RTSP

RTSP, the Real-Time Streaming Protocol, is an application-layer control protocol for setting up and steering streaming media sessions between a client and a server. It was designed to be the “network remote control” for audio and video: RTSP itself carries the commands — SETUP, PLAY, PAUSE, TEARDOWN — while the actual media typically flows over a separate transport such as RTP. First standardized as RFC 2326 in 1998 and later revised as RFC 7826, it remains the workhorse control plane for IP cameras and surveillance systems.

• Session control, not media transport - RTSP negotiates and controls a stream; the media bytes ride over RTP/RTCP or another transport chosen during setup.
• VCR-style verbs - A small, HTTP-like set of methods (SETUP, PLAY, PAUSE, RECORD, TEARDOWN) gives clients familiar playback control over live or stored media.
• Stateful sessions - Unlike stateless REST, an RTSP server tracks session state across requests, which is what makes true pause-and-resume streaming possible.
• Text-based and HTTP-adjacent - Its request/response syntax deliberately mirrors HTTP, making it approachable to anyone who already reads HTTP traffic.

In practice RTSP shows up far more in the physical-infrastructure corner of the API economy than in the web-API mainstream — nearly every IP camera, NVR, and video-surveillance platform speaks it, and vendors wrap it behind REST or WebRTC gateways for browser and mobile consumption. That gateway pattern is where governance matters: RTSP endpoints are notoriously exposed and under-secured, so treating the RTSP layer as a first-class, access-controlled API surface — not an afterthought behind the “real” API — is the practical lesson for anyone operating streaming infrastructure.