🚧 WIP

README.md

@@ -95,6 +95,8 @@ Authentication: pass one of the configured app tokens either as the `X-App-Token
 | `GET /health` | none | Liveness probe (public) |
 | `GET /messages/count` | token | Total number of stored messages |
 | `GET /messages` | token | List messages, newest first. Query parameters: `imei`, `device` (exact-match filters), `from`/`to` (ISO 8601 range on `received_at` — server receipt time; inclusive; naive values treated as UTC), `payload_from`/`payload_to` (same but on `payload_time` — the device timestamp extracted from the JSON; messages without one are excluded; ordering switches to `payload_time DESC`), `limit` (default 100, capped at `API_MAX_LIMIT`), `offset` for paging. Reversed ranges return 422 |
+| `GET /configs/{name}` | token | Read a config file's content as JSON. `name`: `app_tokens` or `imei_map` |
+| `PUT/POST /configs/{name}` | token | Replace a config file's content. Body **must be a JSON object**; per-config schema is validated (imei_map keys must be 15-digit IMEIs; app_tokens must keep the `{"tokens": {name: secret}}` shape). Invalid payloads → 422, unknown names → 404. Writes are atomic. Updating `app_tokens` takes effect immediately; updating `imei_map` is picked up by the listener within ~5 seconds |
 | `GET /docs`, `GET /redoc` | none | OpenAPI docs (public) |
 
 Example — everything device `Water tank sensor B` reported on August 31st, by device clock:
@@ -103,6 +105,24 @@ Example — everything device `Water tank sensor B` reported on August 31st, by
 GET /messages?device=Water%20tank%20sensor%20B&payload_from=2026-08-31T00:00:00Z&payload_to=2026-08-31T23:59:59Z
 ```
 
+### Managing config files through the API
+
+The two JSON config files can be read and replaced over HTTP (authenticated like all other endpoints). This is how to add a device or rotate a token without touching the host filesystem:
+
+```bash
+# read the current IMEI map
+TOKEN='replace-me-with-a-long-random-secret-1'
+curl -H "X-App-Token: $TOKEN" http://localhost:18080/configs/imei_map
+
+# replace it (JSON object only; keys must be 15-digit IMEIs)
+curl -X PUT -H "X-App-Token: $TOKEN" -H "Content-Type: application/json" \
+  -d '{"350123456789012": "Greenhouse sensor A", "490154203237518": "Water tank sensor B"}' \
+  http://localhost:18080/configs/imei_map
+```
+
+- `app_tokens`: `{"tokens": {"app-name": "secret"}}` — after an update the API re-authenticates with the **new** tokens immediately.
+- `imei_map`: `{"<15-digit-IMEI>": "<device name>"}` — the listener picks the change up within ~5 seconds (periodic reload); a temporarily invalid file on disk never breaks ingestion (the last good mapping stays in effect).
+
 Example response:
 
 ```json