AXIS OS 13 doesn't warn you. It rolls back.

Point it at your Axis cameras and it tells you which ones will survive the upgrade — before you start it. Read-only. No agent, nothing installed on the camera.

Is your camera affected?

Type a model. Answered in your browser from rules.json — nothing is sent anywhere, and this page never asks for a camera, an address or a password.

579 models, matched by chipset — which is what decides the architecture, and therefore the answer Axis's own 58-model list gets wrong for some cameras. Chipset data from CamStreamer's supported-cameras list.

“If a re-installation of an ACAP results in an error… AXIS OS will initiate a rollback.”

“Compatibility field with AXIS OS major versions now mandatory in manifest.”
— Axis, upcoming breaking changes

Preflight ACAP · v1.4.9, signed

Install it on one camera. Buy Pavel a Ko-fi and it checks the whole network.

Add it through the camera's own Apps page. It finds every camera on that network and answers per device: will upgrade, will roll back, or cannot be determined — and names the applications responsible.

Download Preflight ACAP App →How it works ↓

9Tier A rules 14Tier B rules 41Tier C rules 42028 items 5932-bit models 3.2.0ruleset · 2026-10-29

01 · The rules

68 documented breaking changes, sorted by what they cost you

Click a rule to open its impact, detection method and Axis source. Filter by tier or AXIS OS version, or search for a parameter, CGI or model.

Tier

Tier A Blocks or rolls back the upgrade 9

The upgrade does not warn you and proceed. It fails and the device rolls back to the previous AXIS OS.

ACAP manifest compatibility declaration is mandatory

OS 13.0

Every installed ACAP must declare which AXIS OS major versions it is compatible with. An application without the declaration is treated as incompatible.

What it does to you. The upgrade fails and the device rolls back. Axis's own guidance is that the user must remove the application before upgrading.

Detection One call: axis-cgi/applications/list.cgi. On AXIS OS 12.11 each <application> carries <CompatibleOsVersions><VersionRange><Min>..</Min><Max>..</Max></VersionRange>. Flag any application whose element is absent, or whose Max is below 13. No manifest fetch, no .eap. vapix-param verified

Axis source ↗

Rollback on ACAP re-installation failure during upgrade

OS 13.0the one that matters

During the OS upgrade every installed ACAP is re-installed. If any one of them errors, AXIS OS initiates a rollback of the whole upgrade.

What it does to you. This is the rule the product exists for. One stale application on one camera reverts that camera, with no per-camera explanation of which application caused it.

Detection Composite over A1, A4, A5 and A7. Now cheap: A1 and A4 come from one list.cgi response, A5 from one parameter read. acap-manifest designed

Axis source ↗

ACAP manifest schema v2 enforced; package.conf removed

OS 13.0

Applications must use manifest schema v2 to declare their access rights. package.conf is no longer supported — those applications are handled by an older ACAP framework that is gone. Applications are restricted to running as their own dynamically created user or as the sdk user. Access is limited to a predefined set of system groups and to the D-Bus methods the official ACAP APIs require.

What it does to you. A pre-schema-v2 or package.conf application will not re-install, which triggers A2.

Detection Manifest schema version is NOT exposed by list.cgi, and no read-only manifest endpoint responded on either bench unit. Still needs the .eap. A missing CompatibleOsVersions element on modern firmware is suggestive but not proof. acap-manifest open blocked by Q2

Axis source ↗

Unsigned ACAPs no longer permitted

OS 13.0

Only signed ACAP applications are accepted. The AllowUnsigned escape hatch is removed. Applications installed before AXIS OS 12.8 must be reinstalled on AXIS OS 12.8 or later before upgrading to AXIS OS 13: their signature status was not persisted at install time, so AXIS OS 12.11 can show them as unsigned even when they were signed.

What it does to you. Any unsigned application currently running on a camera that had AllowUnsigned set will fail re-installation, which triggers A2.

Removed/axis-cgi/applications/config.cgi?action=set&name=AllowUnsigned

Detection SignatureStatus attribute per application in list.cgi. "Signed" passes; "Unknown" or "Unsigned" is a rollback candidate. "Unknown" also covers signed applications installed before AXIS OS 12.8 — the fix for those is a reinstall on 12.8 or later, not a new build. vapix-param verified

Axis recommends going through an AXIS OS 12 LTS release (version still to be announced), reinstalling existing applications and redoing their configuration there, then upgrading to AXIS OS 13. For development only, unsigned applications run through Axis's Developer Mode application; turning Developer Mode off uninstalls every unsigned application and its SSH user. Signed applications are still required in production. Source: the AXIS OS 13.0 release notes.

Axis source ↗

Y2038 — 64-bit time_t ABI break on 32-bit products

OS 13.0

AXIS OS 13 moves to 64-bit time_t and 64-bit time APIs in glibc and the kernel. On 32-bit products this is an ABI break: ACAP applications and internal services must be recompiled.

What it does to you. On the listed models, any ACAP not rebuilt against the new ABI must be removed before the upgrade or the device rolls back. A 32-bit product NOT on this list does not receive AXIS OS 13 at all — see A9.

59 affected models

AXIS A1210AXIS A1210-BAXIS A1214AXIS A1610AXIS A1610-BAXIS A1710-BAXIS A1711AXIS A1810-BAXIS A1811AXIS A9210AXIS C1210-EAXIS C1211-EAXIS C1510AXIS C1511AXIS C1610-VEAXIS C8110AXIS C8210D201-S XPT Q6075EXCAM XPT Q6075AXIS F9104-BAXIS F9111AXIS F9114AXIS F9114-BAXIS I8016-LVEAXIS M3057-PLR MK IIAXIS M4215-LVAXIS M5000AXIS M5000-GAXIS M5074AXIS M5075AXIS M5075-GAXIS M7104AXIS M7116AXIS P3818-PVEAXIS P3925-LREAXIS P3925-RAXIS P3935-LRAXIS P5654-EAXIS P5654-E MK IIAXIS P5655-EAXIS P5676-LEAXIS P7304AXIS P7316AXIS Q6074AXIS Q6074-EAXIS Q6075AXIS Q6075-EAXIS Q6075-SAXIS Q6075-SEAXIS Q6078-EAXIS Q6135-LEAXIS Q6225-LEAXIS Q6315-LEAXIS Q6318-LEAXIS Q8615-EAXIS Q8752-EAXIS Q8752-E MK IIAXIS V5925AXIS V5938

Detection Read Properties.System.Architecture. aarch64 is not exposed to the Y2038 ABI break. armv7hf is — but only matters if the product actually receives AXIS OS 13, so cross-check the model against models32bit below (Axis's published list of 32-bit products that will get AXIS OS 13). A 32-bit product absent from that list has no AXIS OS 13 at all and is rule A9, not this one. vapix-param verified

Axis source ↗

Install and uninstall script rules tightened

OS 13.0

Scripts must have executable permission, must complete within 5 minutes, shell scripts must start with #!/bin/sh, umask is set to 022, and a non-zero exit from the post-install script fails the installation.

What it does to you. A script that used to pass sloppily now fails the re-installation, which triggers A2.

Detection Static inspection of the .eap where the package is obtainable. Not detectable from a running camera. eap-binary open

ACAP installation and execution on SD card no longer supported

OS 13.0

Support for installing and running ACAP applications from the SD card is removed entirely.

What it does to you. An SD-card-resident application will not come back after the upgrade, and its re-installation failure triggers A2.

Detection Read install location per application from the application list. vapix-param designed

Axis source ↗

DLPU usage must be declared in the ACAP manifest

OS 13.0

An application using the deep-learning processing unit must declare that use in its manifest.

What it does to you. An undeclared analytics application is a re-installation risk, and a rollback candidate under A2.

Detection list.cgi returns <Resources><Resource name="DeepLearningProcessor" used="Yes|No"/></Resources> per application. Compare the declaration against actual DLPU use. vapix-param verified

Axis source ↗

No AXIS OS 13 for this hardware

OS 13.0

AXIS OS 13 does not exist for every camera. Axis states that AXIS OS 13 will not support ARTPEC-6 products, and publishes the list of 32-bit products that will receive it (see A5 models32bit). A 32-bit camera absent from that list has no AXIS OS 13 upgrade to prepare for.

What it does to you. This changes what the owner does, not how carefully they do it. No application work, vendor build or configuration change makes AXIS OS 13 available on this hardware: the camera runs its current firmware until it is replaced. Reported separately from the rollback cases so that a fleet splits into work to schedule and hardware to budget for.

Detection Properties.System.Architecture is 32-bit (armv7hf), Brand.ProdNbr is not in A5's models32bit, AND Properties.Firmware.Version is still on AXIS OS 10. Matching on the model is exact, not a prefix — a prefix match would clear a variant Axis never listed. vapix-param verified

This is the one rule in the set whose false positive costs money rather than time: telling an owner their cameras cannot be upgraded when they can invites a replacement they do not need. It therefore reports 'no published upgrade path', names its source, and tells the reader to confirm with Axis — the opposite of every other rule here, which errs toward 'unverified' because a false all-clear is the expensive error there. Absence from the published list is deliberately not sufficient on its own: that list omits large ARTPEC-7 families such as the P1375 and P3245, and ARTPEC-7 is not the generation Axis says is unsupported. The firmware track is what settles it — an ARTPEC-7 product has been offered AXIS OS 11 and 12, while an ARTPEC-6 product is capped on the 10.12 LTS track, so a 32-bit camera absent from the list and still on AXIS OS 10 was never offered AXIS OS 11 either. A camera on 11.x or 12.x that is absent from the list is reported as unknown, never as stranded.

Axis source ↗

Tier B Silently breaks an app after a successful upgrade 14

The camera comes up on OS 13. The application on it does not work, or crashes.

.larod model format removed — .tflite only

OS 13.0

The .larod model container is gone. Models must be .tflite.

What it does to you. An analytics application shipping .larod models installs but cannot load its model.

Detection Inspect model files inside the analytics ACAP. eap-binary open

Axis source ↗

larod API versions 1 and 2 removed — v3 only

OS 13.0

Only larod version 3 is supported. Applications on v1 or v2 must be migrated.

What it does to you. Inference fails at runtime after an otherwise clean upgrade.

Detection Inspect the application's larod linkage or SDK version. eap-binary open

Axis source ↗

Prevent stack execution

OS 13.0

A process with an executable stack crashes immediately with a segmentation fault.

What it does to you. The application installs and then dies on start. Hardest failure in the set to attribute, because nothing in the logs points at the cause.

Detection Read the GNU_STACK program header of the application's binaries. Requires the .eap; not obtainable read-only from a camera. eap-binary open

Axis source ↗

Message-Broker removed, replaced by the device data hub API

OS 13.0

The message-broker interface is gone. The replacement device data hub API is available from ACAP SDK 12.10.

What it does to you. Applications publishing or subscribing over message-broker lose their event path silently.

Detection Detect message-broker usage in the package; alternatively maintain a known-app list. eap-binary open

Axis source ↗

AXIS Motion Guard, Fence Guard and Loitering Guard removed

OS 13.0

The three guard applications are removed. AXIS Object Analytics is the replacement.

What it does to you. Two failures at once: the analytic stops, and anything subscribing to its VAPIX events or endpoints stops with it.

Detection Match installed application names against the removed set. vapix-param designed

Axis source ↗

AXIS Removed Object Detection removed

OS 13.0

The application is removed from AXIS OS 13.

What it does to you. Same shape as B5 — analytic and its event consumers both stop.

Detection Match installed application names. vapix-param designed

Axis source ↗

Camera Tampering detector removed

OS 13.0

The MotionRegionDetector / Motion tampering event is removed. AXIS Image Health Analytics is the replacement.

What it does to you. Event rules and VMS triggers bound to the tampering event stop firing.

Detection Read the configured event rules and flag any bound to the removed detector. vapix-param designed

Axis source ↗

Deprecated VDO functions removed

OS 13.0

vdo_frame_get_is_last_buffer, vdo_frame_get_fd and vdo_frame_get_opaque are removed. Crop settings, deprecated since 11.11, are no longer available to ACAPs.

What it does to you. Video-pipeline applications built against the old functions fail to run.

Removedvdo_frame_get_is_last_buffer vdo_frame_get_fd vdo_frame_get_opaque

Detection Symbol inspection of the application binary. eap-binary open

Axis source ↗

VDO_TIMESTAMP uint16_t support removed

OS 13.0

Only uint32_t is supported for VDO_TIMESTAMP.

What it does to you. Timestamp handling breaks in applications still using the 16-bit form.

Detection Source or binary inspection. Practically a rebuild-advisory rather than a detection. eap-binary open

Axis source ↗

B10

Overlay enums removed from the VDO ACAP API

OS 13.0

The overlay enumerations are removed from the VDO ACAP API.

What it does to you. Overlay-drawing applications built against them fail to compile or run.

Detection Source or binary inspection. eap-binary open

Axis source ↗

B11

Loopback interfaces reduced from 12 to 3

OS 13.0

Only 127.0.0.1, 127.0.0.4 and 127.0.0.12 remain.

What it does to you. An ACAP binding any other loopback address fails to bind after the upgrade.

Detection Configuration or binary inspection for hardcoded loopback addresses. eap-binary open

Axis source ↗

B12

Root privileges for ACAP applications removed

OS 12.0

Root-privileged access for ACAP applications was removed indefinitely, with no way to re-enable it.

What it does to you. Applications that need root do not work. This includes on-camera VPN clients — Tailscale, ZeroTier, WireGuard, OpenVPN, IPsec — which are the usual real-world casualties.

Detection Manifest privilege level, plus a known-app list for the VPN cases. acap-manifest designed

Already in force since AXIS OS 12.0. A fleet still on 11.x meets this and everything in 13 at the same time.

Axis source ↗

B13

OpenSSL 1.1.1 support removed

OS 12.0

Applications must link OpenSSL 3.x.

What it does to you. TLS calls from the application fail.

Detection Linked OpenSSL version in the package. eap-binary open

Axis source ↗

B14

Computer Vision SDK and host container support removed

OS 13.0

The Computer Vision SDK is no longer supported. ACAP applications can no longer request support from the host system for running containers.

What it does to you. Applications built on the Computer Vision SDK, or that rely on the host to run their workload in containers, stop working.

Detection Look for a manifest or package that requests host container support or depends on the Computer Vision SDK. Approach not settled; may need the .eap. acap-manifest open

Listed in the AXIS OS 13.0 release notes, not on the Changes in AXIS OS 13 page. Axis does not say whether an affected application fails to re-install (which would make it Tier A) or installs and fails at runtime.

Axis source ↗

Tier C Breaks your integration, not the camera 41

The camera is fine. Your VMS, middleware, or script calling it is not.

C24

Password complexity enforcement — and it cannot be disabled

OS 13.0

Password complexity enforcement is enabled by default for new and edited accounts created via SSH, VAPIX, ONVIF and SNMP, and it applies to the web interface too. Profile 1 requires 15 characters; Profile 2 requires 12 characters plus numbers, capitals and specials. Axis states the behaviour cannot be disabled.

What it does to you. This is the rule that breaks automated onboarding. Middleware or a VMS that provisions cameras with a standard non-compliant service password fails at the account-creation step — on every new or reset device, every time, with no switch to turn off. Existing accounts are the quiet half: they are not re-validated and keep working, so the failure only shows up on new and reset devices, which is exactly where an integrator is least likely to be watching. Axis is explicit that existing accounts need adjusting manually.

Detection Not detectable on the camera — the exposure is in the provisioning side. The useful check is whether the onboarding script or VMS pushes a password meeting the 15-character or 12-character-plus-complexity profile. Worth reporting per camera which profile the device is set to. client-side open

Ordered first in Tier C because it has the widest blast radius of anything here for anyone who onboards cameras programmatically. It is not a camera failure, which is why it sits in C rather than A.

Axis source ↗

HTTPS-only becomes the factory default; HTTP port 80 disabled

OS 13.0

System.BoaGroupPolicy.admin, .operator and .viewer move from both to https. Port 80 is disabled by default after a factory reset.

What it does to you. Middleware, scripts and VMS integrations calling http:// stop working. Note the wording carefully: this is the factory-default state, so an upgraded device that keeps its configuration is not necessarily affected — a reset one is.

ChangesSystem.BoaGroupPolicy.admin both → https
System.BoaGroupPolicy.operator both → https
System.BoaGroupPolicy.viewer both → https

Detection Read System.BoaGroupPolicy.admin/.operator/.viewer. vapix-param verified

Axis source ↗

Basic authentication for HTTPS connections

OS 12.1

AXIS OS 12.1 introduced a new authentication policy mode, described by Axis as “Recommended”, which uses basic authentication over HTTPS.

What it does to you. Clients hardcoded to digest may need to change. Whether digest stops working depends on which policy the device is actually set to.

Detection Read Network.HTTP.AuthenticationPolicy. Observed: recommended (12.11) and basic (10.12). Confirm by attempting digest and basic and reporting which the device accepts. vapix-param verified

Correction. The plan said digest-over-HTTPS stops working by default from 12.1; ruleset 2.x softened that to 'the source doesn't say so'. Bench evidence lands between the two: on Q1656/12.11.77 (policy=recommended) and M1137/10.12.300 (policy=basic), digest returned 401 and basic-over-HTTPS returned 200. Digest is refused in practice under both policies observed — the plan's instinct was right, but the mechanism is the AuthenticationPolicy parameter, not a blanket 12.1 default change. A client hardcoded to digest fails today, before OS 13.

Axis source ↗

Signed Video enabled by default

OS 13.0

Image.I0.MPEG.SignedVideo.Enabled changes from no to yes.

What it does to you. Axis notes a slight bitrate increase in specific situations. A storage and bandwidth planning item, not a failure.

ChangesImage.I0.MPEG.SignedVideo.Enabled no → yes

Detection Read Image.I0.MPEG.SignedVideo.Enabled. Absent on older firmware — treat absence as not-applicable, not as 'no'. vapix-param verified

Axis source ↗

UPnP discovery removed

OS 13.0

Network.UPnP.Enabled is removed. UPnP was already disabled by default in 12.1.

What it does to you. Discovery tooling that finds cameras over UPnP stops finding them.

RemovedNetwork.UPnP.Enabled

Detection Read Network.UPnP.Enabled; absence means already removed. vapix-param verified

Axis source ↗

Recording system rewritten

OS 13.0

Recording IDs are capped at 24 hours with a 1 hour default and a continuous sequence now spans multiple IDs. record/list.cgi returns more IDs. exportrecording.cgi is extended for trailing IDs. H.264 header timestamps are not implemented in the new system. Ongoing recordings cannot be removed directly — they must be stopped first. Recording files moved to a new on-disk location with a new naming scheme. RTSP failoverrecordinglength is ignored, and RTSP GET_PARAMETER Failover-Recording-ID now returns 451. EstimatedFileSize is removed from the export API. Object Store Recording (OSR) is now the default for recordings. The Content-Base header in the RTSP DESCRIBE response for Edge recordings changed from the .../record/play.amp path to .../media.amp.

What it does to you. The largest single item on the page for anyone with a recording integration. Several independent ways to break at once.

Changedaxis-cgi/record/list.cgi axis-cgi/record/export/exportrecording.cgi

Detection Cannot be detected on the camera. Exposure lives in whatever calls the recording APIs. client-side open

The Content-Base change also shipped in AXIS OS 12.11.147, so LTS 2026 fleets meet it before OS 13. The OSR default and the Content-Base change are listed in the release notes, not on the Changes in AXIS OS 13 page.

Axis source ↗

record.cgi and stop.cgi removed

OS 13.0

Replaced by the event system recording, or record/continuous/addconfiguration.cgi.

What it does to you. Any script starting or stopping a recording directly stops working.

Removedrecord.cgi stop.cgi

Detection Not on-camera. Grep your own integration. client-side open

Axis source ↗

StreamCache.Size removed on non-video products

OS 13.0

root.StreamCache.Size is removed on the listed non-video products.

What it does to you. Configuration tooling touching the parameter on these models errors.

Removedroot.StreamCache.Size

21 affected models

AXIS A1210AXIS A1610AXIS A9210AXIS C1110-EAXIS C1111-EAXIS C1210-EAXIS C1211-EAXIS C1310-E Mk IIAXIS C1410 Mk IIAXIS C1510AXIS C1511AXIS C1610-VEAXIS C1710AXIS C1720AXIS C6110AXIS C8110AXIS C8210AXIS D3110 Mk IIAXIS D4100-VE Mk IIAXIS D4200-VEAXIS XC1311-E

Detection Model list lookup, same shape as A5. model-list designed

Axis source ↗

Bulk VAPIX parameter removals — SNMP

OS 13.0

The legacy SNMP parameter group is removed.

What it does to you. SNMP configuration through param.cgi stops working. Configure via the current API instead.

RemovedSNMP.DSCP SNMP.Enabled SNMP.EngineBoots SNMP.InitialUserPasswd SNMP.InitialUserPasswdSet SNMP.TransportProtocol SNMP.V1 SNMP.V1ReadCommunity SNMP.V1WriteCommunity SNMP.V2c SNMP.V3 SNMP.NTCIP.Enabled SNMP.Trap.Enabled SNMP.Trap.T0.Address SNMP.Trap.T0.Community SNMP.Trap.T0.AuthFail.Enabled SNMP.Trap.T0.ColdStart.Enabled SNMP.Trap.T0.LinkUp.Enabled SNMP.Trap.T0.WarmStart.Enabled

Detection Report which of the removed parameters are currently set to a non-default value — those are the ones somebody is actually using. vapix-param designed

Axis source ↗

Bulk VAPIX parameter removals — Layout

OS 13.0

The Layout parameter group is removed.

What it does to you. Low real-world exposure. Most integrators never touch these.

RemovedLayout.ViewerIE Layout.ViewerOther Layout.PlainConfigEnabled Layout.H264InstallationEnabled Layout.AACInstallationEnabled Layout.EnableBasicSetup Layout.ShowVideoFormatDropDown Layout.DefaultStreamProfile Layout.ShowPaletteSelector Layout.ShowRelCrossEnabled Layout.DefaultJoystickMode

Detection Same non-default-value approach as C8. vapix-param designed

Axis source ↗

C10

Bulk VAPIX parameter removals — Storage group

OS 13.0

Only DiskID, Enabled, ExtraMountOptions, FriendlyName and MountOnBoot remain in the Storage.Sn group.

What it does to you. Storage provisioning scripts that set the removed parameters error out.

RemovedStorage.MountDir Storage.Sn.AutoRepair Storage.Sn.CleanupLevel Storage.Sn.CleanupMaxAge Storage.Sn.CleanupPolicyActive Storage.Sn.DeviceNode Storage.Sn.FileSystem Storage.Sn.Locked Storage.Sn.MountPointPermissions

RetainedStorage.Sn.DiskID Storage.Sn.Enabled Storage.Sn.ExtraMountOptions Storage.Sn.FriendlyName Storage.Sn.MountOnBoot

Detection Report removed parameters currently at non-default values. vapix-param designed

Axis source ↗

C11

Bulk VAPIX parameter removals — legacy streaming

OS 13.0

A set of legacy image and streaming parameters is removed.

What it does to you. Stream-profile provisioning scripts break.

RemovedImage.RFCCompliantMulticastEnabled Image.ReferrersEnabled Image.Referrers Image.IX.MaxFrameSize Image.IX.MPEG.ConfigHeaderInterval Image.IX.MPEG.ICount Image.IX.MPEG.Complexity Audio.DSCP Network.RTSP.AuthenticateOverHTTP

Detection Report removed parameters currently at non-default values. vapix-param designed

Axis source ↗

C12

Bulk VAPIX parameter removals — time and privacy mask

OS 13.0

Time.POSIXTimeZone and Time.DST.Enabled are removed. Image.PrivacyMaskType is removed, replaced by root.Properties.PrivacyMask.PrivacyMask.

What it does to you. Time provisioning and privacy-mask configuration scripts break.

RemovedTime.POSIXTimeZone Time.DST.Enabled Image.PrivacyMaskType

Detection Report removed parameters currently at non-default values. vapix-param designed

Axis source ↗

C13

Legacy image rotation parameters removed

OS 13.0

Image.I#.Appearance.Rotation and Image.I#.Appearance.AutoRotationEnabled are removed, replaced by ImageSource.I#.Rotation. ImageSource.I#.SourceRotation now reports yes on all supported products.

What it does to you. Rotation is a common provisioning step, which makes this a more likely break than most of the bulk removals.

RemovedImage.I#.Appearance.Rotation Image.I#.Appearance.AutoRotationEnabled

Detection Report the removed parameters and their current values. vapix-param designed

Axis source ↗

C14

HTTP network authentication parameters removed

OS 13.0

Network.HTTP.AuthenticationPolicy and Network.HTTP.AuthenticationWithQop are removed, replaced by the Virtual Host VAPIX API. RTSP and RTSPS authentication modes are hardcoded.

What it does to you. Authentication provisioning has to move to the new API.

RemovedNetwork.HTTP.AuthenticationPolicy Network.HTTP.AuthenticationWithQop

Detection Report the parameters and their current values. vapix-param designed

Axis source ↗

C15

RTSP tunnelled over HTTP(S) authentication defaults flip

OS 13.0

System.HTTPAuthRTSPOverHTTP moves from no to yes and Network.RTSP.AuthenticateRTSPOverHTTP from yes to no.

What it does to you. Clients tunnelling RTSP over HTTP need to authenticate differently.

ChangesSystem.HTTPAuthRTSPOverHTTP no → yes
Network.RTSP.AuthenticateRTSPOverHTTP yes → no

Detection Read both parameters and report current values. vapix-param designed

Axis source ↗

C16

PTZ parameter and endpoint removals

OS 13.0

PTZ.Support.S#.JoyStickEmulation and PTZ.Support.S#.GenericHTTP are removed. PTZ.Various.V#.HomePresetSet is removed, replaced by PTZ.Preset.HomePosition. ptzcoordcalc.cgi is removed. The PTZ-Autotracking 2.x legacy .fcgi URLs move to /axis-cgi/ptz-autotracking/*.cgi.

What it does to you. PTZ integrations and autotracking clients break in several small ways at once.

RemovedPTZ.Support.S#.JoyStickEmulation PTZ.Support.S#.GenericHTTP PTZ.Various.V#.HomePresetSet

Removedaxis-cgi/ptzcoordcalc.cgi /local/axis-ptz-autotracking/settings.fcgi /local/axis-ptz-autotracking/operator.fcgi /local/axis-ptz-autotracking/viewer.fcgi

Detection Read the removed PTZ parameters; report presence of the autotracking application. vapix-param designed

Axis source ↗

C17

best-snapshot renamed to object-snapshot

OS 13.0

/config/rest/best-snapshot becomes /config/rest/object-snapshot.

What it does to you. A pure rename, which makes it a silent client failure — nothing on the camera looks wrong.

Detection Not on-camera. Grep your integration for the old path. client-side open

Axis source ↗

C18

VDO stream info statistics fields removed

OS 13.0

The statistics.* fields are removed from VDO stream info.

What it does to you. Monitoring and dashboard code reading per-stream statistics loses its input.

Removedstatistics.duration statistics.framerate statistics.bitrate statistics.frame_count statistics.idrframe_count statistics.bit_count statistics.failed_frames statistics.accumulated_bytes statistics.accumulated_idrbytes

Detection Not on-camera. client-side open

Axis source ↗

C19

File upload VAPIX API removed

OS 13.0

upload_file.cgi, local_del.cgi, local_list.cgi and file_upload.cgi are removed.

What it does to you. Any tooling pushing files onto the camera over these endpoints stops.

Removedupload_file.cgi local_del.cgi local_list.cgi file_upload.cgi

Detection Not on-camera. client-side open

Axis source ↗

C20

receive.cgi updated for HTTP/1.1 compliance

OS 13.0

Data is now sent as a sequence of length-delimited buffers, response headers are updated, and Transfer-Encoding: chunked is implemented.

What it does to you. Parsers written against the old response shape break.

Detection Not on-camera. client-side open

Axis source ↗

C21

Media Clip and Audio Mixer API changes

OS 13.0

The audiooutput parameter is removed from the Media Clip API, replaced by audiodeviceid and audioouputid. The tenBandGraphicDspEqualizer audio mixer plugin is replaced by tenBandGraphicEqualizer.

What it does to you. Audio integration calls need updating.

Removedaudiooutput

Detection Not on-camera. client-side open

Axis source ↗

C22

View Area API behaviour change

OS 13.0

View areas no longer synchronise with the digital PTZ home position, and the behaviour of root.PTZ.Various.V2.Locked is modified.

What it does to you. Multi-view-area setups behave differently after the upgrade. Nothing errors.

Detection Behavioural. Report as an advisory on cameras with more than one view area. none designed

Axis source ↗

C23

Unofficial SSH v1 management API removed

OS 13.0

Only version 2 of the SSH Management API is supported.

What it does to you. Provisioning scripts using the v1 API break.

Detection Not on-camera. client-side open

Axis source ↗

C25

OS image file compression changed from gzip to zstd

OS 13.0

AXIS OS image files use zstd compression.

What it does to you. External tooling that unpacks or parses firmware images needs adapting.

Detection Informational. none designed

Axis source ↗

C26

PTZ continuous pan stops after 10 minutes

OS 13.0

A PTZ camera no longer pans indefinitely; continuous pan stops automatically after 10 minutes.

What it does to you. Guard-tour and continuous-scan setups change behaviour. Nothing errors, which is what makes it easy to miss.

Detection Behavioural. Advisory on PTZ models. none designed

Axis source ↗

C27

TLS 1.0 and 1.1 removed for SIP communication

OS 12.10

In the factory-default state, TLS 1.0/1.1 SIP communication is no longer supported. Already in force since 12.10.

What it does to you. Legacy SIP endpoints fail to negotiate.

Detection Report SIP configuration where present. vapix-param open

Axis source ↗

vFAT removed

OS 12.1already in force

SD cards were delivered with vFAT as the standard file system; it is no longer used.

Detection Read the SD card file system. vapix-param designed

Axis source ↗

UPnP discovery disabled by default

OS 12.1already in force

root.Network.UPnP.Enabled defaults to disabled. Fully removed in 13 — see C4.

Detection Read the parameter. vapix-param designed

Old web interface (Web Version B) removed

OS 12.0already in force

The legacy web interface is gone.

Detection Informational. none designed

Axis source ↗

HTTP port 80 redirects disabled

OS 12.0already in force

Redirects from port 80 no longer happen. See C1 for the 13.0 escalation.

Detection Covered by the C1 probe. vapix-param designed

TLS 1.0 and 1.1 removed for HTTPS

OS 12.0already in force

root.HTTPS.AllowTLS1 and root.HTTPS.AllowTLS11 are removed.

Removedroot.HTTPS.AllowTLS1 root.HTTPS.AllowTLS11

Detection Report presence of the parameters. vapix-param designed

Axis source ↗

Default IP 192.168.0.90/24 removed

OS 12.0already in force

The fixed default IP is gone and link-local address behaviour changed.

Detection Informational — affects out-of-box provisioning workflows. none designed

Axis source ↗

WS-Discovery disabled

OS 12.0already in force

WebService.DiscoveryMode.Discoverable defaults to disabled.

Detection Read the parameter. vapix-param designed

Axis source ↗

Basic Device Info VAPIX API can be disabled

OS 12.0already in force

The API can now be turned off, which discovery tooling must tolerate.

Detection Probe the endpoint and handle a disabled response. vapix-param designed

Axis source ↗

releaseinfo.cgi removed

OS 12.0already in force

axis-release/releaseinfo.cgi is gone.

Removedaxis-release/releaseinfo.cgi

Detection Not on-camera. client-side open

Axis source ↗

L10

getbrand.cgi removed

OS 12.0already in force

axis-cgi/prod_brand_info/getbrand.cgi is gone.

Removedaxis-cgi/prod_brand_info/getbrand.cgi

Detection Not on-camera. client-side open

Axis source ↗

L11

Network Filter API removed

OS 12.0already in force

The Network.Filter parameter group is removed.

RemovedNetwork.Filter.Enabled Network.Filter.Input.AcceptAddresses Network.Filter.Input.Policy Network.Filter.Log.Enabled

Detection Report presence and value. vapix-param designed

Axis source ↗

L12

SMB 1.0 and 2.0 support removed

OS 12.0already in force

Network share recording over SMB 1 or 2 no longer works.

Detection Read the configured network share settings. vapix-param open

Axis source ↗

L13

Signed ACAP applications introduced

OS 12.0already in force

Signing was introduced with AllowUnsigned as the escape hatch. AXIS OS 13 removes the escape hatch — see A4.

Detection Covered by the A4 probe. vapix-param designed

ACAP post-install exit code EX_NOPERM aborts installation

OS 12.0already in force

A post-install script exiting 77 aborts the installation. AXIS OS 13 tightens this further — see A6.

Detection Static inspection of the package. eap-binary open

2028 Already dated — the 2028 wave 4

AXIS OS 14, September 2028. Nothing to do today. Worth knowing it is coming.

Unofficial certificate management APIs removed

OS 14.0

/axis-cgi/certappmgmt.cgi and /axis-cgi/certmgmt.cgi are removed in AXIS OS 14, September 2028.

Removed/axis-cgi/certappmgmt.cgi /axis-cgi/certmgmt.cgi

Detection Dated. Listed so it is on your radar, not detected. none open

Axis source ↗

time.cgi removed

OS 14.0

The time.cgi VAPIX API is removed in AXIS OS 14.

Removedaxis-cgi/time.cgi

Detection Dated. none open

Axis source ↗

axhttp library removed for ACAP applications

OS 14.0

The axhttp library goes, and the manifest schema removes the transferCgi option.

Detection Dated. A rebuild advisory for anyone still on transferCgi. none open

Axis source ↗

SMB support removed for S30 and S40 series

OS 14.0

SMB goes entirely on the S30 and S40 recorders in AXIS OS 14.

Detection Dated. Model list lookup when the time comes. model-list open

Axis source ↗

02 · The scanner

Install it on one camera. Buy Pavel a Ko-fi and it checks the whole network.

The upgrade does not warn you and then proceed — it fails and reverts the camera, because of one application somebody installed years ago. With four hundred cameras you find this out one camera at a time, at night, in a maintenance window, with nothing telling you which application did it.

An ACAP you add through the camera's own Apps page — no laptop, no terminal, nothing to set up. It finds every camera on that network and answers one question per device: will upgrade, will roll back, or cannot be determined. For the ones that roll back, it names the applications responsible.

Released — signed by Axis, free to install. The camera it is installed on is checked in full, free. The other cameras it scans are the paid part: a €5 licence key. Without a key the scan stops at 5 cameras. ARTPEC-8/9 (aarch64) and ARTPEC-6/7 (armv7hf) packages.

Download Preflight ACAP App →

Read-only against every camera it touches: it reads the installed-application list and a handful of parameters, the same calls any Axis management tool makes. Nothing is written, nothing is installed on the cameras being checked, and no credentials leave your network. The app publishes the complete list of endpoints it requests, so that is checkable on the device rather than taken on trust.

Unknown is not a pass. Firmware older than about AXIS OS 12 does not publish the per-application fields two of these rules depend on. Those cameras report unknown rather than a clean bill of health, because a false all-clear is the one answer that would make the tool worse than not running it.

now

9 of the 68 rules are bench-verified and checked automatically. Command-line, macOS and Linux.

now · ACAP

The signed ACAP: install it on one camera you already have, and it checks the rest of the subnet from inside the network. Download Preflight ACAP App.

Signed downloads for macOS and Windows — nothing to install, no runtime to set up.

The free scan tells you which cameras roll back. That answer is never behind a paywall — the point of this is that fleets get checked, not that a scanner gets sold. A licence names the applications on each camera, says what to do about each, and produces the report you can hand to whoever owns the cameras. The command-line scanner is open and free either way, if you would rather run it yourself.

03 · Known gaps

Open questions

Things this ruleset does not yet know. Listed because a rules page that hides its own gaps is worth less than one that names them.

Q1 ANSWERED — can an installed ACAP's manifest be read over read-only VAPIX? No manifest endpoint responded on either bench unit, but the question was the wrong one: applications/list.cgi on OS 12.11 already returns CompatibleOsVersions, SignatureStatus and DLPU usage — everything A1, A4 and A8 needed, in one read-only call. Blocks .
Q2 Is .eap binary inspection in scope for v1, or deferred? Still the boundary. A3 is not exposed by list.cgi on either unit, so it joins the eap-binary group rather than the cheap one. Blocks A3, A6, B1, B2, B3, B4, B8, B9, B10, B11, B13.
Q4 How should the scanner treat firmware too old to expose the fields A1/A4/A8 rely on? M1137/10.12.300 returns none of them. Absence must read as 'unknown — not verifiable from here', never as 'compatible'. A false all-clear is the one output that would make this product worse than nothing. Blocks A1, A4, A8.