Provider API

Build on the community mutual-aid network. Access is granted to verified community partners.

beta100 req/min per userCognito PKCE

Base URL

https://vyxlnfy6na.execute-api.us-west-2.amazonaws.com

All authenticated routes require a bearer token. See Authentication below.

Endpoints

POST/askauth required

Post a request for help to the community network.

curl -X POST https://vyxlnfy6na.execute-api.us-west-2.amazonaws.com/ask \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"need":"first aid supplies","lat":6.61,"lon":0.47}'
POST/giveauth required

Offer support, supplies, or skills to the community.

curl -X POST https://vyxlnfy6na.execute-api.us-west-2.amazonaws.com/give \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"offer":"solar repair training","lat":6.61,"lon":0.47}'
GET/nearby?lat=&lon=auth required

List community resources near a coordinate, sorted by distance. Powered by PostGIS ST_DWithin with an 8km radius.

curl "https://vyxlnfy6na.execute-api.us-west-2.amazonaws.com/nearby?lat=6.61&lon=0.47" \
  -H "Authorization: Bearer $TOKEN"
POST/upload-urlauth required

Request a pre-signed URL to upload a photo or attachment. Text submission posts immediately; photos upload separately via S3 presigned URL — non-blocking for the user.

curl -X POST https://vyxlnfy6na.execute-api.us-west-2.amazonaws.com/upload-url \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"filename":"photo.jpg","contentType":"image/jpeg"}'
GET/search?q=auth required

Full-text search across community resources and offers.

curl "https://vyxlnfy6na.execute-api.us-west-2.amazonaws.com/search?q=clinic" \
  -H "Authorization: Bearer $TOKEN"

Authentication — Cognito PKCE

Ðekawɔwɔ uses an Amazon Cognito user pool with the OAuth 2.0 Authorization Code flow plus PKCE. No client secret is required, so the flow is safe for mobile and single-page apps.

  1. Create a code verifier and challenge. Generate a random verifier, then SHA-256 hash and base64url-encode it to form the challenge.
  2. Redirect to the hosted UI. Send the user to the authorize endpoint with code_challenge and code_challenge_method=S256.
  3. Exchange the code. On redirect back, exchange the authorization code plus your code_verifier at the token endpoint.
  4. Call the API. Pass the returned access token as Authorization: Bearer.
Rate limits

Beta: 100 req/min per authenticated user. Exceeding the limit returns 429 Too Many Requests with a Retry-After header.

Get API access

Request developer credentials to start building on the community mutual-aid network. Access is granted to verified community partners.

Create developer account