,7 +548,6 @@ requires-dist = [
     { name = "mysqlclient" },
     { name = "packaging" },
     { name = "pillow" },
-    { name = "protobuf", specifier = ">=5,<7" },
     { name = "psycopg2" },
     { name = "pyyaml" },
     { name = "redis" },
@@ -730,21 +728,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/fb/49/bc925106abcdac498074f2cbe6137e94e09f418dd2b7775df5b577dc0313/pre_commit-4.6.1-py2.py3-none-any.whl", hash = "sha256:0e3b2942510d1fb34eec167a3ec57331bf8442122f1153a9fb8b58f5c49b2717", size = 226186, upload-time = "2026-07-21T20:56:57.064Z" },
 ]
 
-[[package]]
-name = "protobuf"
-version = "6.33.6"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/66/70/e908e9c5e52ef7c3a6c7902c9dfbb34c7e29c25d2f81ade3856445fd5c94/protobuf-6.33.6.tar.gz", hash = "sha256:a6768d25248312c297558af96a9f9c929e8c4cee0659cb07e780731095f38135", size = 444531, upload-time = "2026-03-18T19:05:00.988Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/fc/9f/2f509339e89cfa6f6a4c4ff50438db9ca488dec341f7e454adad60150b00/protobuf-6.33.6-cp310-abi3-win32.whl", hash = "sha256:7d29d9b65f8afef196f8334e80d6bc1d5d4adedb449971fefd3723824e6e77d3", size = 425739, upload-time = "2026-03-18T19:04:48.373Z" },
-    { url = "https://files.pythonhosted.org/packages/76/5d/683efcd4798e0030c1bab27374fd13a89f7c2515fb1f3123efdfaa5eab57/protobuf-6.33.6-cp310-abi3-win_amd64.whl", hash = "sha256:0cd27b587afca21b7cfa59a74dcbd48a50f0a6400cfb59391340ad729d91d326", size = 437089, upload-time = "2026-03-18T19:04:50.381Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/01/a3c3ed5cd186f39e7880f8303cc51385a198a81469d53d0fdecf1f64d929/protobuf-6.33.6-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:9720e6961b251bde64edfdab7d500725a2af5280f3f4c87e57c0208376aa8c3a", size = 427737, upload-time = "2026-03-18T19:04:51.866Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/90/b3c01fdec7d2f627b3a6884243ba328c1217ed2d978def5c12dc50d328a3/protobuf-6.33.6-cp39-abi3-manylinux2014_aarch64.whl", hash = "sha256:e2afbae9b8e1825e3529f88d514754e094278bb95eadc0e199751cdd9a2e82a2", size = 324610, upload-time = "2026-03-18T19:04:53.096Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/ca/25afc144934014700c52e05103c2421997482d561f3101ff352e1292fb81/protobuf-6.33.6-cp39-abi3-manylinux2014_s390x.whl", hash = "sha256:c96c37eec15086b79762ed265d59ab204dabc53056e3443e702d2681f4b39ce3", size = 339381, upload-time = "2026-03-18T19:04:54.616Z" },
-    { url = "https://files.pythonhosted.org/packages/16/92/d1e32e3e0d894fe00b15ce28ad4944ab692713f2e7f0a99787405e43533a/protobuf-6.33.6-cp39-abi3-manylinux2014_x86_64.whl", hash = "sha256:e9db7e292e0ab79dd108d7f1a94fe31601ce1ee3f7b79e0692043423020b0593", size = 323436, upload-time = "2026-03-18T19:04:55.768Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/72/02445137af02769918a93807b2b7890047c32bfb9f90371cbc12688819eb/protobuf-6.33.6-py3-none-any.whl", hash = "sha256:77179e006c476e69bf8e8ce866640091ec42e1beb80b213c3900006ecfba6901", size = 170656, upload-time = "2026-03-18T19:04:59.826Z" },
-]
-
 [[package]]
 name = "psycopg2"
 version = "2.9.12"

From d289465b2aeaeb0826e87870cc55e832960bfda9 Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 19:42:09 +0000
Subject: [PATCH 4/9] api: trim the legacy api to the pycore surface

- only the endpoints kegbot-pycore calls remain (status, taps,
  record/cancel drink, thermo logging, auth-token lookup, controller
  and flow-meter creation), plus the events feed the fullscreen page
  polls; every other route answers 410 Gone
- the device-link flow (api + kegadmin page) is removed along with the
  other app-only endpoints
---
 pykeg/web/api/api_test.py                     | 482 ++-----------
 pykeg/web/api/devicelink.py                   | 106 ---
 pykeg/web/api/devicelink_test.py              |  41 --
 pykeg/web/api/exceptions.py                   |   6 +
 pykeg/web/api/forms.py                        |  47 --
 pykeg/web/api/middleware.py                   |  16 +-
 pykeg/web/api/urls.py                         |  67 +-
 pykeg/web/api/views.py                        | 635 ++----------------
 pykeg/web/kegadmin/forms.py                   |  12 -
 .../templates/kegadmin/link_device.html       |  10 -
 pykeg/web/kegadmin/urls.py                    |   1 -
 pykeg/web/kegadmin/views.py                   |  25 -
 pykeg/web/urls.py                             |   7 +-
 13 files changed, 140 insertions(+), 1315 deletions(-)
 delete mode 100644 pykeg/web/api/devicelink.py
 delete mode 100644 pykeg/web/api/devicelink_test.py
 delete mode 100644 pykeg/web/kegadmin/templates/kegadmin/link_device.html

diff --git a/pykeg/web/api/api_test.py b/pykeg/web/api/api_test.py
index 62bcd799..c1de4080 100644
--- a/pykeg/web/api/api_test.py
+++ b/pykeg/web/api/api_test.py
@@ -1,13 +1,8 @@
 """Unittests for pykeg.web.api"""
 
-from django.core import mail
 from django.test import TestCase
-from django.test.utils import override_settings
-from django.urls import reverse
 
 from pykeg.core import defaults, models
-from pykeg.core.testutils import get_filename
-from pykeg.core.util import get_version
 from pykeg.util import kbjson
 
 # Helper methods
@@ -26,16 +21,12 @@ def post(self, subpath, data={}, follow=False, **extra):
         response = self.client.post(f"/api/{subpath}", data=data, follow=follow, **extra)
         return response, kbjson.loads(response.content)
 
-    def delete(self, subpath, data={}, follow=False, **extra):
-        response = self.client.delete(f"/api/{subpath}", data=data, follow=follow, **extra)
-        return response, kbjson.loads(response.content)
-
 
 class ApiClientNoSiteTestCase(BaseApiTestCase):
     def testNotSetUp(self):
         """Api endpoints should all error out prior to site setup."""
 
-        endpoints = ("events/", "taps/", "kegs/", "drinks/")
+        endpoints = ("events/", "taps/")
         for endpoint in endpoints:
             response, data = self.get(endpoint)
             self.assertEqual(data.meta.result, "error")
@@ -65,11 +56,18 @@ def setUp(self):
 
         self.tap = models.KegTap.objects.all().first()
 
+    def start_keg(self):
+        return models.Keg.start_keg(
+            "kegboard.flow0",
+            beverage_name="Test Brew",
+            beverage_type="beer",
+            producer_name="Test Producer",
+            style_name="Test Style",
+        )
+
     def test_defaults(self):
-        empty_endpoints = ("events/", "kegs/")
-        for endpoint in empty_endpoints:
-            response, data = self.get(endpoint)
-            self.assertEqual(data.objects, [])
+        response, data = self.get("events/")
+        self.assertEqual(data.objects, [])
 
         response, data = self.get("taps/")
         taps = data.objects
@@ -89,7 +87,7 @@ def test_defaults(self):
             self.assertEqual(data1, data2)
 
     def test_api_access(self):
-        endpoint = "users/"
+        endpoint = "controllers"
 
         # No API key.
         response, data = self.get(endpoint)
@@ -101,7 +99,7 @@ def test_api_access(self):
         self.assertEqual(data.meta.result, "error")
         self.assertEqual(data.error.code, "BadApiKeyError")
 
-        # Key exists, non-superuser.
+        # Key exists, staff user.
         response, data = self.get(endpoint, HTTP_X_KEGBOT_API_KEY=self.bad_apikey.key)
         self.assertEqual(data.meta.result, "ok")
 
@@ -124,7 +122,7 @@ def test_api_access(self):
         response, data = self.get(endpoint)
         self.assertEqual(data.meta.result, "ok")
 
-        # Alert to staff-only.
+        # Alter to staff-only.
         self.site.privacy = "staff"
         self.site.save()
         response, data = self.get(endpoint)
@@ -135,39 +133,12 @@ def test_api_access(self):
         self.assertEqual(data.meta.result, "error")
         self.assertEqual(data.error.code, "NoAuthTokenError")
 
-        # Login endpoint works despite privacy settings
-        for ep in ("login", "login/", "v1/login", "v1/login/"):
-            response, data = self.post(ep, data={"username": "admin", "password": "testpass"})
-            self.assertEqual(data.meta.result, "ok")
-
-        for ep in ("version/", "v1/version/"):
-            response, data = self.get(ep)
-            self.assertEqual(data.meta.result, "ok")
-
     def test_record_drink(self):
         response, data = self.get(f"taps/{self.tap.id}")
         self.assertEqual(data.meta.result, "ok")
         self.assertEqual(data.object.get("current_keg"), None)
 
-        response, data = self.get("drinks/last")
-        self.assertEqual(response.status_code, 404)
-        self.assertEqual(data.meta.result, "error")
-
-        new_keg_data = {
-            "keg_size": "half-barrel",
-            "beverage_name": "Test Brew",
-            "producer_name": "Test Producer",
-            "style_name": "Test Style,",
-        }
-        response, data = self.post(f"taps/{self.tap.id}/activate", data=new_keg_data)
-        self.assertEqual(data.meta.result, "error")
-        self.assertEqual(data.error.code, "NoAuthTokenError")
-
-        response, data = self.post(
-            f"taps/{self.tap.id}/activate", data=new_keg_data, HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(data.meta.result, "ok")
-        self.assertIsNotNone(data.object.get("current_keg"))
+        self.start_keg()
 
         response, data = self.post(f"taps/{self.tap.id}", data={"ticks": 1000})
         self.assertEqual(data.meta.result, "error")
@@ -180,11 +151,7 @@ def test_record_drink(self):
         )
         self.assertEqual(data.meta.result, "ok")
         drink = data.object
-
-        response, data = self.get("drinks/last")
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(data.meta.result, "ok")
-        self.assertEqual(data.object.id, drink.id)
+        self.assertEqual(drink.id, models.Drink.objects.latest("id").id)
 
         response, data = self.get("status", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
         self.assertEqual(data.meta.result, "ok")
@@ -194,16 +161,7 @@ def test_record_drink(self):
         self.assertEqual(self.normal_user.username, active_user.username)
 
     def test_record_drink_usernames(self):
-        new_keg_data = {
-            "keg_size": "half-barrel",
-            "beverage_name": "Test Brew",
-            "producer_name": "Test Producer",
-            "style_name": "Test Style,",
-        }
-        response, data = self.post(
-            f"taps/{self.tap.id}/activate", data=new_keg_data, HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(data.meta.result, "ok")
+        self.start_keg()
 
         models.User.objects.create(username="test.123")
         response, data = self.post(
@@ -213,51 +171,6 @@ def test_record_drink_usernames(self):
         )
         self.assertEqual(data.meta.result, "ok")
 
-    @override_settings(EMAIL_BACKEND="django.core.mail.backends.locmem.EmailBackend")
-    @override_settings(DEFAULT_FROM_EMAIL="test-from@example")
-    def test_registration(self):
-        response, data = self.post(
-            "new-user/", data={"username": "newuser", "email": "foo@example.com"}
-        )
-        self.assertEqual(data.meta.result, "error")
-        self.assertEqual(data.error.code, "NoAuthTokenError")
-
-        self.assertEqual(0, len(mail.outbox))
-
-        response, data = self.post(
-            "new-user/",
-            data={"username": "newuser", "email": "foo@example.com"},
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-        )
-        self.assertEqual(data.meta.result, "ok")
-        self.assertEqual(1, len(mail.outbox))
-
-        msg = mail.outbox[0]
-        self.assertEqual("[My Kegbot] Complete your registration", msg.subject)
-        self.assertEqual(["foo@example.com"], msg.to)
-        self.assertEqual("test-from@example", msg.from_email)
-
-        # Simulate clicking on the activation link.
-        user = models.User.objects.get(username="newuser")
-        self.assertIsNotNone(user.activation_key)
-        activation_url = reverse(
-            "activate-account", args=(), kwargs={"activation_key": user.activation_key}
-        )
-        self.client.logout()
-        response = self.client.get(activation_url)
-        self.assertContains(response, "Choose a Password", status_code=200)
-
-    def test_pictures(self):
-        image_data = open(get_filename("test_image_800x600.png"), "rb")
-        response, data = self.post(
-            "pictures/", data={"photo": image_data}, HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(data.meta.result, "ok")
-
-        picture = data["object"]
-        picture_url = picture["url"]
-        self.assertTrue(picture_url.startswith("http://test.example.com/media/"))
-
     def test_controller_data(self):
         for endpoint in ("controllers", "flow-meters"):
             response, data = self.get(endpoint)
@@ -307,337 +220,64 @@ def test_controller_data(self):
         }
         self.assertEqual(expected, data)
 
-        response, data = self.get("flow-toggles", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(data.meta.result, "ok")
-        toggles = models.FlowToggle.objects.all()
-        expected = {
-            "objects": [
-                {
-                    "id": toggles[0].id,
-                    "port_name": "relay0",
-                    "controller": {
-                        "id": controllers[0].id,
-                        "name": "kegboard",
-                    },
-                    "name": "kegboard.relay0",
-                },
-                {
-                    "id": toggles[1].id,
-                    "port_name": "relay1",
-                    "controller": {"id": controllers[0].id, "name": "kegboard"},
-                    "name": "kegboard.relay1",
-                },
-            ],
-            "meta": {"result": "ok"},
-        }
-        self.assertEqual(expected, data)
-
-    def test_add_remove_meters(self):
-        response, data = self.get(f"taps/{self.tap.id}", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(data.meta.result, "ok")
-        meter = models.FlowMeter.objects.get(tap=self.tap)
-        self.assertEqual(data.object.meter.id, meter.id)
-        original_data = data
-
-        response, data = self.post(
-            f"taps/{self.tap.id}/disconnect-meter", HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(data.meta.result, "ok")
-        self.assertEqual(data.object.get("meter"), None)
-
-        response, data = self.post(
-            f"taps/{self.tap.id}/connect-meter",
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={"meter": meter.id},
-        )
-        self.assertEqual(data.meta.result, "ok")
-        self.assertEqual(data.object.meter.id, meter.id)
-        self.assertEqual(original_data, data)
-
-    def test_add_remove_toggles(self):
-        response, data = self.get(f"taps/{self.tap.id}", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(data.meta.result, "ok")
-        toggle = models.FlowToggle.objects.get(tap=self.tap)
-        self.assertEqual(data.object.toggle.id, toggle.id)
-
-        response, data = self.post(
-            f"taps/{self.tap.id}/disconnect-toggle", HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(data.meta.result, "ok")
-        self.assertEqual(data.object.get("toggle"), None)
-
-        response, data = self.post(
-            f"taps/{self.tap.id}/connect-toggle",
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={"toggle": toggle.id},
-        )
-        response, data = self.get(f"taps/{self.tap.id}", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(data.meta.result, "ok")
-        self.assertIsNotNone(data.object.get("toggle"))
-        self.assertEqual(data.object.toggle.id, toggle.id)
-
-    def test_get_version(self):
-        response, data = self.get("version")
-        self.assertEqual(data.meta.result, "ok")
-        self.assertEqual(data.object.get("server_version"), get_version())
-
-    def test_devices(self):
-        # Perform a device link.
-        response, data = self.post("devices/link", data={"name": "Test Device"})
-        self.assertEqual(data.meta.result, "ok")
-        code = data.object.code
-
-        response, data = self.get("devices/link/status/" + code)
-        self.assertEqual(data.meta.result, "ok")
-        self.assertEqual(False, data.object.linked)
-
-        self.client.login(username="admin", password="testpass")
-        response = self.client.post("/kegadmin/devices/link/", data={"code": code}, follow=True)
-        self.client.logout()
-        self.assertEqual(response.status_code, 200)
-
-        response, data = self.get("devices/link/status/" + code)
-        self.assertEqual(data.meta.result, "ok")
-        self.assertEqual(True, data.object.linked)
-        api_key = data.object.get("api_key")
-        self.assertIsNotNone(api_key)
-
-        key_obj = models.ApiKey.objects.get(key=api_key)
-        self.assertIsNotNone(key_obj.device)
-        self.assertEqual("Test Device", key_obj.device.name)
-
-        # Confirm device key is gone.
-        response, data = self.get("devices/link/status/" + code)
-        self.assertEqual(response.status_code, 404)
-
-    # Kegbot object tests
-
     def test_auth_tokens(self):
         response, data = self.get("auth-tokens/nfc/deadbeef", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
         self.assertEqual(data.meta.result, "error")
         self.assertEqual(response.status_code, 404)
 
-        response, data = self.post(
-            "auth-tokens/nfc/deadbeef/assign",
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={"username": self.normal_user.username},
+        models.AuthenticationToken.create_auth_token(
+            "nfc", "deadbeef", username=self.normal_user.username
         )
+        response, data = self.get("auth-tokens/nfc/deadbeef", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
         self.assertEqual(data.meta.result, "ok")
         self.assertEqual(data.object.auth_device, "nfc")
         self.assertEqual(data.object.token_value, "deadbeef")
         self.assertEqual(data.object.username, "normal_user")
-        self.assertEqual(response.status_code, 200)
 
-    def test_controllers(self):
-        """List, create, update, and delete controllers."""
-        # List controllers.
-        response, data = self.get("controllers", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(1, len(data.objects))
-        self.assertEqual("kegboard", data.objects[0]["name"])
-
-        # Create a new controller.
-        response, data = self.post(
-            "controllers",
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={
-                "name": "Test Controller",
-                "model_name": "Test Model",
-                "serial_number": "Test Serial",
-            },
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("Test Controller", data.object.name)
-        self.assertEqual("Test Model", data.object.model_name)
-        self.assertEqual("Test Serial", data.object.serial_number)
-
-        # Fetch controller.
-        new_controller_id = data.object.id
-        response, data = self.get(
-            "controllers/" + str(new_controller_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("Test Controller", data.object.name)
-        self.assertEqual("Test Model", data.object.model_name)
-        self.assertEqual("Test Serial", data.object.serial_number)
-
-        # Update controller
-        response, data = self.post(
-            "controllers/" + str(new_controller_id),
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={
-                "name": "Test Controller+",
-                "model_name": "Test Model+",
-                "serial_number": "Test Serial+",
-            },
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("Test Controller+", data.object.name)
-        self.assertEqual("Test Model+", data.object.model_name)
-        self.assertEqual("Test Serial+", data.object.serial_number)
-
-        response, data = self.get(
-            "controllers/" + str(new_controller_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("Test Controller+", data.object.name)
-        self.assertEqual("Test Model+", data.object.model_name)
-        self.assertEqual("Test Serial+", data.object.serial_number)
-
-        # Delete controller
-        response, data = self.delete("controllers/" + str(new_controller_id))
-        self.assertEqual(response.status_code, 401)
-        response, data = self.delete(
-            "controllers/" + str(new_controller_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 200)
-        response, data = self.get(
-            "controllers/" + str(new_controller_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 404)
-
-    def test_flow_meters(self):
-        """List, create, update, and delete flow meters."""
-        # List flow meters.
-        response, data = self.get("flow-meters", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(2, len(data.objects))
-        self.assertEqual("kegboard.flow0", data.objects[0]["name"])
-        self.assertEqual("flow0", data.objects[0]["port_name"])
-        self.assertEqual("kegboard.flow1", data.objects[1]["name"])
-        self.assertEqual("flow1", data.objects[1]["port_name"])
-
-        # Create a new meter.
-        controller = models.Controller.objects.all()[0]
-        response, data = self.post(
-            "flow-meters",
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={
-                "port_name": "flow-test",
-                "ticks_per_ml": 3.45,
-                "controller": controller.id,
-            },
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("kegboard.flow-test", data.object.name)
-        self.assertEqual("flow-test", data.object.port_name)
-        self.assertEqual(3.45, data.object.ticks_per_ml)
-        self.assertEqual(controller.name, data.object.controller.name)
-
-        # Fetch meter.
-        new_meter_id = data.object.id
-        response, data = self.get(
-            "flow-meters/" + str(new_meter_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("kegboard.flow-test", data.object.name)
-        self.assertEqual("flow-test", data.object.port_name)
-        self.assertEqual(3.45, data.object.ticks_per_ml)
-        self.assertEqual(controller.name, data.object.controller.name)
+    def test_create_tap(self):
+        response, data = self.post("taps/", data={"name": "Third Tap"})
+        self.assertEqual(data.meta.result, "error")
+        self.assertEqual(data.error.code, "NoAuthTokenError")
 
-        # Update meter
         response, data = self.post(
-            "flow-meters/" + str(new_meter_id),
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={
-                "ticks_per_ml": 5.67,
-            },
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("kegboard.flow-test", data.object.name)
-        self.assertEqual(5.67, data.object.ticks_per_ml)
-        self.assertEqual(controller.name, data.object.controller.name)
-
-        # Delete meter
-        response, data = self.delete("flow-meters/" + str(new_meter_id))
-        self.assertEqual(response.status_code, 401)
-        response, data = self.delete(
-            "flow-meters/" + str(new_meter_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
+            "taps/", data={"name": "Third Tap"}, HTTP_X_KEGBOT_API_KEY=self.apikey.key
         )
-        self.assertEqual(response.status_code, 200)
-        response, data = self.get(
-            "flow-meters/" + str(new_meter_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 404)
+        self.assertEqual(data.meta.result, "ok")
+        self.assertEqual("Third Tap", data.object.name)
+        self.assertEqual(3, models.KegTap.objects.count())
 
-    def test_flow_toggles(self):
-        """List, create, and delete flow toggles."""
-        # List flow toggles.
-        response, data = self.get("flow-toggles", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(2, len(data.objects))
-        self.assertEqual("kegboard.relay0", data.objects[0]["name"])
-        self.assertEqual("relay0", data.objects[0]["port_name"])
-        self.assertEqual("kegboard.relay1", data.objects[1]["name"])
-        self.assertEqual("relay1", data.objects[1]["port_name"])
-
-        # Create a new toggle.
-        controller = models.Controller.objects.all()[0]
-        response, data = self.post(
-            "flow-toggles",
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={
-                "port_name": "toggle-test",
-                "controller": controller.id,
-            },
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("kegboard.toggle-test", data.object.name)
-        self.assertEqual("toggle-test", data.object.port_name)
-        self.assertEqual(controller.name, data.object.controller.name)
-
-        # Fetch toggle.
-        new_toggle_id = data.object.id
-        response, data = self.get(
-            "flow-toggles/" + str(new_toggle_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("kegboard.toggle-test", data.object.name)
-        self.assertEqual("toggle-test", data.object.port_name)
-        self.assertEqual(controller.name, data.object.controller.name)
-
-        # Delete toggle.
-        response, data = self.delete("flow-toggles/" + str(new_toggle_id))
-        self.assertEqual(response.status_code, 401)
-        response, data = self.delete(
-            "flow-toggles/" + str(new_toggle_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 200)
-        response, data = self.get(
-            "flow-toggles/" + str(new_toggle_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key
-        )
-        self.assertEqual(response.status_code, 404)
 
-    def test_taps(self):
-        """List, create, and delete taps."""
-        # List flow toggles.
-        response, data = self.get("taps", HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(2, len(data.objects))
-        self.assertEqual("Main Tap", data.objects[0]["name"])
-        self.assertEqual("Second Tap", data.objects[1]["name"])
+class RetiredEndpointsTestCase(BaseApiTestCase):
+    def setUp(self):
+        self.site = create_site()
 
-        # Create a new toggle.
-        response, data = self.post(
-            "taps",
-            HTTP_X_KEGBOT_API_KEY=self.apikey.key,
-            data={
-                "name": "Test Tap",
-            },
+    def test_retired_endpoints_are_gone(self):
+        retired = (
+            "version",
+            "login",
+            "logout",
+            "get-api-key",
+            "devices/link",
+            "drinks",
+            "drinks/last",
+            "kegs/",
+            "kegs/1",
+            "keg-sizes/",
+            "sessions/",
+            "sessions/current",
+            "sound-events/",
+            "stats/",
+            "users/",
+            "users/someuser",
+            "new-user/",
+            "pictures/",
+            "taps/1/activate",
+            "taps/1/calibrate",
+            "auth-tokens/nfc/deadbeef/assign",
+            "thermo-sensors/foo/logs",
         )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("Test Tap", data.object.name)
-
-        # Fetch tap.
-        tap_id = data.object.id
-        response, data = self.get("taps/" + str(tap_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual("Test Tap", data.object.name)
-
-        # Delete tap.
-        response, data = self.delete("taps/" + str(tap_id))
-        self.assertEqual(response.status_code, 401)
-        response, data = self.delete("taps/" + str(tap_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(response.status_code, 200)
-        response, data = self.get("taps/" + str(tap_id), HTTP_X_KEGBOT_API_KEY=self.apikey.key)
-        self.assertEqual(response.status_code, 404)
+        for endpoint in retired:
+            response, data = self.get(endpoint)
+            self.assertEqual(410, response.status_code, f"expected 410 for {endpoint}")
+            self.assertEqual("error", data.meta.result)
+            self.assertEqual("GoneError", data.error.code)
diff --git a/pykeg/web/api/devicelink.py b/pykeg/web/api/devicelink.py
deleted file mode 100644
index f2e4d2d6..00000000
--- a/pykeg/web/api/devicelink.py
+++ /dev/null
@@ -1,106 +0,0 @@
-"""Protocol for associating new frontend devices with a Kegbot server.
-
-The protocol consists of three phases, ultimately granting the requesting
-device (client) a new API key to Kegbot Server.
-
-Protocol:
-
-    1. Client initiates a new pairing session by POSTing to
-       `/api/devices/link`.
-
-    2. Server generates a new opaque and unguessable short-lived
-       pairing token (`start_link()`) and returns it to the client.
-
-    3. Client displays the pairing token on its screen, and continuously
-       polls its status via `/api/devices/status/<token>` (`get_status()`).
-
-    4. User logs in to the web interface and confirms the request by
-       entering the same access token into a form, causing the token
-       to be marked as validated (`confirm_link()`).
-
-    5. On next subsequent poll of `/api/devices/status/<token>`, the
-       request handler discovers the token has been confirm, creates
-       a new Device record and ApiKey, and returns the ApiKey.
-"""
-
-import random
-
-from django.core.cache import cache
-
-from pykeg.core import models
-
-CACHE_PREFIX = "devicelink:"
-CACHE_TIMEOUT = 60 * 60
-
-# Letters used to build a new device link code.  Currently
-# A-Z,0-9 sans visually-ambiguous characters {I, 1, O, 0}.
-CODE_LETTERS = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
-
-# Default code size generated by _build_code.  Entropy of the pairing
-# code is:
-#
-#   len(CODE_LETTERS) ** DEFAULT_CODE_SIZE
-#
-# Entropy is only needed to prevent collisions of active pairing
-# sessions, and not for security of the protocol (since an attacker
-# still needs a logged-in admin session cookie to accept a
-# guessed code).
-DEFAULT_CODE_SIZE = 6
-
-
-class LinkExpiredException(Exception):
-    """Link code not found."""
-
-
-def _build_code(size=DEFAULT_CODE_SIZE):
-    code = "".join(random.choice(CODE_LETTERS) for i in range(size))
-    mid = size // 2
-    code = f"{code[:mid]}-{code[mid:]}"
-    return code
-
-
-def _get_status(code):
-    cache_key = "".join((CACHE_PREFIX, code))
-    status = cache.get(cache_key)
-    return status
-
-
-def _set_status(code, status):
-    cache_key = "".join((CACHE_PREFIX, code))
-    cache.set(cache_key, status, timeout=CACHE_TIMEOUT)
-
-
-def start_link(name):
-    """Starts a new link, by allocating and returning a link code."""
-    if not name:
-        raise ValueError("Must specify a name.")
-    code = _build_code()
-    _set_status(code, {"name": name, "linked": False})
-    return code
-
-
-def confirm_link(code):
-    """Confirms a link, ie, flips its status to True."""
-    status = _get_status(code)
-    if not status:
-        raise LinkExpiredException("Code not found")
-    status["linked"] = True
-    _set_status(code, status)
-    return status
-
-
-def get_status(code):
-    """Gets status, finishing the link if true.
-
-    Returns: string api key on link, None otherwise
-    """
-    status = _get_status(code)
-    if not status:
-        raise LinkExpiredException("Code not found")
-    if status.get("linked"):
-        cache_key = "".join((CACHE_PREFIX, code))
-        cache.delete(cache_key)
-        device = models.Device.objects.create(name=status.get("name"))
-        apikey = models.ApiKey.objects.create(description="Linked device.", device=device)
-        return apikey.key
-    return None
diff --git a/pykeg/web/api/devicelink_test.py b/pykeg/web/api/devicelink_test.py
deleted file mode 100644
index c988e759..00000000
--- a/pykeg/web/api/devicelink_test.py
+++ /dev/null
@@ -1,41 +0,0 @@
-"""Unittests for pykeg.web.api.devicelink"""
-
-from django.core.cache import cache
-from django.test import TransactionTestCase
-
-from pykeg.core import models
-from pykeg.web.api import devicelink
-
-
-class DevicelinkTest(TransactionTestCase):
-    def test_pairing(self):
-        code = devicelink.start_link("test1")
-        key = "".join((devicelink.CACHE_PREFIX, code))
-        saved = cache.get(key)
-        self.assertEqual({"name": "test1", "linked": False}, saved)
-
-        status = devicelink.get_status(code)
-        self.assertIsNone(status)
-
-        devicelink.confirm_link(code)
-        saved = cache.get(key)
-        self.assertEqual({"name": "test1", "linked": True}, saved)
-
-        status = devicelink.get_status(code)
-        self.assertIsNotNone(status)
-        apikey = models.ApiKey.objects.get(key=status)
-        self.assertEqual("test1", apikey.device.name)
-
-        # Entry has been deleted.
-        self.assertRaises(devicelink.LinkExpiredException, devicelink.get_status, code)
-
-        self.assertRaises(devicelink.LinkExpiredException, devicelink.get_status, "bogus-code")
-
-    def test_build_code(self):
-        code = devicelink._build_code(6)
-        self.assertEqual(7, len(code))
-        self.assertEqual("-", code[3])
-
-        code = devicelink._build_code(3)
-        self.assertEqual(4, len(code))
-        self.assertEqual("-", code[1])
diff --git a/pykeg/web/api/exceptions.py b/pykeg/web/api/exceptions.py
index c79e7e21..05256002 100644
--- a/pykeg/web/api/exceptions.py
+++ b/pykeg/web/api/exceptions.py
@@ -51,3 +51,9 @@ class PermissionDeniedError(Error):
     """The api_key given does not have permission for this resource."""
 
     HTTP_CODE = 401
+
+
+class GoneError(Error):
+    """This endpoint has been retired."""
+
+    HTTP_CODE = 410
diff --git a/pykeg/web/api/forms.py b/pykeg/web/api/forms.py
index fc93b807..7bcd4244 100644
--- a/pykeg/web/api/forms.py
+++ b/pykeg/web/api/forms.py
@@ -1,12 +1,7 @@
 from django import forms
 
-from pykeg.core import models
 from pykeg.core.kb_common import USERNAME_REGEX
 
-ALL_METERS = models.FlowMeter.objects.all()
-ALL_TOGGLES = models.FlowToggle.objects.all()
-ALL_THERMOS = models.ThermoSensor.objects.all()
-
 
 class DrinkPostForm(forms.Form):
     """Form to handle posts to /tap/<tap_id>/"""
@@ -37,47 +32,5 @@ class ThermoPostForm(forms.Form):
     now = forms.IntegerField(required=False)
 
 
-class CreateKegTapForm(forms.ModelForm):
-    class Meta:
-        model = models.KegTap
-        fields = ("name", "notes")
-
-
-class CalibrateTapForm(forms.Form):
-    ml_per_tick = forms.FloatField()
-
-
 class TapCreateForm(forms.Form):
     name = forms.CharField()
-
-
-class TapSpillForm(forms.Form):
-    volume_ml = forms.FloatField()
-
-
-class DebugLogForm(forms.Form):
-    message = forms.CharField()
-    client_name = forms.CharField(required=False)
-
-
-class RegisterForm(forms.Form):
-    username = forms.RegexField(max_length=30, regex=r"^[\w-]+$")
-    email = forms.EmailField()
-    password = forms.CharField(required=False)
-    photo = forms.ImageField(required=False)
-
-
-class AssignTokenForm(forms.Form):
-    username = forms.RegexField(max_length=30, regex=r"^[\w-]+$")
-
-
-class ConnectMeterForm(forms.Form):
-    meter = forms.ModelChoiceField(queryset=ALL_METERS, required=True)
-
-
-class ConnectToggleForm(forms.Form):
-    toggle = forms.ModelChoiceField(queryset=ALL_TOGGLES, required=True)
-
-
-class ConnectThermoForm(forms.Form):
-    thermo = forms.ModelChoiceField(queryset=ALL_THERMOS, required=True)
diff --git a/pykeg/web/api/middleware.py b/pykeg/web/api/middleware.py
index 0e0c70f6..203c9ea1 100644
--- a/pykeg/web/api/middleware.py
+++ b/pykeg/web/api/middleware.py
@@ -9,19 +9,9 @@
 LOGGER = logging.getLogger(__name__)
 
 # These paths are allowed without authorization, regardless of
-# site privacy settings.
-WHITELISTED_API_PATHS = (
-    "/api/devices/link",
-    "/api/v1/devices/link",
-    "/api/login",
-    "/api/v1/login",
-    "/api/version",
-    "/api/v1/version",
-    "/api/get-api-key",
-    "/api/v1/get-api-key",
-)
-
-WHITELISTED_API_PATHS += getattr(settings, "KEGBOT_EXTRA_WHITELISTED_API_PATHS", ())
+# site privacy settings. All built-in whitelisted endpoints were
+# retired with the legacy API trim.
+WHITELISTED_API_PATHS = tuple(getattr(settings, "KEGBOT_EXTRA_WHITELISTED_API_PATHS", ()))
 
 
 class ApiRequestMiddleware:
diff --git a/pykeg/web/api/urls.py b/pykeg/web/api/urls.py
index b56bbaf3..aaa23c50 100644
--- a/pykeg/web/api/urls.py
+++ b/pykeg/web/api/urls.py
@@ -1,73 +1,20 @@
-from django.urls import path
+from django.urls import path, re_path
 
 from . import views
 
+# The legacy v1 API is deprecated. Only the endpoints used by
+# kegbot-pycore (plus the events feed used by the fullscreen page)
+# remain; everything else responds 410 Gone.
 urlpatterns = [
-    # General endpoints
     path("status", views.get_status),
-    path("version", views.get_version),
-    # API authorization
-    path("login", views.login),
-    path("logout", views.logout),
-    path("get-api-key", views.get_api_key),
-    path("devices/link", views.link_device_new),
-    path("devices/link/status", views.link_device_status),
-    path("devices/link/status/<str:code>", views.link_device_status),
-    # Kegbot objects
     path("auth-tokens/<str:auth_device>/<str:token_value>", views.get_auth_token),
-    path(
-        "auth-tokens/<str:auth_device>/<str:token_value>/assign",
-        views.assign_auth_token,
-    ),
-    path("controllers", views.all_controllers),
-    path("controllers/<int:controller_id>", views.get_controller),
-    path("drinks", views.all_drinks),
-    path("drinks/last", views.last_drink),
-    path("drinks/<int:drink_id>", views.get_drink),
-    path("drinks/<int:drink_id>/add-photo", views.add_drink_photo),
     path("cancel-drink", views.cancel_drink),
+    path("controllers", views.all_controllers),
     path("events", views.all_events),
     path("flow-meters", views.all_flow_meters),
-    path("flow-meters/<int:flow_meter_id>", views.get_flow_meter),
-    path("flow-toggles", views.all_flow_toggles),
-    path("flow-toggles/<int:flow_toggle_id>", views.get_flow_toggle),
-    path("kegs", views.all_kegs),
-    path("kegs/<int:keg_id>", views.get_keg),
-    path("kegs/<int:keg_id>/end", views.end_keg),
-    path("kegs/<int:keg_id>/drinks", views.get_keg_drinks),
-    path("kegs/<int:keg_id>/events", views.get_keg_events),
-    path("kegs/<int:keg_id>/sessions", views.get_keg_sessions),
-    path("kegs/<int:keg_id>/stats", views.get_keg_stats),
-    path("keg-sizes", views.get_keg_sizes),
-    path("pictures", views.pictures),
-    path("sessions", views.all_sessions),
-    path("sessions/current", views.current_session),
-    path("sessions/<int:session_id>", views.get_session),
-    path("sessions/<int:session_id>/stats", views.get_session_stats),
     path("taps", views.all_taps),
-    path("taps/<str:meter_name_or_id>/activate", views.tap_activate),
-    path("taps/<str:meter_name_or_id>/calibrate", views.tap_calibrate),
-    path("taps/<str:meter_name_or_id>/spill", views.tap_spill),
-    path("taps/<str:meter_name_or_id>/connect-meter", views.tap_connect_meter),
-    path("taps/<str:meter_name_or_id>/disconnect-meter", views.tap_disconnect_meter),
-    path("taps/<str:meter_name_or_id>/connect-toggle", views.tap_connect_toggle),
-    path("taps/<str:meter_name_or_id>/disconnect-toggle", views.tap_disconnect_toggle),
     path("taps/<str:meter_name_or_id>", views.tap_detail),
-    path("thermo-sensors", views.all_thermo_sensors),
     path("thermo-sensors/<str:sensor_name>", views.get_thermo_sensor),
-    path("thermo-sensors/<str:sensor_name>/logs", views.get_thermo_sensor_logs),
-    path("taps/<str:meter_name_or_id>/connect-thermo", views.tap_connect_thermo),
-    path("taps/<str:meter_name_or_id>/disconnect-thermo", views.tap_disconnect_thermo),
-    path("users", views.user_list),
-    path("users/<str:username>/drinks", views.get_user_drinks),
-    path("users/<str:username>/events", views.get_user_events),
-    path("users/<str:username>/stats", views.get_user_stats),
-    path("users/<str:username>/photo", views.user_photo),
-    path("users/<str:username>", views.get_user),
-    path("new-user", views.register),
-    path("stats", views.get_system_stats),
-    # Deprecated endpoints
-    path("sound-events", views.all_sound_events),
-    # Catch-all
-    path(r"", views.default_handler),
+    # Catch-all for retired endpoints.
+    re_path(r"", views.gone),
 ]
diff --git a/pykeg/web/api/views.py b/pykeg/web/api/views.py
index 26f4843b..f851df24 100644
--- a/pykeg/web/api/views.py
+++ b/pykeg/web/api/views.py
@@ -1,29 +1,24 @@
-"""Kegweb RESTful API views."""
+"""Legacy (v1) API views.
+
+This API is deprecated: only the endpoints kegbot-pycore uses (plus the
+events feed used by the fullscreen page) are still served. Everything
+else responds 410 Gone; new integrations should use the v2 API.
+"""
 
 import datetime
 import logging
 from functools import wraps
 
-from django.contrib.auth import login as auth_login
-from django.contrib.auth import logout as auth_logout
-from django.contrib.auth.forms import AuthenticationForm
 from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils import timezone
 from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_http_methods
 
-from pykeg.core import keg_sizes, models
+from pykeg.core import models
 from pykeg.core import util as core_util
-from pykeg.web.api import devicelink, exceptions, forms, serialize, util
-from pykeg.web.auth import UserExistsException
-from pykeg.web.kegadmin.forms import (
-    ChangeKegForm,
-    ControllerForm,
-    FlowToggleForm,
-    NewFlowMeterForm,
-    UpdateFlowMeterForm,
-)
+from pykeg.web.api import exceptions, forms, serialize, util
+from pykeg.web.kegadmin.forms import ControllerForm, NewFlowMeterForm
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -54,188 +49,38 @@ def _form_errors(form):
     return ret
 
 
-# Endpoints
-
-
-def all_kegs(request):
-    return models.Keg.objects.all().order_by("-start_time")
+def _current_session():
+    try:
+        latest = models.DrinkingSession.objects.latest()
+        if latest.IsActiveNow():
+            return latest
+    except models.DrinkingSession.DoesNotExist:
+        pass
+    return None
 
 
-def all_drinks(request, limit=100):
-    qs = models.Drink.objects.all()
-    if "start" in request.GET:
+def get_tap_from_meter_name_or_404(meter_name_or_id):
+    try:
+        meter_id = int(meter_name_or_id)
         try:
-            start = int(request.GET["start"])
-            qs = qs.filter(id__lte=start)
-        except ValueError:
-            pass
-    qs = qs.order_by("-id")
-    qs = qs[:limit]
-    return qs
-
-
-def last_drink(request):
-    drinks = models.Drink.objects.all().order_by("-id")
-    if not drinks:
-        raise Http404
-    return serialize.to_dict(drinks[0], full=True)
-
-
-def get_drink(request, drink_id):
-    drink = get_object_or_404(models.Drink, id=drink_id)
-    return serialize.to_dict(drink, full=True)
-
-
-@csrf_exempt
-@auth_required
-def all_controllers(request):
-    if request.method == "POST":
-        form = ControllerForm(request.POST)
-        if form.is_valid():
-            return form.save()
-        else:
-            errors = _form_errors(form)
-            raise exceptions.BadRequestError(errors)
-
-    return models.Controller.objects.all()
-
-
-@csrf_exempt
-@auth_required
-def get_controller(request, controller_id):
-    controller = get_object_or_404(models.Controller, id=controller_id)
-
-    if request.method == "DELETE":
-        controller.delete()
-        return RESULT_OK
-
-    elif request.method == "POST":
-        form = ControllerForm(request.POST, instance=controller)
-        if form.is_valid():
-            controller = form.save()
-        else:
-            errors = _form_errors(form)
-            raise exceptions.BadRequestError(errors)
-
-    return serialize.to_dict(controller, full=True)
-
-
-@csrf_exempt
-@auth_required
-def all_flow_meters(request):
-    if request.method == "POST":
-        form = NewFlowMeterForm(request.POST)
-        if form.is_valid():
-            return form.save()
-        else:
-            errors = _form_errors(form)
-            raise exceptions.BadRequestError(errors)
-
-    return models.FlowMeter.objects.all()
-
-
-@csrf_exempt
-@auth_required
-def get_flow_meter(request, flow_meter_id):
-    meter = get_object_or_404(models.FlowMeter, id=flow_meter_id)
-
-    if request.method == "DELETE":
-        meter.delete()
-        return RESULT_OK
-
-    elif request.method == "POST":
-        form = UpdateFlowMeterForm(request.POST, instance=meter)
-        if form.is_valid():
-            meter = form.save()
-        else:
-            errors = _form_errors(form)
-            raise exceptions.BadRequestError(errors)
-
-    return serialize.to_dict(meter, full=True)
-
-
-@csrf_exempt
-@auth_required
-def all_flow_toggles(request):
-    if request.method == "POST":
-        form = FlowToggleForm(request.POST)
-        if form.is_valid():
-            return form.save()
-        else:
-            errors = _form_errors(form)
-            raise exceptions.BadRequestError(errors)
-
-    return models.FlowToggle.objects.all()
-
-
-@csrf_exempt
-@auth_required
-def get_flow_toggle(request, flow_toggle_id):
-    toggle = get_object_or_404(models.FlowToggle, id=flow_toggle_id)
-
-    if request.method == "DELETE":
-        toggle.delete()
-        return RESULT_OK
-
-    elif request.method == "POST":
-        form = FlowToggleForm(request.POST, instance=toggle)
-        if form.is_valid():
-            toggle = form.save()
-        else:
-            errors = _form_errors(form)
-            raise exceptions.BadRequestError(errors)
-
-    return serialize.to_dict(toggle, full=True)
-
-
-@csrf_exempt
-@auth_required
-def pictures(request):
-    if request.method != "POST":
-        raise Http404("Method not supported")
-    pic = models.Picture.objects.create(
-        image=request.FILES["photo"],
-    )
-    return serialize.to_dict(pic, full=True)
-
-
-@csrf_exempt
-@auth_required
-def add_drink_photo(request, drink_id):
-    if request.method != "POST":
-        raise Http404("Method not supported")
-    drink = get_object_or_404(models.Drink, id=drink_id)
-    pic = _save_pour_pic(request, drink)
-    return serialize.to_dict(pic, full=True)
-
-
-def _save_pour_pic(request, drink):
-    pic = models.Picture.objects.create(
-        image=request.FILES["photo"], user=drink.user, keg=drink.keg, session=drink.session
-    )
-    # TODO(mikey): Should we do anything with a previously-saved
-    # picture here?
-    drink.picture = pic
-    drink.save()
-    return pic
-
+            return models.KegTap.objects.get(pk=meter_id)
+        except models.KegTap.DoesNotExist as e:
+            raise Http404(str(e))
+    except ValueError:
+        pass
 
-def get_session(request, session_id):
-    session = get_object_or_404(models.DrinkingSession, id=session_id)
-    return serialize.to_dict(session, full=True)
+    try:
+        return models.KegTap.get_from_meter_name(meter_name_or_id)
+    except models.KegTap.DoesNotExist as e:
+        raise Http404(str(e))
 
 
-def get_session_stats(request, session_id):
-    session = get_object_or_404(models.DrinkingSession, id=session_id)
-    return session.get_stats()
+# Endpoints
 
 
 @auth_required
 def get_status(request):
-    try:
-        session = current_session(request)
-    except Http404:
-        session = None
+    session = _current_session()
 
     controllers = models.Controller.objects.all()
     drinks = models.Drink.objects.all()[:5]
@@ -255,7 +100,7 @@ def get_status(request):
     title = models.KegbotSite.get().title
     version = core_util.get_version()
 
-    response = serialize.sync_dict(
+    return serialize.sync_dict(
         active_kegs=kegs,
         active_session=session,
         active_users=current_users,
@@ -268,68 +113,34 @@ def get_status(request):
         taps=taps,
         toggles=toggles,
     )
-    return response
-
-
-def get_version(request):
-    return {"server_version": core_util.get_version()}
-
 
-def get_keg(request, keg_id):
-    keg = get_object_or_404(models.Keg, id=keg_id)
-    return serialize.to_dict(keg, full=True)
 
-
-def get_keg_drinks(request, keg_id):
-    keg = get_object_or_404(models.Keg, id=keg_id)
-    return keg.drinks.all()
-
-
-def get_keg_events(request, keg_id):
-    keg = get_object_or_404(models.Keg, id=keg_id)
-    events = keg.events.all()
-    events = apply_since(request, events)
-    return events
-
-
-def get_keg_sizes(request):
-    # Deprecated endpoint.
-    ret = []
-    fake_id = 0
-    for size_name, volume_ml in list(keg_sizes.VOLUMES_ML.items()):
-        ret.append(
-            {
-                "volume_ml": volume_ml,
-                "id": fake_id,
-                "description": keg_sizes.DESCRIPTIONS[size_name],
-            }
-        )
-        fake_id += 1
-    return ret
-
-
-@require_http_methods(["POST"])
-@auth_required
 @csrf_exempt
-def end_keg(request, keg_id):
-    keg = get_object_or_404(models.Keg, id=keg_id)
-    keg.end_keg()
-    return serialize.to_dict(keg, full=True)
-
+@auth_required
+def all_controllers(request):
+    if request.method == "POST":
+        form = ControllerForm(request.POST)
+        if form.is_valid():
+            return form.save()
+        else:
+            errors = _form_errors(form)
+            raise exceptions.BadRequestError(errors)
 
-def all_sessions(request):
-    return models.DrinkingSession.objects.all()
+    return models.Controller.objects.all()
 
 
-def current_session(request):
-    try:
-        latest = models.DrinkingSession.objects.latest()
-        if latest.IsActiveNow():
-            return latest
-    except models.DrinkingSession.DoesNotExist:
-        pass
+@csrf_exempt
+@auth_required
+def all_flow_meters(request):
+    if request.method == "POST":
+        form = NewFlowMeterForm(request.POST)
+        if form.is_valid():
+            return form.save()
+        else:
+            errors = _form_errors(form)
+            raise exceptions.BadRequestError(errors)
 
-    raise Http404("There is no active session.")
+    return models.FlowMeter.objects.all()
 
 
 def all_events(request):
@@ -351,26 +162,6 @@ def apply_since(request, query):
     return query
 
 
-@auth_required
-def all_sound_events(request):
-    return []  # deprecated
-
-
-def get_keg_sessions(request, keg_id):
-    keg = get_object_or_404(models.Keg, id=keg_id)
-    sessions = keg.get_sessions()
-    return sessions
-
-
-def get_keg_stats(request, keg_id):
-    keg = get_object_or_404(models.Keg, id=keg_id)
-    return keg.get_stats()
-
-
-def get_system_stats(request):
-    return models.KegbotSite.get().get_stats()
-
-
 @require_http_methods(["GET", "POST"])
 @csrf_exempt
 def all_taps(request):
@@ -387,31 +178,6 @@ def create_tap(request):
     raise exceptions.BadRequestError(_form_errors(form))
 
 
-@auth_required
-def user_list(request):
-    return models.User.objects.filter(is_active=True).exclude(username="guest").order_by("username")
-
-
-def get_user(request, username):
-    user = get_object_or_404(models.User, username=username)
-    return serialize.to_dict(user, full=True)
-
-
-def get_user_drinks(request, username):
-    user = get_object_or_404(models.User, username=username)
-    return user.drinks.all()
-
-
-def get_user_events(request, username):
-    user = get_object_or_404(models.User, username=username)
-    return user.events.all()
-
-
-def get_user_stats(request, username):
-    user = get_object_or_404(models.User, username=username)
-    return user.get_stats()
-
-
 @auth_required
 def get_auth_token(request, auth_device, token_value):
     tok = get_object_or_404(
@@ -420,43 +186,6 @@ def get_auth_token(request, auth_device, token_value):
     return tok
 
 
-@csrf_exempt
-@auth_required
-def assign_auth_token(request, auth_device, token_value):
-    if not request.POST:
-        raise exceptions.BadRequestError("POST required.")
-
-    form = forms.AssignTokenForm(request.POST)
-    if not form.is_valid():
-        errors = _form_errors(form)
-        raise exceptions.BadRequestError(errors)
-
-    username = form.cleaned_data["username"]
-
-    user = models.User.objects.filter(username=username).first()
-    if not user:
-        raise exceptions.BadRequestError("User does not exist")
-
-    tok = models.AuthenticationToken.objects.filter(
-        auth_device=auth_device, token_value=token_value
-    ).first()
-    if not tok:
-        tok = models.AuthenticationToken.create_auth_token(
-            auth_device, token_value, username=username
-        )
-
-    if tok.user != user:
-        if tok.user:
-            raise exceptions.BadRequestError("Token is already bound to a user")
-        tok.user = user
-        tok.save()
-    return tok
-
-
-def all_thermo_sensors(request):
-    return models.ThermoSensor.objects.all()
-
-
 def _get_sensor_or_404(request, sensor_name):
     try:
         sensor = models.ThermoSensor.objects.get(raw_name=sensor_name)
@@ -486,7 +215,7 @@ def _thermo_sensor_get(request, sensor_name):
         last_temp = logs[0].temp
         last_time = logs[0].time
     res = {
-        "sensor": sensor,
+        "sensor": serialize.to_dict(sensor),
         "last_temp": last_temp,
         "last_time": last_time,
     }
@@ -504,21 +233,6 @@ def _thermo_sensor_post(request, sensor_name):
     return sensor.log_sensor_reading(cd["temp_c"])
 
 
-def get_thermo_sensor_logs(request, sensor_name):
-    sensor = _get_sensor_or_404(request, sensor_name)
-    return sensor.thermolog_set.all()[: 60 * 2]
-
-
-def get_api_key(request):
-    user = request.user
-    api_key = ""
-    if user and (user.is_staff or user.is_superuser):
-        description = request.GET.get("description", "")
-        api_key = models.ApiKey.objects.create(description=description)
-        api_key = api_key.key
-    return {"api_key": api_key}
-
-
 @csrf_exempt
 def tap_detail(request, meter_name_or_id):
     tap = get_tap_from_meter_name_or_404(meter_name_or_id)
@@ -526,133 +240,11 @@ def tap_detail(request, meter_name_or_id):
         util.check_api_key(request)
         return _tap_detail_post(request, tap)
     elif request.method == "GET":
-        return _tap_detail_get(request, tap)
-    elif request.method == "DELETE":
-        util.check_api_key(request)
-        tap.delete()
-        return RESULT_OK
+        return serialize.to_dict(tap, full=True)
 
     raise exceptions.BadRequestError("Method not supported")
 
 
-def _tap_detail_get(request, tap):
-    return serialize.to_dict(tap, full=True)
-
-
-@csrf_exempt
-@auth_required
-def tap_calibrate(request, meter_name_or_id):
-    # TODO(mikey): This would make more semantic sense as PATCH /taps/tap-name/,
-    # but Django's support for non-POST verbs is poor (specifically wrt request
-    # body/form handling).
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    meter = tap.current_meter()
-    if not meter:
-        raise exceptions.BadRequestError("Tap does not have a meter!")
-
-    form = forms.CalibrateTapForm(request.POST)
-    if form.is_valid():
-        meter.ticks_per_ml = 1.0 / form.cleaned_data["ml_per_tick"]
-        meter.save()
-        tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    else:
-        raise exceptions.BadRequestError(_form_errors(form))
-    return serialize.to_dict(tap, full=True)
-
-
-@csrf_exempt
-@auth_required
-def tap_spill(request, meter_name_or_id):
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    if not tap.current_keg:
-        raise exceptions.BadRequestError("No keg on tap.")
-    form = forms.TapSpillForm(request.POST)
-    if form.is_valid():
-        tap.current_keg.spilled_ml += form.cleaned_data["volume_ml"]
-        tap.current_keg.save()
-    else:
-        raise exceptions.BadRequestError(_form_errors(form))
-    return serialize.to_dict(tap, full=True)
-
-
-@csrf_exempt
-@auth_required
-def tap_activate(request, meter_name_or_id):
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    form = ChangeKegForm(request.POST)
-    if form.is_valid():
-        form.save(tap)
-    else:
-        raise exceptions.BadRequestError(_form_errors(form))
-    return serialize.to_dict(tap, full=True)
-
-
-@require_http_methods(["POST"])
-@csrf_exempt
-@auth_required
-def tap_connect_meter(request, meter_name_or_id):
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    form = forms.ConnectMeterForm(request.POST)
-    if form.is_valid():
-        tap.connect_meter(form.cleaned_data["meter"])
-    else:
-        raise exceptions.BadRequestError(_form_errors(form))
-    return serialize.to_dict(tap, full=True)
-
-
-@require_http_methods(["POST"])
-@csrf_exempt
-@auth_required
-def tap_disconnect_meter(request, meter_name_or_id):
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    tap.connect_meter(None)
-    return serialize.to_dict(tap, full=True)
-
-
-@require_http_methods(["POST"])
-@csrf_exempt
-@auth_required
-def tap_connect_toggle(request, meter_name_or_id):
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    form = forms.ConnectToggleForm(request.POST)
-    if form.is_valid():
-        tap.connect_toggle(form.cleaned_data["toggle"])
-    else:
-        raise exceptions.BadRequestError(_form_errors(form))
-    return serialize.to_dict(tap, full=True)
-
-
-@require_http_methods(["POST"])
-@csrf_exempt
-@auth_required
-def tap_disconnect_toggle(request, meter_name_or_id):
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    tap.connect_toggle(None)
-    return serialize.to_dict(tap, full=True)
-
-
-@require_http_methods(["POST"])
-@csrf_exempt
-@auth_required
-def tap_connect_thermo(request, meter_name_or_id):
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    form = forms.ConnectThermoForm(request.POST)
-    if form.is_valid():
-        tap.connect_thermo(form.cleaned_data["thermo"])
-    else:
-        raise exceptions.BadRequestError(_form_errors(form))
-    return serialize.to_dict(tap, full=True)
-
-
-@require_http_methods(["POST"])
-@csrf_exempt
-@auth_required
-def tap_disconnect_thermo(request, meter_name_or_id):
-    tap = get_tap_from_meter_name_or_404(meter_name_or_id)
-    tap.connect_thermo(None)
-    return serialize.to_dict(tap, full=True)
-
-
 @auth_required
 def _tap_detail_post(request, tap):
     form = forms.DrinkPostForm(request.POST)
@@ -702,115 +294,8 @@ def cancel_drink(request):
     return result
 
 
-@require_http_methods(["POST"])
-@csrf_exempt
-def login(request):
-    form = AuthenticationForm(data=request.POST)
-    if form.is_valid():
-        auth_login(request, form.get_user())
-        if request.session.test_cookie_worked():
-            request.session.delete_test_cookie()
-        return RESULT_OK
-    else:
-        raise exceptions.PermissionDeniedError("Login failed.")
-
-
-def logout(request):
-    auth_logout(request)
-    return RESULT_OK
-
-
-@csrf_exempt
-@auth_required
-def register(request):
-    if not request.POST:
-        raise exceptions.BadRequestError("POST required.")
-    form = forms.RegisterForm(request.POST)
-    errors = {}
-    if not form.is_valid():
-        errors = _form_errors(form)
-    else:
-        username = form.cleaned_data["username"]
-        email = form.cleaned_data.get("email", None)
-        password = form.cleaned_data.get("password", None)
-        photo = request.FILES.get("photo", None)
-        try:
-            user = models.User.create_new_user(
-                username, email=email, password=password, photo=photo
-            )
-            return serialize.to_dict(user, full=True)
-        except UserExistsException:
-            user_errs = errors.get("username", [])
-            user_errs.append("Username not available.")
-            errors["username"] = user_errs
-    raise exceptions.BadRequestError(errors)
-
-
-@csrf_exempt
-@auth_required
-def user_photo(request, username):
-    user = get_object_or_404(models.User, username=username)
-    if request.method == "POST":
-        return post_user_photo(request, user)
-    else:
-        return get_user_photo(request, user)
-
-
-def get_user_photo(request, user):
-    mugshot = user.mugshot
-    if not mugshot:
-        return {}
-    return mugshot
-
-
-def post_user_photo(request, user):
-    photo_file = request.FILES.get("photo")
-    if not photo_file:
-        raise exceptions.BadRequestError('The file "photo" is required.')
-
-    pic = models.Picture.objects.create(user=user)
-    pic.image.save(photo_file.name, photo_file)
-    pic.save()
-
-    user.mugshot = pic
-    user.save()
-    return serialize.to_dict(pic)
-
-
-@csrf_exempt
-@require_http_methods(["POST"])
-def link_device_new(request):
-    name = request.POST.get("name", "Unknown Device")
-    code = devicelink.start_link(name)
-    return {"status": "ok", "code": code, "linked": False}
-
-
-@require_http_methods(["GET"])
-def link_device_status(request, code):
-    try:
-        api_key = devicelink.get_status(code)
-    except devicelink.LinkExpiredException:
-        raise Http404("Code expired or does not exist.")
-    if api_key:
-        return {"status": "ok", "linked": True, "api_key": api_key}
-    return {"status": "ok", "linked": False}
-
-
-def default_handler(request):
-    raise Http404(f"Not an API endpoint: {request.path[:100]}")
-
-
-def get_tap_from_meter_name_or_404(meter_name_or_id):
-    try:
-        meter_id = int(meter_name_or_id)
-        try:
-            return models.KegTap.objects.get(pk=meter_id)
-        except models.KegTap.DoesNotExist as e:
-            raise Http404(str(e))
-    except ValueError:
-        pass
-
-    try:
-        return models.KegTap.get_from_meter_name(meter_name_or_id)
-    except models.KegTap.DoesNotExist as e:
-        raise Http404(str(e))
+def gone(request):
+    raise exceptions.GoneError(
+        "This endpoint has been retired; the legacy API only serves "
+        "kegbot-pycore. Use the v2 API instead."
+    )
diff --git a/pykeg/web/kegadmin/forms.py b/pykeg/web/kegadmin/forms.py
index 8962f819..11a13fb0 100644
--- a/pykeg/web/kegadmin/forms.py
+++ b/pykeg/web/kegadmin/forms.py
@@ -817,15 +817,3 @@ class Meta:
             Submit("submit_controller_form", "Save Controller", css_class="btn-success"),
         ),
     )
-
-
-class LinkDeviceForm(forms.Form):
-    code = forms.CharField(required=True, help_text="Link code shown on device.")
-    helper = FormHelper()
-    helper.form_class = "form-horizontal"
-    helper.layout = Layout(
-        "code",
-        FormActions(
-            Submit("link_device", "Link Device", css_class="btn-success"),
-        ),
-    )
diff --git a/pykeg/web/kegadmin/templates/kegadmin/link_device.html b/pykeg/web/kegadmin/templates/kegadmin/link_device.html
deleted file mode 100644
index c4cc987f..00000000
--- a/pykeg/web/kegadmin/templates/kegadmin/link_device.html
+++ /dev/null
@@ -1,10 +0,0 @@
-{% extends "kegadmin/base.html" %}
-{% load kegweblib %}
-{% load crispy_forms_tags %}
-
-{% block title %}Kegbot Admin: Link a Device | {{ block.super }}{% endblock %}
-{% block pagetitle %}Kegbot Admin: Link a Device{% endblock %}
-
-{% block kegadmin-main %}
-{% crispy form %}
-{% endblock %}
diff --git a/pykeg/web/kegadmin/urls.py b/pykeg/web/kegadmin/urls.py
index 21dff4d3..268d6767 100644
--- a/pykeg/web/kegadmin/urls.py
+++ b/pykeg/web/kegadmin/urls.py
@@ -14,7 +14,6 @@
     path("beers/", views.beverages_list, name="kegadmin-beverages"),
     path("beers/add/", views.beverage_add, name="kegadmin-add-beverage"),
     path("beers/<int:beer_id>/", views.beverage_detail, name="kegadmin-edit-beverage"),
-    path("devices/link/", views.link_device, name="kegadmin-link-device"),
     path("kegs/", views.keg_list, name="kegadmin-kegs"),
     path("kegs/online/", views.keg_list_online, name="kegadmin-kegs-online"),
     path("kegs/available/", views.keg_list_available, name="kegadmin-kegs-available"),
diff --git a/pykeg/web/kegadmin/views.py b/pykeg/web/kegadmin/views.py
index 1e8aab60..90e4d484 100644
--- a/pykeg/web/kegadmin/views.py
+++ b/pykeg/web/kegadmin/views.py
@@ -3,7 +3,6 @@
 import datetime
 import logging
 import os
-import re
 import subprocess
 import zipfile
 from operator import itemgetter
@@ -24,7 +23,6 @@
 from pykeg.logging.handlers import RedisListHandler
 from pykeg.util import kbjson
 from pykeg.util.email import build_message
-from pykeg.web.api import devicelink
 from pykeg.web.decorators import staff_member_required
 from pykeg.web.kegadmin import forms
 
@@ -990,26 +988,3 @@ def logs(request):
 
     context["logs"] = logs
     return render(request, "kegadmin/logs.html", context=context)
-
-
-@staff_member_required
-def link_device(request):
-    context = {}
-    form = forms.LinkDeviceForm()
-    if request.method == "POST":
-        form = forms.LinkDeviceForm(request.POST)
-        if form.is_valid():
-            code = form.cleaned_data.get("code")
-            result = re.match("^([A-Z1-9]{3})-?([A-Z1-9]{3})$", code.upper())
-            if not result:
-                messages.error('Link code is not in the form of "XXX-XXX"')
-            code = f"{result.group(1)}-{result.group(2)}"
-            try:
-                status = devicelink.confirm_link(code)
-                name = status.get("name", "New device")
-                messages.success(request, f"{name} linked!")
-            except devicelink.LinkExpiredException:
-                messages.error(request, "Code incorrect or expired.")
-            return redirect("kegadmin-link-device")
-    context["form"] = form
-    return render(request, "kegadmin/link_device.html", context=context)
diff --git a/pykeg/web/urls.py b/pykeg/web/urls.py
index 82dd7330..cc5fdbb6 100644
--- a/pykeg/web/urls.py
+++ b/pykeg/web/urls.py
@@ -2,7 +2,6 @@
 from django.conf.urls.static import static
 from django.contrib import admin
 from django.urls import include, path, re_path
-from django.views.generic.base import RedirectView
 
 from pykeg.api import urls as apiv2_urls
 from pykeg.web.account import urls as account_urls
@@ -13,12 +12,12 @@
 from pykeg.web.setup_wizard import urls as setup_wizard_urls
 
 urlpatterns = [
-    re_path(r"^api/(?:v1/)?", include(api_urls)),
+    # The legacy api is served at api/ and api/v1/; the negative lookahead
+    # keeps its catch-all from shadowing api/v2/.
+    re_path(r"^api/(?!v2/)(?:v1/)?", include(api_urls)),
     path("account/", include(account_urls)),
     path("accounts/", include(kbregistration_urls)),
     path("kegadmin/", include(kegadmin_urls)),
-    # Shortcuts
-    path("link", RedirectView.as_view(pattern_name="kegadmin-link-device")),
 ]
 
 # Enable the currently-experimental v2 api.

From e92ba3e8df4cab00d6713ba5dcfd470fb4a76bba Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 19:42:51 +0000
Subject: [PATCH 5/9] api: mark all legacy responses deprecated

- every v1 response carries a Deprecation header
- changelog notes the trim, the 410s, and the mobile-app impact
---
 docs/source/releases/changelog.rst | 8 ++++++++
 pykeg/web/api/api_test.py          | 5 +++++
 pykeg/web/api/middleware.py        | 2 ++
 3 files changed, 15 insertions(+)

diff --git a/docs/source/releases/changelog.rst b/docs/source/releases/changelog.rst
index 0cd3ab66..ddcdd8e2 100644
--- a/docs/source/releases/changelog.rst
+++ b/docs/source/releases/changelog.rst
@@ -25,6 +25,11 @@ brought up to date.
   accepts legacy format-1 backups (created by Kegbot v1.1.x) and upgrades
   their data in one step; no intermediate 1.2/1.3 install is needed.
 * Time zone choices are now derived from the system time zone database.
+* **The legacy HTTP API (``/api/v1``) is deprecated.** It now serves only
+  the endpoints used by kegbot-pycore (plus the events feed); every other
+  endpoint returns ``410 Gone``, and all legacy responses carry a
+  ``Deprecation`` header. Protocol Buffers are no longer used anywhere in
+  the server.
 
 **Upgrade notes**
 
@@ -40,6 +45,9 @@ brought up to date.
   arm64 only).
 * The legacy gflags-based Python API client was removed from the server
   package; it lives in the separate kegbot-api project.
+* The old Kegbot mobile apps depended on now-retired API endpoints (device
+  linking, registration, drink lists) and no longer work against this
+  server.
 
 
 Version 1.3.0 (2022-08-10)
diff --git a/pykeg/web/api/api_test.py b/pykeg/web/api/api_test.py
index c1de4080..07eff406 100644
--- a/pykeg/web/api/api_test.py
+++ b/pykeg/web/api/api_test.py
@@ -281,3 +281,8 @@ def test_retired_endpoints_are_gone(self):
             self.assertEqual(410, response.status_code, f"expected 410 for {endpoint}")
             self.assertEqual("error", data.meta.result)
             self.assertEqual("GoneError", data.error.code)
+
+    def test_deprecation_header(self):
+        for endpoint in ("taps/", "version"):
+            response, data = self.get(endpoint)
+            self.assertEqual("true", response.headers.get("Deprecation"))
diff --git a/pykeg/web/api/middleware.py b/pykeg/web/api/middleware.py
index 203c9ea1..5a5dc79e 100644
--- a/pykeg/web/api/middleware.py
+++ b/pykeg/web/api/middleware.py
@@ -28,6 +28,8 @@ def __call__(self, request):
                 response = util.build_response(request, data, 200)
 
             add_never_cache_headers(response)
+            # The v1 api is deprecated; it only serves kegbot-pycore.
+            response.headers["Deprecation"] = "true"
 
         return response
 

From 7be048a646e993fbdfde723dc2348addff54207b Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 19:54:22 +0000
Subject: [PATCH 6/9] api: serve the drf api at /api, legacy only at /api/v1

- the drf api is always enabled (KEGBOT_ENABLE_V2_API is gone) and owns
  the /api/ namespace
- the deprecated legacy api moves exclusively to /api/v1/; pycore
  installs must configure their api url accordingly
- privacy, setup-gate, and slash-rewrite middleware follow the new
  prefixes
---
 docs/source/releases/changelog.rst    | 14 +++++++++-----
 docs/source/settings.rst              |  7 -------
 pykeg/api/tests.py                    |  2 +-
 pykeg/config.py                       |  7 -------
 pykeg/web/api/api_test.py             |  4 ++--
 pykeg/web/api/pycore_contract_test.py |  4 ++--
 pykeg/web/api/util.py                 |  2 +-
 pykeg/web/middleware.py               | 17 ++++++++---------
 pykeg/web/urls.py                     | 17 +++++++----------
 9 files changed, 30 insertions(+), 44 deletions(-)

diff --git a/docs/source/releases/changelog.rst b/docs/source/releases/changelog.rst
index ddcdd8e2..bf292d30 100644
--- a/docs/source/releases/changelog.rst
+++ b/docs/source/releases/changelog.rst
@@ -25,11 +25,15 @@ brought up to date.
   accepts legacy format-1 backups (created by Kegbot v1.1.x) and upgrades
   their data in one step; no intermediate 1.2/1.3 install is needed.
 * Time zone choices are now derived from the system time zone database.
-* **The legacy HTTP API (``/api/v1``) is deprecated.** It now serves only
-  the endpoints used by kegbot-pycore (plus the events feed); every other
-  endpoint returns ``410 Gone``, and all legacy responses carry a
-  ``Deprecation`` header. Protocol Buffers are no longer used anywhere in
-  the server.
+* **A new REST API is served at ``/api/``** (previously the experimental
+  ``/api/v2/``, now always enabled).
+* **The legacy HTTP API is deprecated and now lives only at ``/api/v1/``.**
+  It serves only the endpoints used by kegbot-pycore (plus the events
+  feed); every other endpoint returns ``410 Gone``, and all legacy
+  responses carry a ``Deprecation`` header. Protocol Buffers are no longer
+  used anywhere in the server. **kegbot-pycore users:** set the api url to
+  ``http://<server>/api/v1/`` (the bare ``/api/`` prefix no longer serves
+  the legacy endpoints).
 
 **Upgrade notes**
 
diff --git a/docs/source/settings.rst b/docs/source/settings.rst
index e1cd4cc6..58cd4917 100644
--- a/docs/source/settings.rst
+++ b/docs/source/settings.rst
@@ -82,10 +82,3 @@ change and should only be needed by advanced users.
   be prefixed by this URL. Otherwise, media will be served from
   the same host as the server itself, under ``/media``. You may use
   this setting to e.g. serve media links through a CDN.
-
-.. data:: KEGBOT_ENABLE_V2_API
-
-  If set to ``true``, the new Kegbot Server API will be enabled (at
-  path ``/api/v2/...``). This API will replace the existing API implementation
-  in a future major Kegbot release. It is currently unfinished. Enable this
-  if you are a developer intending to work on or with this API.
diff --git a/pykeg/api/tests.py b/pykeg/api/tests.py
index d2b4b1fb..2bc89d12 100644
--- a/pykeg/api/tests.py
+++ b/pykeg/api/tests.py
@@ -27,7 +27,7 @@ def get(self, *args, **kwargs):
         return response.status_code, response.json()
 
     def get_events(self):
-        return self.get("/api/v2/events")
+        return self.get("/api/events")
 
 
 class V2ApiTestCase(TestCase):
diff --git a/pykeg/config.py b/pykeg/config.py
index c18c0c54..b6a04026 100644
--- a/pykeg/config.py
+++ b/pykeg/config.py
@@ -145,10 +145,3 @@ def validate(exit_on_error=True):
 define_setting("KEGBOT_MEDIA_URL", default="", required=False)
 
 define_setting("KEGBOT_INSECURE_SHARED_API_KEY", default="", required=False)
-
-define_setting(
-    "KEGBOT_ENABLE_V2_API",
-    default=True if IS_RUNNING_PYTEST else False,
-    typefn=boolstr,
-    required=False,
-)
diff --git a/pykeg/web/api/api_test.py b/pykeg/web/api/api_test.py
index 07eff406..e65ded34 100644
--- a/pykeg/web/api/api_test.py
+++ b/pykeg/web/api/api_test.py
@@ -14,11 +14,11 @@ def create_site():
 
 class BaseApiTestCase(TestCase):
     def get(self, subpath, data={}, follow=False, **extra):
-        response = self.client.get(f"/api/{subpath}", data=data, follow=follow, **extra)
+        response = self.client.get(f"/api/v1/{subpath}", data=data, follow=follow, **extra)
         return response, kbjson.loads(response.content)
 
     def post(self, subpath, data={}, follow=False, **extra):
-        response = self.client.post(f"/api/{subpath}", data=data, follow=follow, **extra)
+        response = self.client.post(f"/api/v1/{subpath}", data=data, follow=follow, **extra)
         return response, kbjson.loads(response.content)
 
 
diff --git a/pykeg/web/api/pycore_contract_test.py b/pykeg/web/api/pycore_contract_test.py
index de7ad758..63ab4101 100644
--- a/pykeg/web/api/pycore_contract_test.py
+++ b/pykeg/web/api/pycore_contract_test.py
@@ -24,12 +24,12 @@ def setUp(self):
 
     def get(self, subpath, data={}):
         data = dict(data, api_key=API_KEY)
-        response = self.client.get(f"/api/{subpath}", data=data)
+        response = self.client.get(f"/api/v1/{subpath}", data=data)
         return response, kbjson.loads(response.content)
 
     def post(self, subpath, data={}):
         data = dict(data, api_key=API_KEY)
-        response = self.client.post(f"/api/{subpath}", data=data)
+        response = self.client.post(f"/api/v1/{subpath}", data=data)
         return response, kbjson.loads(response.content)
 
     def start_keg(self):
diff --git a/pykeg/web/api/util.py b/pykeg/web/api/util.py
index e4e40507..0d1a14dd 100644
--- a/pykeg/web/api/util.py
+++ b/pykeg/web/api/util.py
@@ -20,7 +20,7 @@
 
 
 def is_api_v1_request(request):
-    return request.path.startswith("/api") and not request.path.startswith("/api/v2")
+    return request.path.startswith("/api/v1")
 
 
 def needs_auth(viewfunc):
diff --git a/pykeg/web/middleware.py b/pykeg/web/middleware.py
index 7f06cf8a..24dd1b4a 100644
--- a/pykeg/web/middleware.py
+++ b/pykeg/web/middleware.py
@@ -23,8 +23,8 @@
     "/setup/",
     "/sso/login",
     "/sso/logout",
-    # Enforced by v2 api auth layer
-    "/api/v2",
+    # Both apis enforce their own privacy rules.
+    "/api/",
 )
 
 PRIVACY_EXEMPT_PATHS += getattr(settings, "KEGBOT_EXTRA_PRIVACY_EXEMPT_PATHS", ())
@@ -70,7 +70,7 @@ def __call__(self, request):
 
 
 class PathRewriteMiddleware:
-    """Rewrites `request.path` to ignore trailing slashes for /api/ requests.
+    """Rewrites `request.path` to ignore trailing slashes for legacy api requests.
 
     Earlier versions of kegbot-server tolerated an optional trailing slash.
     We don't want to define every API url as an `re_path(r".../?")`.
@@ -83,12 +83,11 @@ def __init__(self, get_response):
         self.get_response = get_response
 
     def __call__(self, request):
-        if request.path.startswith("/api") and not getattr(request, "path_rewritten", None):
-            if not request.path.startswith("/api/v2"):
-                if request.path.endswith("/"):
-                    request.path = request.path[:-1]
-                    request.path_info = request.path_info[:-1]
-                    request.path_rewritten = True
+        if request.path.startswith("/api/v1") and not getattr(request, "path_rewritten", None):
+            if request.path.endswith("/"):
+                request.path = request.path[:-1]
+                request.path_info = request.path_info[:-1]
+                request.path_rewritten = True
         return self.get_response(request)
 
 
diff --git a/pykeg/web/urls.py b/pykeg/web/urls.py
index cc5fdbb6..3a06006c 100644
--- a/pykeg/web/urls.py
+++ b/pykeg/web/urls.py
@@ -1,29 +1,26 @@
 from django.conf import settings
 from django.conf.urls.static import static
 from django.contrib import admin
-from django.urls import include, path, re_path
+from django.urls import include, path
 
-from pykeg.api import urls as apiv2_urls
+from pykeg.api import urls as api_urls
 from pykeg.web.account import urls as account_urls
-from pykeg.web.api import urls as api_urls
+from pykeg.web.api import urls as legacy_api_urls
 from pykeg.web.kbregistration import urls as kbregistration_urls
 from pykeg.web.kegadmin import urls as kegadmin_urls
 from pykeg.web.kegweb import urls as kegweb_urls
 from pykeg.web.setup_wizard import urls as setup_wizard_urls
 
 urlpatterns = [
-    # The legacy api is served at api/ and api/v1/; the negative lookahead
-    # keeps its catch-all from shadowing api/v2/.
-    re_path(r"^api/(?!v2/)(?:v1/)?", include(api_urls)),
+    # The deprecated legacy api is served only at api/v1/; everything else
+    # under api/ is the current api.
+    path("api/v1/", include(legacy_api_urls)),
+    path("api/", include(api_urls)),
     path("account/", include(account_urls)),
     path("accounts/", include(kbregistration_urls)),
     path("kegadmin/", include(kegadmin_urls)),
 ]
 
-# Enable the currently-experimental v2 api.
-if settings.KEGBOT["KEGBOT_ENABLE_V2_API"]:
-    urlpatterns += [path("api/v2/", include(apiv2_urls))]
-
 if "pykeg.web.setup_wizard" in settings.INSTALLED_APPS:
     urlpatterns += [
         path("setup/", include(setup_wizard_urls)),

From 2ee93490bdbd608dc8c3c4117fedf20d5bb29f04 Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 19:57:08 +0000
Subject: [PATCH 7/9] api: refresh the drf api

- close write-permission holes: users and invitations are read-only,
  beverages/producers need admin to write, notification settings are
  scoped to the caller, plugin data (may hold plugin credentials) is
  admin-only, thermologs are read-only
- fix InvitationViewSet serving the wrong serializer
- api keys created via the api bind to the caller; key value is
  server-generated (read-only)
- nested and method-sourced serializer fields are marked read-only;
  beverages accept producer_id on write
- login goes through django authenticate(), honoring auth backends and
  inactive-user checks
---
 pykeg/api/apps.py        |  2 +-
 pykeg/api/models.py      |  1 -
 pykeg/api/permissions.py | 17 ++++++++++----
 pykeg/api/serializers.py | 51 ++++++++++++++++++++--------------------
 pykeg/api/tests.py       | 40 ++++++++++++++++++++++++++++++-
 pykeg/api/views.py       | 37 +++++++++++++++++++----------
 6 files changed, 103 insertions(+), 45 deletions(-)
 delete mode 100644 pykeg/api/models.py

diff --git a/pykeg/api/apps.py b/pykeg/api/apps.py
index 878e7d54..08c7b52c 100644
--- a/pykeg/api/apps.py
+++ b/pykeg/api/apps.py
@@ -3,4 +3,4 @@
 
 class ApiConfig(AppConfig):
     default_auto_field = "django.db.models.BigAutoField"
-    name = "api"
+    name = "pykeg.api"
diff --git a/pykeg/api/models.py b/pykeg/api/models.py
deleted file mode 100644
index 6b202199..00000000
--- a/pykeg/api/models.py
+++ /dev/null
@@ -1 +0,0 @@
-# Create your models here.
diff --git a/pykeg/api/permissions.py b/pykeg/api/permissions.py
index 37b6ef6f..56a9f603 100644
--- a/pykeg/api/permissions.py
+++ b/pykeg/api/permissions.py
@@ -32,11 +32,7 @@ def has_permission(self, request, view):
 
 
 class IsAuthenticated(DashboardViewer):
-    """Permission for API resources which respects site-privacy.
-
-    Resources are readable without authentication, *unless* the site's
-    `.privacy` setting is non-public.
-    """
+    """Requires an authenticated user who also passes the site-privacy check."""
 
     message = "You must log in to do that"
 
@@ -44,3 +40,14 @@ def has_permission(self, request, view):
         if not super().has_permission(request, view):
             return False
         return bool(request.user and request.user.is_authenticated)
+
+
+class AdminWriteDashboardRead(DashboardViewer):
+    """Reads follow site-privacy; writes require a staff user."""
+
+    message = "You must be an admin to do that"
+
+    def has_permission(self, request, view):
+        if request.method in permissions.SAFE_METHODS:
+            return super().has_permission(request, view)
+        return bool(request.user and request.user.is_staff)
diff --git a/pykeg/api/serializers.py b/pykeg/api/serializers.py
index 86b9c40a..9f57aef3 100644
--- a/pykeg/api/serializers.py
+++ b/pykeg/api/serializers.py
@@ -1,3 +1,4 @@
+from django.contrib.auth import authenticate
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
 
@@ -59,8 +60,8 @@ class Meta:
             "stats",
         ]
 
-    background_image = PictureSerializer()
-    stats = serializers.JSONField(source="get_stats")
+    background_image = PictureSerializer(read_only=True)
+    stats = serializers.JSONField(source="get_stats", read_only=True)
 
 
 class UserSerializer(serializers.ModelSerializer):
@@ -79,7 +80,7 @@ class Meta:
             "is_active",
         ]
 
-    picture = PictureSerializer(source="mugshot")
+    picture = PictureSerializer(source="mugshot", read_only=True)
 
 
 class InvitationSerializer(serializers.ModelSerializer):
@@ -118,6 +119,7 @@ class Meta:
         ]
 
     is_active = serializers.BooleanField(source="active")
+    key = serializers.CharField(read_only=True)
 
 
 class BeverageProducerSerializer(serializers.ModelSerializer):
@@ -143,6 +145,7 @@ class Meta:
             "id",
             "name",
             "producer",
+            "producer_id",
             "beverage_type",
             "style",
             "description",
@@ -160,7 +163,10 @@ class Meta:
             "untappd_beer_id",
         ]
 
-    producer = BeverageProducerSerializer()
+    producer = BeverageProducerSerializer(read_only=True)
+    producer_id = serializers.PrimaryKeyRelatedField(
+        queryset=models.BeverageProducer.objects.all(), source="producer", write_only=True
+    )
 
 
 class ControllerSerializer(serializers.ModelSerializer):
@@ -230,10 +236,10 @@ class Meta:
             "stats",
         ]
 
-    beverage = BeverageSerializer(source="type")
-    illustration = serializers.URLField(source="get_illustration")
-    illustration_thumbnail = serializers.URLField(source="get_illustration_thumb")
-    stats = serializers.JSONField(source="get_stats")
+    beverage = BeverageSerializer(source="type", read_only=True)
+    illustration = serializers.URLField(source="get_illustration", read_only=True)
+    illustration_thumbnail = serializers.URLField(source="get_illustration_thumb", read_only=True)
+    stats = serializers.JSONField(source="get_stats", read_only=True)
 
 
 class KegTapSerializer(serializers.ModelSerializer):
@@ -249,7 +255,7 @@ class Meta:
             "current_keg",
         ]
 
-    current_keg = KegSerializer()
+    current_keg = KegSerializer(read_only=True)
 
 
 class DrinkSerializer(serializers.ModelSerializer):
@@ -268,9 +274,9 @@ class Meta:
             "picture",
         ]
 
-    picture = PictureSerializer()
-    user = UserSerializer()
-    keg = KegSerializer()
+    picture = PictureSerializer(read_only=True)
+    user = UserSerializer(read_only=True)
+    keg = KegSerializer(read_only=True)
 
 
 class AuthenticationTokenSerializer(serializers.ModelSerializer):
@@ -302,7 +308,7 @@ class Meta:
             "stats",
         ]
 
-    stats = serializers.JSONField(source="get_stats")
+    stats = serializers.JSONField(source="get_stats", read_only=True)
 
 
 class ThermoSensorSerializer(serializers.ModelSerializer):
@@ -338,10 +344,10 @@ class Meta:
             "session",
         ]
 
-    drink = DrinkSerializer()
-    keg = KegSerializer()
-    user = UserSerializer()
-    session = DrinkingSessionSerializer()
+    drink = DrinkSerializer(read_only=True)
+    keg = KegSerializer(read_only=True)
+    user = UserSerializer(read_only=True)
+    session = DrinkingSessionSerializer(read_only=True)
 
 
 class NotificationSettingsSerializer(serializers.ModelSerializer):
@@ -373,13 +379,8 @@ class LoginSerializer(serializers.Serializer):
     password = serializers.CharField()
 
     def validate(self, data):
-        username = data["username"]
-        password = data["password"]
-        try:
-            user = models.User.objects.get(username=username)
-        except models.User.DoesNotExist:
-            raise ValidationError("Incorrect username/password")
-        if not user.check_password(password):
+        user = authenticate(username=data["username"], password=data["password"])
+        if not user:
             raise ValidationError("Incorrect username/password")
         data["user"] = user
         return data
@@ -403,7 +404,7 @@ class Meta:
             "email",
         ]
 
-    picture = PictureSerializer(source="mugshot")
+    picture = PictureSerializer(source="mugshot", read_only=True)
 
 
 class SystemStatusSerializer(serializers.Serializer):
diff --git a/pykeg/api/tests.py b/pykeg/api/tests.py
index 2bc89d12..93a10eb4 100644
--- a/pykeg/api/tests.py
+++ b/pykeg/api/tests.py
@@ -16,7 +16,6 @@ def add_auth(self):
         if self.api_key:
             credentials = f"api:{self.api_key}"
             base64_credentials = base64.b64encode(credentials.encode()).decode()
-            print("credentials", base64_credentials)
             self.client.credentials(HTTP_AUTHORIZATION=f"Basic {base64_credentials}")
         else:
             self.client.credentials()
@@ -117,3 +116,42 @@ def test_api_key_from_inactive_account_is_rejected(self):
         self.user.save()
         status, _ = self.client.get_events()
         self.assertEqual(403, status)
+
+
+class V2ApiPermissionsTestCase(TestCase):
+    fixtures = ["testdata/demo-site.json"]
+
+    def setUp(self):
+        self.client = ApiClient()
+        self.site = models.KegbotSite.objects.all().first()
+        self.site.server_version = get_version()
+        self.site.save()
+        self.member = models.User.objects.get(username="alice")
+        self.member_key = models.ApiKey.objects.get_or_create(user=self.member)[0]
+
+    def test_users_are_read_only(self):
+        self.client.api_key = self.member_key.key
+        self.client.add_auth()
+        response = self.client.client.patch(
+            f"/api/users/{self.member.id}", {"display_name": "hax"}, format="json"
+        )
+        self.assertEqual(405, response.status_code)
+
+    def test_plugin_data_requires_admin(self):
+        self.client.api_key = self.member_key.key
+        status, _ = self.client.get("/api/plugin-data")
+        self.assertEqual(403, status)
+
+    def test_beverages_require_admin_to_write(self):
+        self.client.api_key = self.member_key.key
+        self.client.add_auth()
+        response = self.client.client.post("/api/beverages", {"name": "Nope"}, format="json")
+        self.assertEqual(403, response.status_code)
+
+    def test_notification_settings_are_scoped_to_caller(self):
+        other = models.User.objects.get(username="bob")
+        models.NotificationSettings.objects.create(user=other, backend="test", keg_tapped=True)
+        self.client.api_key = self.member_key.key
+        status, data = self.client.get("/api/notification-settings")
+        self.assertEqual(200, status)
+        self.assertEqual([], data["results"])
diff --git a/pykeg/api/views.py b/pykeg/api/views.py
index 91c2f399..a317926c 100644
--- a/pykeg/api/views.py
+++ b/pykeg/api/views.py
@@ -13,10 +13,11 @@
 from . import permissions, serializers
 
 
-class UserViewSet(viewsets.ModelViewSet):
+class UserViewSet(viewsets.ReadOnlyModelViewSet):
     """Lists all users in the system.
 
-    Public view for any authenticated caller.
+    Read-only view for any authenticated caller; user management happens
+    in the admin dashboard.
     """
 
     queryset = models.User.objects.all()
@@ -24,11 +25,11 @@ class UserViewSet(viewsets.ModelViewSet):
     permission_classes = [permissions.IsAuthenticated]
 
 
-class InvitationViewSet(viewsets.ModelViewSet):
+class InvitationViewSet(viewsets.ReadOnlyModelViewSet):
     """Lists all of the *current user's* invitations."""
 
     queryset = models.Invitation.objects.all()
-    serializer_class = serializers.UserSerializer
+    serializer_class = serializers.InvitationSerializer
     permission_classes = [permissions.IsAuthenticated]
 
     def get_queryset(self):
@@ -60,6 +61,9 @@ class ApiKeyViewSet(viewsets.ModelViewSet):
     serializer_class = serializers.ApiKeySerializer
     permission_classes = [permissions.IsAuthenticated]
 
+    def perform_create(self, serializer):
+        serializer.save(user=self.request.user)
+
     def get_queryset(self):
         return (
             super()
@@ -76,7 +80,7 @@ class BeverageProducerViewSet(viewsets.ModelViewSet):
 
     queryset = models.BeverageProducer.objects.all()
     serializer_class = serializers.BeverageProducerSerializer
-    permission_classes = [permissions.IsAuthenticated]
+    permission_classes = [permissions.AdminWriteDashboardRead]
 
 
 class BeverageViewSet(viewsets.ModelViewSet):
@@ -84,7 +88,7 @@ class BeverageViewSet(viewsets.ModelViewSet):
 
     queryset = models.Beverage.objects.all()
     serializer_class = serializers.BeverageSerializer
-    permission_classes = [permissions.IsAuthenticated]
+    permission_classes = [permissions.AdminWriteDashboardRead]
 
 
 class KegTapViewSet(viewsets.ReadOnlyModelViewSet):
@@ -159,16 +163,16 @@ class ThermoSensorViewSet(viewsets.ModelViewSet):
     permission_classes = [permissions.IsAdminUser]
 
 
-class ThermologViewSet(viewsets.ModelViewSet):
+class ThermologViewSet(viewsets.ReadOnlyModelViewSet):
     """Lists all Thermologs in the system."""
 
     queryset = models.Thermolog.objects.all()
     serializer_class = serializers.ThermologSerializer
-    permission_classes = [permissions.IsAdminUser]
+    permission_classes = [permissions.DashboardViewer]
 
 
 class StatsViewSet(viewsets.ReadOnlyModelViewSet):
-    """Lists all Statss in the system."""
+    """Lists all stats snapshots in the system."""
 
     queryset = models.Stats.objects.all()
     serializer_class = serializers.StatsSerializer
@@ -184,19 +188,28 @@ class SystemEventViewSet(viewsets.ReadOnlyModelViewSet):
 
 
 class NotificationSettingsViewSet(viewsets.ModelViewSet):
-    """Lists all NotificationSettingss in the system."""
+    """Lists the *current user's* notification settings."""
 
     queryset = models.NotificationSettings.objects.all()
     serializer_class = serializers.NotificationSettingsSerializer
     permission_classes = [permissions.IsAuthenticated]
 
+    def get_queryset(self):
+        return super().get_queryset().filter(user=self.request.user)
+
+    def perform_create(self, serializer):
+        serializer.save(user=self.request.user)
+
 
 class PluginDataViewSet(viewsets.ModelViewSet):
-    """Lists all PluginDatas in the system."""
+    """Lists all PluginData in the system.
+
+    Admin-only: plugin data may contain plugin credentials.
+    """
 
     queryset = models.PluginData.objects.all()
     serializer_class = serializers.PluginDataSerializer
-    permission_classes = [permissions.IsAuthenticated]
+    permission_classes = [permissions.IsAdminUser]
 
 
 @api_view(["GET"])

From f294d604944674e8707c8f5671333b869ff93ece Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 19:59:19 +0000
Subject: [PATCH 8/9] api: generate an openapi spec with drf-spectacular

- schema served at /api/schema, interactive docs at /api/docs (swagger
  ui assets bundled via the sidecar package; no cdn)
- schema validates with --fail-on-warn: auth scheme described via an
  extension, method fields carry type hints
- pykeg.api is now a proper installed app (label pykeg_api; the label
  'api' belongs to the legacy pykeg.web.api)
---
 docs/source/releases/changelog.rst |   3 +-
 pykeg/api/apps.py                  |   1 +
 pykeg/api/auth.py                  |  15 +++
 pykeg/api/serializers.py           |   8 ++
 pykeg/api/tests.py                 |  18 ++++
 pykeg/api/urls.py                  |   3 +
 pykeg/api/views.py                 |   6 ++
 pykeg/settings.py                  |  15 +++
 pyproject.toml                     |   2 +
 uv.lock                            | 166 +++++++++++++++++++++++++++++
 10 files changed, 236 insertions(+), 1 deletion(-)

diff --git a/docs/source/releases/changelog.rst b/docs/source/releases/changelog.rst
index bf292d30..b9c6d0b4 100644
--- a/docs/source/releases/changelog.rst
+++ b/docs/source/releases/changelog.rst
@@ -26,7 +26,8 @@ brought up to date.
   their data in one step; no intermediate 1.2/1.3 install is needed.
 * Time zone choices are now derived from the system time zone database.
 * **A new REST API is served at ``/api/``** (previously the experimental
-  ``/api/v2/``, now always enabled).
+  ``/api/v2/``, now always enabled). An OpenAPI schema is available at
+  ``/api/schema``, with interactive documentation at ``/api/docs``.
 * **The legacy HTTP API is deprecated and now lives only at ``/api/v1/``.**
   It serves only the endpoints used by kegbot-pycore (plus the events
   feed); every other endpoint returns ``410 Gone``, and all legacy
diff --git a/pykeg/api/apps.py b/pykeg/api/apps.py
index 08c7b52c..d6eca7bf 100644
--- a/pykeg/api/apps.py
+++ b/pykeg/api/apps.py
@@ -4,3 +4,4 @@
 class ApiConfig(AppConfig):
     default_auto_field = "django.db.models.BigAutoField"
     name = "pykeg.api"
+    label = "pykeg_api"
diff --git a/pykeg/api/auth.py b/pykeg/api/auth.py
index bbbe9cf3..0ccdda6d 100644
--- a/pykeg/api/auth.py
+++ b/pykeg/api/auth.py
@@ -1,3 +1,4 @@
+from drf_spectacular.extensions import OpenApiAuthenticationExtension
 from rest_framework import authentication
 from rest_framework.exceptions import AuthenticationFailed
 
@@ -40,3 +41,17 @@ def authenticate_credentials(self, userid, password, request=None):
                 'For Basic Auth, provide "api" as the username and an API key as the password.'
             )
         return validate_api_key(password)
+
+
+class ApiKeyBasicAuthScheme(OpenApiAuthenticationExtension):
+    """Describes ApiKeyBasicAuth in the OpenAPI schema."""
+
+    target_class = "pykeg.api.auth.ApiKeyBasicAuth"
+    name = "apiKeyBasicAuth"
+
+    def get_security_definition(self, auto_schema):
+        return {
+            "type": "http",
+            "scheme": "basic",
+            "description": 'Use "api" as the username and an API key as the password.',
+        }
diff --git a/pykeg/api/serializers.py b/pykeg/api/serializers.py
index 9f57aef3..a39bbdf1 100644
--- a/pykeg/api/serializers.py
+++ b/pykeg/api/serializers.py
@@ -1,4 +1,6 @@
 from django.contrib.auth import authenticate
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import extend_schema_field
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
 
@@ -26,15 +28,19 @@ class Meta:
     thumbnail_png_url = serializers.SerializerMethodField()
     caption = serializers.CharField()
 
+    @extend_schema_field(OpenApiTypes.URI)
     def get_resized_url(self, picture):
         return picture.resized.url if picture else None
 
+    @extend_schema_field(OpenApiTypes.URI)
     def get_resized_png_url(self, picture):
         return picture.resized_png.url if picture else None
 
+    @extend_schema_field(OpenApiTypes.URI)
     def get_thumbnail_url(self, picture):
         return picture.thumbnail.url if picture else None
 
+    @extend_schema_field(OpenApiTypes.URI)
     def get_thumbnail_png_url(self, picture):
         return picture.thumbnail_png.url if picture else None
 
@@ -94,6 +100,8 @@ class Meta:
             "is_expired",
         ]
 
+    is_expired = serializers.BooleanField(read_only=True)
+
 
 class DeviceSerializer(serializers.ModelSerializer):
     class Meta:
diff --git a/pykeg/api/tests.py b/pykeg/api/tests.py
index 93a10eb4..2b15ac6a 100644
--- a/pykeg/api/tests.py
+++ b/pykeg/api/tests.py
@@ -155,3 +155,21 @@ def test_notification_settings_are_scoped_to_caller(self):
         status, data = self.client.get("/api/notification-settings")
         self.assertEqual(200, status)
         self.assertEqual([], data["results"])
+
+
+class SchemaTestCase(TestCase):
+    fixtures = ["testdata/demo-site.json"]
+
+    def setUp(self):
+        site = models.KegbotSite.objects.all().first()
+        site.server_version = get_version()
+        site.save()
+
+    def test_schema(self):
+        response = self.client.get("/api/schema")
+        self.assertEqual(200, response.status_code)
+        self.assertIn("openapi", response.headers["Content-Type"])
+
+    def test_docs(self):
+        response = self.client.get("/api/docs")
+        self.assertEqual(200, response.status_code)
diff --git a/pykeg/api/urls.py b/pykeg/api/urls.py
index f7534168..f7e395d1 100644
--- a/pykeg/api/urls.py
+++ b/pykeg/api/urls.py
@@ -1,4 +1,5 @@
 from django.urls import include, path
+from drf_spectacular.views import SpectacularAPIView, SpectacularSwaggerView
 from rest_framework import routers
 
 from . import views
@@ -32,4 +33,6 @@
     path("auth/login", views.login),
     path("auth/logout", views.logout),
     path("status", views.system_status),
+    path("schema", SpectacularAPIView.as_view(), name="api-schema"),
+    path("docs", SpectacularSwaggerView.as_view(url_name="api-schema"), name="api-docs"),
 ]
diff --git a/pykeg/api/views.py b/pykeg/api/views.py
index a317926c..e41dc8ff 100644
--- a/pykeg/api/views.py
+++ b/pykeg/api/views.py
@@ -1,5 +1,7 @@
 from django.contrib.auth import login as auth_login
 from django.contrib.auth import logout as auth_logout
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import extend_schema
 from rest_framework import viewsets
 from rest_framework.decorators import (
     api_view,
@@ -212,6 +214,7 @@ class PluginDataViewSet(viewsets.ModelViewSet):
     permission_classes = [permissions.IsAdminUser]
 
 
+@extend_schema(responses=serializers.SystemStatusSerializer)
 @api_view(["GET"])
 @permission_classes([permissions.DashboardViewer])
 def system_status(request):
@@ -232,6 +235,7 @@ def system_status(request):
     return Response(serializer.data)
 
 
+@extend_schema(request=serializers.LoginSerializer, responses=serializers.CurrentUserSerializer)
 @api_view(["POST"])
 @authentication_classes(())
 @permission_classes(())
@@ -243,12 +247,14 @@ def login(request):
     return Response(serializers.CurrentUserSerializer(user).data)
 
 
+@extend_schema(request=None, responses=OpenApiTypes.BOOL)
 @api_view(["POST"])
 def logout(request):
     auth_logout(request)
     return Response(True)
 
 
+@extend_schema(responses=serializers.CurrentUserSerializer)
 @api_view(["GET"])
 def current_user(request):
     user = request.user
diff --git a/pykeg/settings.py b/pykeg/settings.py
index d9fb5f68..7a83dbcd 100644
--- a/pykeg/settings.py
+++ b/pykeg/settings.py
@@ -46,11 +46,14 @@
     "django.contrib.messages",
     "django.contrib.sessions",
     "django.contrib.staticfiles",
+    "pykeg.api",
     "crispy_forms",
     "crispy_bootstrap4",
     "imagekit",
     "corsheaders",
     "rest_framework",
+    "drf_spectacular",
+    "drf_spectacular_sidecar",
     "django_rq",
 )
 
@@ -339,6 +342,18 @@
         "pykeg.api.auth.ApiKeyBasicAuth",
         "rest_framework.authentication.SessionAuthentication",
     ),
+    "DEFAULT_SCHEMA_CLASS": "drf_spectacular.openapi.AutoSchema",
+}
+
+SPECTACULAR_SETTINGS = {
+    "TITLE": "Kegbot Server API",
+    "DESCRIPTION": "The Kegbot Server REST API.",
+    "VERSION": None,
+    "SERVE_INCLUDE_SCHEMA": False,
+    "SERVE_PERMISSIONS": ["rest_framework.permissions.AllowAny"],
+    # Serve the docs UI assets locally (no CDN).
+    "SWAGGER_UI_DIST": "SIDECAR",
+    "SWAGGER_UI_FAVICON_HREF": "SIDECAR",
 }
 
 CORS_ALLOWED_ORIGINS = [
diff --git a/pyproject.toml b/pyproject.toml
index e2d26828..7b10ee32 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,6 +18,8 @@ dependencies = [
     "django-registration>=5.1",
     "django-rq>=3,<5",
     "djangorestframework>=3.16,<4",
+    "drf-spectacular>=0.28",
+    "drf-spectacular-sidecar",
     "Django>=5.2,<5.3",
     "freezegun>=1.2.1,<2",
     "isodate",
diff --git a/uv.lock b/uv.lock
index 5a418d3f..23ef5c6f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -53,6 +53,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c0/1b/54f4ad77cd8a584fa70746c47df988e002cf1ee1eba43364d46f87803647/asgiref-3.12.1-py3-none-any.whl", hash = "sha256:fe386d1c2bff7259ea95929266d12a8cf9a8b5a1c2598402967d8792e7a7c094", size = 25478, upload-time = "2026-07-14T09:56:16.926Z" },
 ]
 
+[[package]]
+name = "attrs"
+version = "26.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/9a/8e/82a0fe20a541c03148528be8cac2408564a6c9a0cc7e9171802bc1d26985/attrs-26.1.0.tar.gz", hash = "sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32", size = 952055, upload-time = "2026-03-19T14:22:25.026Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/64/b4/17d4b0b2a2dc85a6df63d1157e028ed19f90d4cd97c36717afef2bc2f395/attrs-26.1.0-py3-none-any.whl", hash = "sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309", size = 67548, upload-time = "2026-03-19T14:22:23.645Z" },
+]
+
 [[package]]
 name = "babel"
 version = "2.18.0"
@@ -351,6 +360,35 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/02/10/5da547df7a391dcde17f59520a231527b8571e6f46fc8efb02ccb370ab12/docutils-0.22.4-py3-none-any.whl", hash = "sha256:d0013f540772d1420576855455d050a2180186c91c15779301ac2ccb3eeb68de", size = 633196, upload-time = "2025-12-18T19:00:18.077Z" },
 ]
 
+[[package]]
+name = "drf-spectacular"
+version = "0.30.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+    { name = "djangorestframework" },
+    { name = "inflection" },
+    { name = "jsonschema" },
+    { name = "pyyaml" },
+    { name = "uritemplate" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/50/43/41d25039a6a53545420ebc98eb9f877ec9fe30c7bd03fefabcaf9b953af7/drf_spectacular-0.30.0.tar.gz", hash = "sha256:53e79e7ba00e240441b63c32273754a5368e4c2ab44a19f2595277cc1cd559c9", size = 252311, upload-time = "2026-07-06T11:29:46.264Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c3/56/74dd7b45bbde6d24494220b98d6961cb1200b63a1800332b430daa2c4551/drf_spectacular-0.30.0-py3-none-any.whl", hash = "sha256:006cf5921ebe20a9bd24f7c846261ebbf78780be5961b0d6e87afaa82afd62ff", size = 111150, upload-time = "2026-07-06T11:29:45.12Z" },
+]
+
+[[package]]
+name = "drf-spectacular-sidecar"
+version = "2026.8.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/28/82/eb18e2108b8ceaa50a01d2cdb35ab5ce198c18f062448b2d29d6e89aabeb/drf_spectacular_sidecar-2026.8.1.tar.gz", hash = "sha256:9d9ee678e5ec70cdda2c7ed95cafcdb6141664dc3e11def8a8599c8ad36cf6f5", size = 2603635, upload-time = "2026-08-01T12:09:03.088Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3e/5b/5ea443b8c24b4a4815a6467a158c4511dfe8bed83f8861a27bdb29c4fc47/drf_spectacular_sidecar-2026.8.1-py3-none-any.whl", hash = "sha256:6b8784d3e8c6bd9aa740b14e874640697ab1bc67f5232d74fdd9ef84eaea6bc3", size = 2626283, upload-time = "2026-08-01T12:09:01.705Z" },
+]
+
 [[package]]
 name = "fakeredis"
 version = "2.37.0"
@@ -449,6 +487,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/5f/53/fb7122b71361a0d121b669dcf3d31244ef75badbbb724af388948de543e2/imagesize-2.0.0-py2.py3-none-any.whl", hash = "sha256:5667c5bbb57ab3f1fa4bc366f4fbc971db3d5ed011fd2715fd8001f782718d96", size = 9441, upload-time = "2026-03-03T14:18:27.892Z" },
 ]
 
+[[package]]
+name = "inflection"
+version = "0.5.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e1/7e/691d061b7329bc8d54edbf0ec22fbfb2afe61facb681f9aaa9bff7a27d04/inflection-0.5.1.tar.gz", hash = "sha256:1a29730d366e996aaacffb2f1f1cb9593dc38e2ddd30c91250c6dde09ea9b417", size = 15091, upload-time = "2020-08-22T08:16:29.139Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/59/91/aa6bde563e0085a02a435aa99b49ef75b0a4b062635e606dab23ce18d720/inflection-0.5.1-py2.py3-none-any.whl", hash = "sha256:f38b2b640938a4f35ade69ac3d053042959b62a0f1076a5bbaa1b9526605a8a2", size = 9454, upload-time = "2020-08-22T08:16:27.816Z" },
+]
+
 [[package]]
 name = "iniconfig"
 version = "2.3.0"
@@ -479,6 +526,33 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/62/a1/3d680cbfd5f4b8f15abc1d571870c5fc3e594bb582bc3b64ea099db13e56/jinja2-3.1.6-py3-none-any.whl", hash = "sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67", size = 134899, upload-time = "2025-03-05T20:05:00.369Z" },
 ]
 
+[[package]]
+name = "jsonschema"
+version = "4.26.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "attrs" },
+    { name = "jsonschema-specifications" },
+    { name = "referencing" },
+    { name = "rpds-py" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b3/fc/e067678238fa451312d4c62bf6e6cf5ec56375422aee02f9cb5f909b3047/jsonschema-4.26.0.tar.gz", hash = "sha256:0c26707e2efad8aa1bfc5b7ce170f3fccc2e4918ff85989ba9ffa9facb2be326", size = 366583, upload-time = "2026-01-07T13:41:07.246Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/69/90/f63fb5873511e014207a475e2bb4e8b2e570d655b00ac19a9a0ca0a385ee/jsonschema-4.26.0-py3-none-any.whl", hash = "sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce", size = 90630, upload-time = "2026-01-07T13:41:05.306Z" },
+]
+
+[[package]]
+name = "jsonschema-specifications"
+version = "2025.9.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "referencing" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/19/74/a633ee74eb36c44aa6d1095e7cc5569bebf04342ee146178e2d36600708b/jsonschema_specifications-2025.9.1.tar.gz", hash = "sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d", size = 32855, upload-time = "2025-09-08T01:34:59.186Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/41/45/1a4ed80516f02155c51f51e8cedb3c1902296743db0bbc66608a0db2814f/jsonschema_specifications-2025.9.1-py3-none-any.whl", hash = "sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe", size = 18437, upload-time = "2025-09-08T01:34:57.871Z" },
+]
+
 [[package]]
 name = "kegbot"
 version = "2.0.0.dev0"
@@ -497,6 +571,8 @@ dependencies = [
     { name = "django-registration" },
     { name = "django-rq" },
     { name = "djangorestframework" },
+    { name = "drf-spectacular" },
+    { name = "drf-spectacular-sidecar" },
     { name = "freezegun" },
     { name = "isodate" },
     { name = "mysqlclient" },
@@ -543,6 +619,8 @@ requires-dist = [
     { name = "django-registration", specifier = ">=5.1" },
     { name = "django-rq", specifier = ">=3,<5" },
     { name = "djangorestframework", specifier = ">=3.16,<4" },
+    { name = "drf-spectacular", specifier = ">=0.28" },
+    { name = "drf-spectacular-sidecar" },
     { name = "freezegun", specifier = ">=1.2.1,<2" },
     { name = "isodate" },
     { name = "mysqlclient" },
@@ -842,6 +920,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/66/9d/c5731f6e3608663d4d3656fd8d3aecee8b509c3082818f5a13eae925baea/redis-8.1.0-py3-none-any.whl", hash = "sha256:a4fe1aac3d3b3cc791d4b3d5931c5a956045dc951ee74d1c913ee3ac4d2ee9fb", size = 560618, upload-time = "2026-07-30T08:50:58.497Z" },
 ]
 
+[[package]]
+name = "referencing"
+version = "0.37.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "attrs" },
+    { name = "rpds-py" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/22/f5/df4e9027acead3ecc63e50fe1e36aca1523e1719559c499951bb4b53188f/referencing-0.37.0.tar.gz", hash = "sha256:44aefc3142c5b842538163acb373e24cce6632bd54bdb01b21ad5863489f50d8", size = 78036, upload-time = "2025-10-13T15:30:48.871Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/2c/58/ca301544e1fa93ed4f80d724bf5b194f6e4b945841c5bfd555878eea9fcb/referencing-0.37.0-py3-none-any.whl", hash = "sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231", size = 26766, upload-time = "2025-10-13T15:30:47.625Z" },
+]
+
 [[package]]
 name = "requests"
 version = "2.34.2"
@@ -878,6 +969,72 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/04/54/6f679c435d28e0a568d8e8a7c0a93a09010818634c3c3907fc98d8983770/roman_numerals-4.1.0-py3-none-any.whl", hash = "sha256:647ba99caddc2cc1e55a51e4360689115551bf4476d90e8162cf8c345fe233c7", size = 7676, upload-time = "2025-12-17T18:25:33.098Z" },
 ]
 
+[[package]]
+name = "rpds-py"
+version = "2026.6.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/aa/2a/9618a122aeb2a169a28b03889a2995fe297588964333d4a7d67bdf46e147/rpds_py-2026.6.3.tar.gz", hash = "sha256:1cebd1337c242e4ec2293e541f712b2da849b29f48f0c293684b71c0632625d4", size = 64051, upload-time = "2026-06-30T07:17:53.009Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b6/36/7fbe9dcdaf857fb3f63c2a2284b62492d95f5e8334e947e5fb6e7f68c9be/rpds_py-2026.6.3-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:931908d9fc855d8f74783377822be318edb6dcb19e47169dc038f9a1bf60b06e", size = 344510, upload-time = "2026-06-30T07:15:57.921Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/54/f785cc3d3f60839ca57a5af4927a9f347b07b2799c373fc20f7949f87c7e/rpds_py-2026.6.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:d7469697dce35be237db177d42e2a2ee26e6dcc5fc052078a6fefabd288c6edd", size = 339495, upload-time = "2026-06-30T07:15:59.238Z" },
+    { url = "https://files.pythonhosted.org/packages/63/ef/d4cdaf309e6b095b43597103cf8c0b951d6cca2acce68c474f75ec12e0c7/rpds_py-2026.6.3-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bcfbcf66006befb9fd2aeaa9e01feaf881b4dc330a02ba07d2322b1c11be7b5d", size = 369454, upload-time = "2026-06-30T07:16:01.021Z" },
+    { url = "https://files.pythonhosted.org/packages/96/4a/9559a68b7ee15db09d7981212e8c2e219d2a1d6d4faa0391d813c3496a36/rpds_py-2026.6.3-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:847927daf4cffbd4e90e42bc890069897101edd015f956cb8721b3473372edda", size = 374583, upload-time = "2026-06-30T07:16:02.287Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/75/8964aa7d2c6e8ac43eba8eb6e6b0fdda1f46d39f2fc3e6aa9f2cb17f485d/rpds_py-2026.6.3-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:aca6c1ef08a82bfe327cc156da694660f599923e2e6665b6d81c9c2d0ac9ffc8", size = 492919, upload-time = "2026-06-30T07:16:03.723Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/97/6908094ac804115e65aedfd90f1b5fee4eebebd3f6c4cfc5419939267565/rpds_py-2026.6.3-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ae50181a047c871561212bb97f7932a2d45fb53e947bd9b57ebad85b529cbc53", size = 383725, upload-time = "2026-06-30T07:16:05.305Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/9c/0d1fdc2e7aba23e290d603bc494e97bd205bae262ce33c6b32a69768ed5e/rpds_py-2026.6.3-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dc319e5a1de4b6913aac94bf6a2f9e847371e0a140a43dd4991db1a09bc2d504", size = 367255, upload-time = "2026-06-30T07:16:07.086Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/fe/f0209ca4a9ed074bc8acb44dfd0e81c3122e94c9689f5645b7973a866719/rpds_py-2026.6.3-cp314-cp314-manylinux_2_31_riscv64.whl", hash = "sha256:e4316bf32babbed84e691e352faf967ce2f0f024174a8643c37c94a1080374fc", size = 379060, upload-time = "2026-06-30T07:16:08.525Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/8d/f1cc54c616b9d8897de8738aac148d20afca93f68187475fe194d09a71b9/rpds_py-2026.6.3-cp314-cp314-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:8c6e5a2f750cc71c3e3b11d71661f21d6f9bc6cebc6564b1466417a1ec03ec77", size = 395960, upload-time = "2026-06-30T07:16:09.989Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/04/aafff00f73aeca2945f734f1d483c64ab8f472d0864ab02377fd8e89c3b2/rpds_py-2026.6.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:4470ce197d4090875cf6affbf1f853338387428df97c4fb7b7106317b8214698", size = 545356, upload-time = "2026-06-30T07:16:11.816Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/cc/e229663b9e4ddac5a4acbe9085dd80a71af2a5d356b8b39d6bff233f24b0/rpds_py-2026.6.3-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:ea964164cc9afa72d4d9b23cc28dafae93693c0a53e0b42acbff15b22c3f9ddd", size = 612319, upload-time = "2026-06-30T07:16:13.586Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/7a/8a0e6d3e6cd066af108b71b43122c3fe158dd9eb86acac626593a2582eb1/rpds_py-2026.6.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:639c8929aa0afe81be836b04de888460d6bed38b9c54cfc18da8f6bfabf5af5d", size = 573508, upload-time = "2026-06-30T07:16:15.23Z" },
+    { url = "https://files.pythonhosted.org/packages/87/03/2a69ab618a789cf6cf85c86bb844c62d090e700ab1a2aa676b3741b6c516/rpds_py-2026.6.3-cp314-cp314-win32.whl", hash = "sha256:882076c00c0a608b131187055ddc5ae29f2e7eaf870d6168980420d58528a5c8", size = 202504, upload-time = "2026-06-30T07:16:16.893Z" },
+    { url = "https://files.pythonhosted.org/packages/85/62/a3892ba945f4e24c78f352e5de3c7620d8479f73f211406a97263d13c7d2/rpds_py-2026.6.3-cp314-cp314-win_amd64.whl", hash = "sha256:0be972be84cfcaf46c8c6edf690ca0f154ac17babf1f6a955a51579b34ad2dc5", size = 220380, upload-time = "2026-06-30T07:16:18.108Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/e7/c2bd44dc831931815ad11ebb5f430b5a0a4d3caa9de837107876c30c3432/rpds_py-2026.6.3-cp314-cp314-win_arm64.whl", hash = "sha256:2a9c6f195058cb45335e8cc3802745c603d716eb96bc9625950c1aac71c0c703", size = 215976, upload-time = "2026-06-30T07:16:19.654Z" },
+    { url = "https://files.pythonhosted.org/packages/79/9c/fff7b74bce9a091ec9a012a03f9ff5f69364eaf9451060dfc4486da2ffdd/rpds_py-2026.6.3-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:f90938e92afda60266da758ee7d363447f7f0138c9559f9e1811629580582d90", size = 346840, upload-time = "2026-06-30T07:16:21.268Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/44/77bcb1168b33704908295533d27f10eb811e9e3e193e8993dc99572211d3/rpds_py-2026.6.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:ec829541c45bca16e61c7ae50c20501f213605beb75d1aba91a6ee37fbbb56a4", size = 340282, upload-time = "2026-06-30T07:16:22.875Z" },
+    { url = "https://files.pythonhosted.org/packages/87/3c/7a9081c7c9e645b39efe19e4ffbeccd80add246327cd9b888aecffd72317/rpds_py-2026.6.3-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:afd70d95892096cdb26f15a00c45907b17817577aa8d1c76b2dcc2788391f9e9", size = 370403, upload-time = "2026-06-30T07:16:24.415Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/69/af47021eb7dad6ff3396cb001c08f0f3c4d06c20253f75be6421a59fe6b7/rpds_py-2026.6.3-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:29dfa0533a5d4c94d4dfa1b694fcb56c9c63aad8330ffdd816fd225d0a7a162f", size = 376055, upload-time = "2026-06-30T07:16:26.111Z" },
+    { url = "https://files.pythonhosted.org/packages/81/fc/a3bcf517084396a6dd258c592567a3c011ba4557f2fde23dceaf26e74f2e/rpds_py-2026.6.3-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:af05d726809bff6b141be124d4c7ce998f9c9c7f30edb1f46c07aa103d540b41", size = 494419, upload-time = "2026-06-30T07:16:27.596Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/eb/13d529d1788135425c7bf207f8463458ca5d92e43f3f701365b83e9dffc1/rpds_py-2026.6.3-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9826217f048f620d9a712672818bf231442c1b35d96b227a07eabd11b4bb6945", size = 384848, upload-time = "2026-06-30T07:16:29.183Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/f4/b7ac49f30013aba8f7b9566b1dd07e81de95e708c1374b7bacc5b9bc5c9c/rpds_py-2026.6.3-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:536bceea4fa4acf7e1c61da2b5786304367c816c8895be71b8f537c480b0ea1f", size = 371369, upload-time = "2026-06-30T07:16:30.912Z" },
+    { url = "https://files.pythonhosted.org/packages/31/86/6260bafa622f788b07ddec0e52d810305c8b9b0b8c27f58a2ab04bf62b4f/rpds_py-2026.6.3-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:bc0011654b91cc4fb2ae701bec0a0ba1e552c0714247fa7af6c59e0ccfa3a4e1", size = 379673, upload-time = "2026-06-30T07:16:32.486Z" },
+    { url = "https://files.pythonhosted.org/packages/19/c3/03f1ee79a047b48daeca157c89a18509cde22b6b951d642b9b0af1be660a/rpds_py-2026.6.3-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:539d75de9e0d536c84ff18dfeb805398e58227001ce09231a26a08b9aed1ee0e", size = 397500, upload-time = "2026-06-30T07:16:34.471Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/95/8ed0cd8c377dca12aea498f119fe639fc474d1461545c39d2b5872eb1c0f/rpds_py-2026.6.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:166cf54d9f44fc6ceb53c7860258dde44a81406646de79f8ed3234fca3b6e538", size = 545978, upload-time = "2026-06-30T07:16:36.45Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/f2/0eb57f0eaa83f8fc152a7e03de968ab77e1f00732bebc892b190c6eebde7/rpds_py-2026.6.3-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:d34c20167764fbcf927194d532dd7e0c56772f0a5f943fa5ef9e9afbba8fb9db", size = 613350, upload-time = "2026-06-30T07:16:38.213Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/de/e0674bdbc3ef7634989b3f854c3f34bc1f587d36e5bfdc5c378d57034619/rpds_py-2026.6.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:ea7bb13b7c9a29791f87a0387ba7d3ad3a6d783d827e4d3f27b40a0ff44495e2", size = 576486, upload-time = "2026-06-30T07:16:39.797Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/f6/21101359743cd136ada781e8210a85769578422ba460672eea0e29739200/rpds_py-2026.6.3-cp314-cp314t-win32.whl", hash = "sha256:6de4744d05bd1aa1be4ed7ea1189e3979196808008113bbbf899a460966b925e", size = 201068, upload-time = "2026-06-30T07:16:41.316Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/b2/9574d4d44f7760c2aa32d92a0a4f41698e33f5b204a0bf5c9758f52c79d5/rpds_py-2026.6.3-cp314-cp314t-win_amd64.whl", hash = "sha256:c7b9a2f8f4d8e90af72571d3d495deebdd7e3c75451f5b41719aee166e940fc2", size = 220600, upload-time = "2026-06-30T07:16:43.091Z" },
+    { url = "https://files.pythonhosted.org/packages/08/ae/f23a2697e6ee6340a578b0f136be6483657bef0c6f9497b752bb5c0964bb/rpds_py-2026.6.3-cp315-cp315-macosx_10_12_x86_64.whl", hash = "sha256:e059c5dde6452b44424bd1834557556c226b57781dee1227af23518459722b13", size = 344726, upload-time = "2026-06-30T07:16:44.5Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/63/e7b3a1a5358dd32c930a1062d8e15b67fd6e8922e81df9e91706d66ee5c8/rpds_py-2026.6.3-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:2f7c26fbc5acd2522b95d4177fe4710ffd8e9b20529e703ffbf8db4d93903f05", size = 339587, upload-time = "2026-06-30T07:16:46.255Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/64/10a85681916ca55fffb91b0a211f84e34297c109243484dd6394660a8a7c/rpds_py-2026.6.3-cp315-cp315-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a3086b538543802f84c843911242db20447de00d8752dd0efc936dbcf02218ba", size = 369585, upload-time = "2026-06-30T07:16:48.101Z" },
+    { url = "https://files.pythonhosted.org/packages/76/c2/baf95c7c38823e12ba34407c5f5767a89e5cf2233895e56f608167ae9493/rpds_py-2026.6.3-cp315-cp315-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8f2e5c5ee828d42cb11760761c0af6507927bec42d0ad5458f97c9203b054617", size = 375479, upload-time = "2026-06-30T07:16:49.93Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/94/0aad06c72d65101e11d33528d438cda99a39ce0da99466e156158f2541d3/rpds_py-2026.6.3-cp315-cp315-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ed0c1e5d10cdc7135537988c74a0188da68e2f3c30813ba3744ab1e42e0480f9", size = 492418, upload-time = "2026-06-30T07:16:51.641Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/17/de3f5a479a1f056535d7489819639d8cd591ea6281d700390b43b1abd745/rpds_py-2026.6.3-cp315-cp315-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:8c2642a7603ec0b16ed77da4555db3b4b472341904873788327c0b0d7b95f1bb", size = 384123, upload-time = "2026-06-30T07:16:53.622Z" },
+    { url = "https://files.pythonhosted.org/packages/46/7d/bf09bd1b145bb2671c03e1e6d1ab8651858d90d8c7dfeadd85a37a934fd8/rpds_py-2026.6.3-cp315-cp315-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8e4320744c1ffdd95a603def63344bfab2d33edeab301c5007e7de9f9f5b3885", size = 367351, upload-time = "2026-06-30T07:16:55.241Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/ea/1bb734f314b8be319149ddee80b18bd41372bdcfbdf88d28131c0cd37719/rpds_py-2026.6.3-cp315-cp315-manylinux_2_31_riscv64.whl", hash = "sha256:a9f4645593036b81bbdb36b9c8e0ea0d1c3fee968c4d59db0344c14087ef143a", size = 378827, upload-time = "2026-06-30T07:16:56.841Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/93/d9611e5b25e26df9a3649813ed66193ace9347a7c7fc4ab7cf70e94851c0/rpds_py-2026.6.3-cp315-cp315-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e55d236be29255554da47abe5c577637db7c24a02b8b46f0ca9524c855801868", size = 395966, upload-time = "2026-06-30T07:16:58.557Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/cb/99d77e16e5534ae1d90629bbe419ba6ee170833a6a85e3aa1cc41726fbbc/rpds_py-2026.6.3-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:24e9c5386e16669b674a69c156c8eeefcb578f3b3397b713b08e6d60f3c7b187", size = 545680, upload-time = "2026-06-30T07:17:00.164Z" },
+    { url = "https://files.pythonhosted.org/packages/59/15/11a29755f790cef7a2f755e8e14f4f0c33f39489e1893a632a2eee59672b/rpds_py-2026.6.3-cp315-cp315-musllinux_1_2_i686.whl", hash = "sha256:c60924535c75f1566b6eb75b5c31a48a43fef04fa2d0d201acbad8a9969c6107", size = 611853, upload-time = "2026-06-30T07:17:01.962Z" },
+    { url = "https://files.pythonhosted.org/packages/68/86/0c27547e21644da938fb530f7e1a8148dd24d02db07e7a5f2567a17ce710/rpds_py-2026.6.3-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:38a2fea2787428f811719ceb9114cb78964a3138838320c29ac39526c79c16ba", size = 573715, upload-time = "2026-06-30T07:17:03.693Z" },
+    { url = "https://files.pythonhosted.org/packages/29/71/4d8fcf700931815594bce892255bbd973b94efaf0fc1932b0590df18d886/rpds_py-2026.6.3-cp315-cp315-win32.whl", hash = "sha256:d483fe17f01ad64b7bf7cc38fcefff1ca9fb83f8c2b2542b68f97ffe0611b369", size = 202864, upload-time = "2026-06-30T07:17:05.746Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/62/b577562de0edbb55b2be85ce5fd09c33e386b9b13eee09833af4240fd5c4/rpds_py-2026.6.3-cp315-cp315-win_amd64.whl", hash = "sha256:67e3a721ffc5d8d2210d3671872298c4a84e4b8035cfe42ffd7cde35d772b146", size = 220430, upload-time = "2026-06-30T07:17:07.471Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/95/d6d0b2509825141eef60669a5739eec88dbc6a48053d6c92993a5704defe/rpds_py-2026.6.3-cp315-cp315-win_arm64.whl", hash = "sha256:6e84adbcf4bf841aed8116a8264b9f50b4cb3e7bd89b516122e616ac56ca269e", size = 215877, upload-time = "2026-06-30T07:17:09.008Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/bf/f3ea278f0afd615c1d0f19cb69043a41526e2bb600c2b536eb192218eb27/rpds_py-2026.6.3-cp315-cp315t-macosx_10_12_x86_64.whl", hash = "sha256:ae6dd8f10bd17aad820876d24caec9efdafd80a318d16c0a48edb5e136902c6b", size = 346933, upload-time = "2026-06-30T07:17:10.762Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/29/9907bdf1c5346763cf10b7f6852aad86652168c259def904cbe0082c5864/rpds_py-2026.6.3-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:bdbd97738551fca3917c1bd7188bec1920bb520104f28e7e1007f9ceb17b7690", size = 340274, upload-time = "2026-06-30T07:17:12.266Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/2c/8e03767b5778ef25cebf74a7a91a2c3806f8eced4c92cb7406bbe060756d/rpds_py-2026.6.3-cp315-cp315t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8b95977e7211527ab0ba576e286d023389fbeeb32a6b7b771665d333c60e5342", size = 370763, upload-time = "2026-06-30T07:17:14.107Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/e1/df2a7e1ba2efd796af26194250b8d42c821b46592311595162af9ef0528d/rpds_py-2026.6.3-cp315-cp315t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d15fde0e6fb0d88a60d221204873743e5d9f0b7d29165e62cd86d0413ad74ba6", size = 376467, upload-time = "2026-06-30T07:17:15.76Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/de/8a0814d1946af29cb068fb259aa8622f856df1d0bab58429448726b537f5/rpds_py-2026.6.3-cp315-cp315t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a136d453475ac0fcbda502ef1e6504bd28d6d904700915d278deeab0d00fe140", size = 496689, upload-time = "2026-06-30T07:17:17.308Z" },
+    { url = "https://files.pythonhosted.org/packages/df/f3/f19e0c852ba13694f5a79f3b719331051573cb5693feacf8a88ffffc3a71/rpds_py-2026.6.3-cp315-cp315t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f826877d462181e5eb1c26a0026b8d0cab05d99844ecb6d8bf3627a2ca0c0442", size = 385340, upload-time = "2026-06-30T07:17:18.928Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/ae/7ec3a9d2d4351f99e37bcb06b6b6f954512646bfdbf9742e1de727865daf/rpds_py-2026.6.3-cp315-cp315t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:79486287de1730dbaff3dbd124d0ca4d2ef7f9d29bf2544f1f93c09b5bcbbd12", size = 372179, upload-time = "2026-06-30T07:17:20.539Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/ac/9cee911dff2aaa9a5a8354f6610bf2e6a616de9197c5fff4f54f82585f1e/rpds_py-2026.6.3-cp315-cp315t-manylinux_2_31_riscv64.whl", hash = "sha256:808345f53cb952433ca2816f1604ff3515608a81784954f38d4452acfe8e61d5", size = 379993, upload-time = "2026-06-30T07:17:22.212Z" },
+    { url = "https://files.pythonhosted.org/packages/83/6b/7c2a07ba88d1e9a936612f7a5d067467ed03d971d5a06f7d309dff044a7e/rpds_py-2026.6.3-cp315-cp315t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:1967debc37f64f2c4dc90a7f563aec558b471966e12adcac4e1c4240496b6ebf", size = 398909, upload-time = "2026-06-30T07:17:23.66Z" },
+    { url = "https://files.pythonhosted.org/packages/97/0b/776ffcb66783637b0031f6d58d6fb55913c8b5abf00aeecd46bf933fb477/rpds_py-2026.6.3-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:f0840b5b17057f7fd918b76183a4b5a0635f43e14eb2ce60dce1d4ee4707ea00", size = 546584, upload-time = "2026-06-30T07:17:25.264Z" },
+    { url = "https://files.pythonhosted.org/packages/55/33/ba3bc04d7092bd553c9b2b195624992d2cc4f3de1f380b7b93cbee67bd79/rpds_py-2026.6.3-cp315-cp315t-musllinux_1_2_i686.whl", hash = "sha256:faa679d19a6696fd54259ad321251ad77a13e70e03dd834daa762a44fb6196ef", size = 614357, upload-time = "2026-06-30T07:17:26.888Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/71/14edf065f04630b1a8472f7653cad03f6c478bcf95ea0e6aed55451e33ea/rpds_py-2026.6.3-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:23a439f31ccbeff1574e24889128821d1f7917470e830cf6544dced1c662262a", size = 576533, upload-time = "2026-06-30T07:17:28.546Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/76/65002b08596c389105720a8c0d22298b8dc25a4baf89b2ce431343c8b1de/rpds_py-2026.6.3-cp315-cp315t-win32.whl", hash = "sha256:913ca42ccad3f8cc6e292b587ae8ae49c8c823e5dce51a736252fc7c7cdfa577", size = 201204, upload-time = "2026-06-30T07:17:30.193Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/97/d855d6b3c322d1f27e26f5241c42016b56cf01377ea8ed348285f54652f0/rpds_py-2026.6.3-cp315-cp315t-win_amd64.whl", hash = "sha256:ae3d4fe8c0b9213624fdce7279d70e3b148b682ca20719ebd193a23ebfa47324", size = 220719, upload-time = "2026-06-30T07:17:31.788Z" },
+]
+
 [[package]]
 name = "rq"
 version = "2.10.0"
@@ -1115,6 +1272,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/e5/6d/b53b99a9f2766d095985947a5782f1702cabb129a34f7a802d7197af832f/tzdata-2026.3-py2.py3-none-any.whl", hash = "sha256:dc096730c87af6cab1b171c9d532be840741ff5d459015e7f6947bd7d7e54931", size = 348168, upload-time = "2026-07-10T08:50:36.46Z" },
 ]
 
+[[package]]
+name = "uritemplate"
+version = "4.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/98/60/f174043244c5306c9988380d2cb10009f91563fc4b31293d27e17201af56/uritemplate-4.2.0.tar.gz", hash = "sha256:480c2ed180878955863323eea31b0ede668795de182617fef9c6ca09e6ec9d0e", size = 33267, upload-time = "2025-06-02T15:12:06.318Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a9/99/3ae339466c9183ea5b8ae87b34c0b897eda475d2aec2307cae60e5cd4f29/uritemplate-4.2.0-py3-none-any.whl", hash = "sha256:962201ba1c4edcab02e60f9a0d3821e82dfc5d2d6662a21abd533879bdb8a686", size = 11488, upload-time = "2025-06-02T15:12:03.405Z" },
+]
+
 [[package]]
 name = "urllib3"
 version = "2.7.0"

From f6ff560672cc8878dc08568efa8ce24789a28ede Mon Sep 17 00:00:00 2001
From: mike wakerly <opensource@hoho.com>
Date: Mon, 3 Aug 2026 20:22:50 +0000
Subject: [PATCH 9/9] docs: list removed and deprecated legacy api endpoints in
 the changelog

---
 docs/source/releases/changelog.rst | 68 ++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/docs/source/releases/changelog.rst b/docs/source/releases/changelog.rst
index b9c6d0b4..f46188da 100644
--- a/docs/source/releases/changelog.rst
+++ b/docs/source/releases/changelog.rst
@@ -50,6 +50,74 @@ brought up to date.
   arm64 only).
 * The legacy gflags-based Python API client was removed from the server
   package; it lives in the separate kegbot-api project.
+* **Breaking change: the following legacy API endpoints have been
+  removed** and now return ``410 Gone``:
+
+  * ``GET /api/v1/version``
+  * ``POST /api/v1/login``
+  * ``GET|POST /api/v1/logout``
+  * ``GET /api/v1/get-api-key``
+  * ``POST /api/v1/devices/link``
+  * ``GET /api/v1/devices/link/status``
+  * ``GET /api/v1/devices/link/status/:code``
+  * ``POST /api/v1/auth-tokens/:auth_device/:token_value/assign``
+  * ``GET|POST|DELETE /api/v1/controllers/:id``
+  * ``GET /api/v1/drinks``
+  * ``GET /api/v1/drinks/last``
+  * ``GET /api/v1/drinks/:id``
+  * ``POST /api/v1/drinks/:id/add-photo``
+  * ``GET|POST|DELETE /api/v1/flow-meters/:id``
+  * ``GET|POST /api/v1/flow-toggles``
+  * ``GET|POST|DELETE /api/v1/flow-toggles/:id``
+  * ``GET /api/v1/kegs``
+  * ``GET /api/v1/kegs/:id``
+  * ``POST /api/v1/kegs/:id/end``
+  * ``GET /api/v1/kegs/:id/drinks``
+  * ``GET /api/v1/kegs/:id/events``
+  * ``GET /api/v1/kegs/:id/sessions``
+  * ``GET /api/v1/kegs/:id/stats``
+  * ``GET /api/v1/keg-sizes``
+  * ``POST /api/v1/pictures``
+  * ``GET /api/v1/sessions``
+  * ``GET /api/v1/sessions/current``
+  * ``GET /api/v1/sessions/:id``
+  * ``GET /api/v1/sessions/:id/stats``
+  * ``DELETE /api/v1/taps/:meter_name_or_id``
+  * ``POST /api/v1/taps/:meter_name_or_id/activate``
+  * ``POST /api/v1/taps/:meter_name_or_id/calibrate``
+  * ``POST /api/v1/taps/:meter_name_or_id/spill``
+  * ``POST /api/v1/taps/:meter_name_or_id/connect-meter``
+  * ``POST /api/v1/taps/:meter_name_or_id/disconnect-meter``
+  * ``POST /api/v1/taps/:meter_name_or_id/connect-toggle``
+  * ``POST /api/v1/taps/:meter_name_or_id/disconnect-toggle``
+  * ``POST /api/v1/taps/:meter_name_or_id/connect-thermo``
+  * ``POST /api/v1/taps/:meter_name_or_id/disconnect-thermo``
+  * ``GET /api/v1/thermo-sensors``
+  * ``GET /api/v1/thermo-sensors/:sensor_name/logs``
+  * ``GET /api/v1/users``
+  * ``GET /api/v1/users/:username``
+  * ``GET /api/v1/users/:username/drinks``
+  * ``GET /api/v1/users/:username/events``
+  * ``GET /api/v1/users/:username/stats``
+  * ``GET|POST /api/v1/users/:username/photo``
+  * ``POST /api/v1/new-user``
+  * ``GET /api/v1/stats``
+  * ``GET /api/v1/sound-events``
+
+* The following legacy API endpoints are deprecated, but remain supported
+  for compatibility with kegbot-pycore. They will be removed in a future
+  release:
+
+  * ``GET /api/v1/status``
+  * ``GET /api/v1/auth-tokens/:auth_device/:token_value``
+  * ``POST /api/v1/cancel-drink``
+  * ``GET|POST /api/v1/controllers``
+  * ``GET /api/v1/events``
+  * ``GET|POST /api/v1/flow-meters``
+  * ``GET|POST /api/v1/taps``
+  * ``GET|POST /api/v1/taps/:meter_name_or_id``
+  * ``GET|POST /api/v1/thermo-sensors/:sensor_name``
+
 * The old Kegbot mobile apps depended on now-retired API endpoints (device
   linking, registration, drink lists) and no longer work against this
   server.