Sony TV Control

Control a Sony Bravia TV over the local network using IP Control (IRCC-IP + REST API). No server required — all commands are direct HTTP calls to the TV.

Configuration

• TV IP: 192.168.50.120
• PSK (Pre-Shared Key): 19890801
• TV Model: KD-55X9500G (BRAVIA 4K)
• Browser: Chrome 77.0.3865.116 (WebAppRuntime 2.1.2+10)

Quick Reference

All commands go directly to http://192.168.50.120. No intermediate server needed.

IRCC Commands (Remote Control Buttons)

IRCC commands use SOAP over POST to /sony/ircc. Common IRCC codes:

Send any IRCC command:

TV="192.168.50.120"
PSK="19890801"
CODE="AAAAAQAAAAEAAAASAw=="  # Volume Up

curl -s -X POST "http://$TV/sony/ircc" \
  -H "Content-Type: text/xml; charset=utf-8" \
  -H 'SOAPACTION: "urn:schemas-sony-com:service:IRCC:1#X_SendIRCC"' \
  -H "X-Auth-PSK: $PSK" \
  -d "<?xml version=\"1.0\"?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:X_SendIRCC xmlns:u=\"urn:schemas-sony-com:service:IRCC:1\"><IRCCCode>$CODE</IRCCCode></u:X_SendIRCC></s:Body></s:Envelope>"

Power Control

# Power On
curl -s -X POST "http://192.168.50.120/sony/ircc" \
  -H "Content-Type: text/xml; charset=utf-8" \
  -H 'SOAPACTION: "urn:schemas-sony-com:service:IRCC:1#X_SendIRCC"' \
  -H "X-Auth-PSK: 19890801" \
  -d '<?xml version="1.0"?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:X_SendIRCC xmlns:u="urn:schemas-sony-com:service:IRCC:1"><IRCCCode>AAAAAQAAAAEAAAAuAw==</IRCCCode></u:X_SendIRCC></s:Body></s:Envelope>'

# Power Off
curl -s -X POST "http://192.168.50.120/sony/ircc" \
  -H "Content-Type: text/xml; charset=utf-8" \
  -H 'SOAPACTION: "urn:schemas-sony-com:service:IRCC:1#X_SendIRCC"' \
  -H "X-Auth-PSK: 19890801" \
  -d '<?xml version="1.0"?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:X_SendIRCC xmlns:u="urn:schemas-sony-com:service:IRCC:1"><IRCCCode>AAAAAQAAAAEAAAAvAw==</IRCCCode></u:X_SendIRCC></s:Body></s:Envelope>'

Open URL in TV Browser

Launches a URL in the TV's built-in Chrome browser via localapp://webappruntime:

curl -s -X POST "http://192.168.50.120/sony/appControl" \
  -H "Content-Type: application/json" \
  -H "X-Auth-PSK: 19890801" \
  -d '{"method":"setActiveApp","params":[{"uri":"localapp://webappruntime?url=http://192.168.50.170:3000/diag.html","data":""}],"id":1,"version":"1.0"}'

Kill All Apps (Close Browser)

Terminates all running apps on the TV (closes browser, stops web apps):

curl -s -X POST "http://192.168.50.120/sony/appControl" \
  -H "Content-Type: application/json" \
  -H "X-Auth-PSK: 19890801" \
  -d '{"method":"terminateApps","params":[],"id":1,"version":"1.0"}'

Get Status

# Get volume
curl -s -X POST "http://192.168.50.120/sony/audio" \
  -H "Content-Type: application/json" \
  -H "X-Auth-PSK: 19890801" \
  -d '{"method":"getVolumeInformation","params":[{"target":"speaker"}],"id":1,"version":"1.0"}'

# Get power status
curl -s -X POST "http://192.168.50.120/sony/system" \
  -H "Content-Type: application/json" \
  -H "X-Auth-PSK: 19890801" \
  -d '{"method":"getPowerStatus","params":[],"id":1,"version":"1.0"}'

Helper Script

For convenience, create a shell wrapper:

#!/bin/bash
# tv.sh - Sony TV control helper
TV="192.168.50.120"
PSK="19890801"

ircc() {
  curl -s -X POST "http://$TV/sony/ircc" \
    -H "Content-Type: text/xml; charset=utf-8" \
    -H 'SOAPACTION: "urn:schemas-sony-com:service:IRCC:1#X_SendIRCC"' \
    -H "X-Auth-PSK: $PSK" \
    -d "<?xml version=\"1.0\"?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:X_SendIRCC xmlns:u=\"urn:schemas-sony-com:service:IRCC:1\"><IRCCCode>$1</IRCCCode></u:X_SendIRCC></s:Body></s:Envelope>"
}

case "$1" in
  power-on)    ircc "AAAAAQAAAAEAAAAuAw==" ;;
  power-off)   ircc "AAAAAQAAAAEAAAAvAw==" ;;
  vol-up)      ircc "AAAAAQAAAAEAAAASAw==" ;;
  vol-down)    ircc "AAAAAQAAAAEAAAATAw==" ;;
  mute)        ircc "AAAAAQAAAAEAAAAUAw==" ;;
  up)          ircc "AAAAAQAAAAEAAAB0Aw==" ;;
  down)        ircc "AAAAAQAAAAEAAAB1Aw==" ;;
  left)        ircc "AAAAAQAAAAEAAAA0Aw==" ;;
  right)       ircc "AAAAAQAAAAEAAAAzAw==" ;;
  confirm)     ircc "AAAAAQAAAAEAAABlAw==" ;;
  home)        ircc "AAAAAQAAAAEAAABgAw==" ;;
  back)        ircc "AAAAAgAAAJcAAAAjAw==" ;;
  hdmi1)       ircc "AAAAAgAAABoAAABaAw==" ;;
  hdmi2)       ircc "AAAAAgAAABoAAABbAw==" ;;
  open-url)    curl -s -X POST "http://$TV/sony/appControl" \
                 -H "Content-Type: application/json" \
                 -H "X-Auth-PSK: $PSK" \
                 -d "{\"method\":\"setActiveApp\",\"params\":[{\"uri\":\"localapp://webappruntime?url=$2\",\"data\":\"\"}],\"id\":1,\"version\":\"1.0\"}" ;;
  kill)        curl -s -X POST "http://$TV/sony/appControl" \
                 -H "Content-Type: application/json" \
                 -H "X-Auth-PSK: $PSK" \
                 -d '{"method":"terminateApps","params":[],"id":1,"version":"1.0"}' ;;
  *)           echo "Usage: tv.sh {power-on|power-off|vol-up|vol-down|mute|up|down|left|right|confirm|home|back|hdmi1|hdmi2|open-url <url>|kill}" ;;
esac

Local Test Server (Optional)

The test/ directory contains an optional Node.js Express server for:

• Hosting the diagnostic page (diag.html) locally
• Collecting diagnostic results from the TV browser
• Providing a web-based remote control UI

This is not required for controlling the TV. It is only useful for running diagnostics and the web UI.

cd test && npm install && npm start
# Server runs on http://0.0.0.0:3000

Diagnostic Page

Access http://<SERVER_IP>:3000/diag.html on the TV's browser (via Open URL) to run a 57-test capability scan. Results are automatically POSTed back to /api/diag-results.

See docs/diag-report.md for the full analysis.

TV Browser Capabilities (KD-55X9500G)

• Browser: Chrome 77.0.3865.116 (WebAppRuntime 2.1.2+10)
• Resolution: 1920x1080
• GPU: Mali-G71
• localStorage: ~1.6 MB
• Sony APIs: All available (systemevents, picturemode, DirectoryReader, decimated-video, multicast-video, 4k-photo)
• Not supported: Service Worker

Sony Proprietary APIs

Available in the TV browser via the sony namespace:

// System events (power on/off, input change, etc.)
sony.tv.systemevents.addListener('event', callback);
sony.tv.systemevents.removeListener('event', callback);

// Picture mode
sony.tv.picturemode.getPictureMode();
sony.tv.picturemode.setPictureMode(mode);

// USB storage reading
sony.tv.DirectoryReader // Read USB storage

// HDMI embedded video
var obj = document.createElement('object');
obj.setAttribute('type', 'application/x-decimated-video');
// Methods: open, close, setWideMode

// Multicast video
// Methods: show, close

// 4K photo rendering
// Methods: open, show, preload

Remote Key Codes

Detectable via keydown events in the TV browser: