Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/admins.md
Original file line number Diff line number Diff line change
Expand Up @@ -544,4 +544,4 @@ The other events can also go to a webhook; see [Notifications in Settings](#noti

### API Access

Create a key for the [Coverage API](coverage-api.md). Each admin gets one key per region, limited to 100 requests a day (usage shows as "n / 100"). A description is required. **Regenerate API key** replaces your key; the old one stops working straight away.
Create an integration key for the [Coverage API](coverage-api.md) and the other [read APIs](api-keys.md). Each admin gets one key per region, limited to 100 Coverage requests a day (usage shows as "n / 100"). A description is required. **Regenerate integration key** replaces your key; the old one stops working straight away.
25 changes: 14 additions & 11 deletions docs/api-keys.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
# API keys and access

MeshMapper uses the same **Coverage API key** for Coverage and the read APIs below. Existing keys keep their values, geographic assignments and Coverage quota. There is no need to regenerate a key for the new endpoints.
MeshMapper uses one **integration key** for Coverage and the read APIs below. Existing keys keep their values, geographic assignments and Coverage quota. There is no need to regenerate a key for the new endpoints.

!!! note "Formerly Coverage keys"
Integration keys used to be called **Coverage keys** (or Coverage API keys). Only the name changed: a key you already have keeps working everywhere, with the same value, assignment and limits.

!!! info "Server v1.5.117 rollout"
Zones, boundaries, scopes and channels require keys when the updated server endpoints are deployed. Send your key now as part of the migration. Repeater authentication has a separate switch, off by default until app 1.4.1 is shipped and the update is forced. This page describes the new contract, not a confirmation that every region has deployed it.
Expand All @@ -9,20 +12,20 @@ MeshMapper uses the same **Coverage API key** for Coverage and the read APIs bel

| API | Credential | Geographic access |
| --- | --- | --- |
| [Coverage](coverage-api.md), `coverage.php` | Coverage key in `X-API-Key` or legacy `?key=` | Assigned region, group, selected regions or GLOBAL |
| [Region directory](zones-api.md), `get_zones.php` | Coverage key in `X-API-Key` | Authorized regions within the requested country |
| [Boundaries](zones-api.md#region-boundary), `get_geojson.php` | Coverage key in `X-API-Key` | Requested region or fully authorized group |
| [Scopes](scopes-api.md), `get_scopes.php` | Coverage key in `X-API-Key` | Requested region or fully authorized group |
| [Channels](channels-api.md), `get_channels.php` | Coverage key in `X-API-Key` | Requested region or fully authorized group |
| Repeaters, `get_repeaters.php` | Scoped Coverage key or existing mobile App key in `X-API-Key`; optional during transition | Coverage keys stay within their assignments; App keys support the app's cross-region repeater reads |
| [Coverage](coverage-api.md), `coverage.php` | Integration key in `X-API-Key` or legacy `?key=` | Assigned region, group, selected regions or GLOBAL |
| [Region directory](zones-api.md), `get_zones.php` | Integration key in `X-API-Key` | Authorized regions within the requested country |
| [Boundaries](zones-api.md#region-boundary), `get_geojson.php` | Integration key in `X-API-Key` | Requested region or fully authorized group |
| [Scopes](scopes-api.md), `get_scopes.php` | Integration key in `X-API-Key` | Requested region or fully authorized group |
| [Channels](channels-api.md), `get_channels.php` | Integration key in `X-API-Key` | Requested region or fully authorized group |
| Repeaters, `get_repeaters.php` | Scoped integration key or existing mobile App key in `X-API-Key`; optional during transition | Integration keys stay within their assignments; App keys support the app's cross-region repeater reads |

Only Coverage accepts a query-string key. App keys do not grant access to Coverage, zones, boundaries, scopes or channels. The mobile app can send its existing App key for repeaters before connecting a radio or starting a session.

## Generate or reuse a key

In your region or group's admin panel, open **User Settings > API Access**. Generate a key with a description, or show your existing key. Each administrator can have one self-service key per region or group. Regeneration invalidates the old value immediately.
In your region or group's admin panel, open **User Settings > API Access**. Generate an integration key with a description, or show your existing key. Each administrator can have one self-service key per region or group. Regeneration invalidates the old value immediately.

Group keys cover the group's current enabled member IATAs, including membership changes without issuing a new key. A key for just one member cannot fetch a whole group's boundaries, scopes or channels unless it covers every enabled member. Repeater exports are filtered to the Coverage key's authorized members, even where a member URL normally expands to its group.
Group keys cover the group's current enabled member IATAs, including membership changes without issuing a new key. A key for just one member cannot fetch a whole group's boundaries, scopes or channels unless it covers every enabled member. Repeater exports are filtered to the integration key's authorized members, even where a member URL normally expands to its group.

Contact the MeshMapper team for custom integrations, selected-region or GLOBAL access, endpoint permissions, or larger limits. Master admins can allow only the endpoints an integration needs. GLOBAL permits geographic access across regions; it does not remove required parameters or turn every endpoint into an all-region feed. For example, `get_zones.php` still requires `country`.

Expand All @@ -40,7 +43,7 @@ Send the header on every request, including conditional requests. CORS preflight

## Limits and caching

The five read APIs share a default budget of **1,000 admitted requests per UTC day and 30 per fixed minute per Coverage key**. Custom keys may have different limits. Coverage retains its separate daily quota, normally 100 calls for self-service keys. Read calls do not consume Coverage calls.
The five read APIs share a default budget of **1,000 admitted requests per UTC day and 30 per fixed minute per integration key**. Custom keys may have different limits. Coverage retains its separate daily quota, normally 100 calls for self-service keys. Read calls do not consume Coverage calls.

Every admitted read counts, including a `304` and a downstream data error. Authentication and authorization failures do not consume the read budget. `OPTIONS` preflights do not count. Existing IP burst protection also applies; App repeater reads do not put all phones behind one shared daily key budget.

Expand All @@ -53,7 +56,7 @@ Protected responses use `Cache-Control: private, no-store`. Keep your backend's
| Status | Error | Action |
| --- | --- | --- |
| 401 | `missing_key`, `invalid_key` | Supply a current key in `X-API-Key`. |
| 403 | `wrong_key_type` | Use a Coverage key; App keys only support repeaters. |
| 403 | `wrong_key_type` | Use an integration key; App keys only support repeaters. |
| 403 | `api_not_allowed` | Ask the key owner to review endpoint permissions. |
| 403 | `no_region`, `region_not_allowed` | Check the key's region/group assignment. |
| 503 | `key_rate_limited` | Wait for `Retry-After`. |
Expand Down
4 changes: 2 additions & 2 deletions docs/channels-api.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Channels API

The Channels API lists the hashtag channels a region's admins have set up for it. That's the same list the MeshMapper app listens on for passive RX in that region. Use it to show a region's local channels, or to set them up in your own client, without scraping the map. Send your Coverage API key in the `X-API-Key` header.
The Channels API lists the hashtag channels a region's admins have set up for it. That's the same list the MeshMapper app listens on for passive RX in that region. Use it to show a region's local channels, or to set them up in your own client, without scraping the map. Send your integration key in the `X-API-Key` header.

```
GET https://yow.meshmapper.net/get_channels.php
Expand All @@ -13,7 +13,7 @@ There are no parameters.

## Authentication

Send your existing **Coverage API key** in the `X-API-Key` header. No new key is needed. See [API keys and access](api-keys.md) for generation, group permissions, custom GLOBAL integrations and the v1.5.117 rollout.
Send your existing **integration key** (formerly a Coverage key) in the `X-API-Key` header. No new key is needed. See [API keys and access](api-keys.md) for generation, group permissions, custom GLOBAL integrations and the v1.5.117 rollout.

Fetch from your backend and serve your own parsed data to visitors. Keep the key out of client-side JavaScript.

Expand Down
22 changes: 11 additions & 11 deletions docs/coverage-api.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,23 +4,23 @@ The Coverage API provides programmatic access to MeshMapper coverage grid-square

## Authentication

Access requires a **Coverage** API key. Each key is scoped to a specific region, a multiregion group, or a set of adjacent regions (see [Multi-Region Keys](#multi-region-keys)). Self-service keys have a daily limit of 100 requests; keys issued by the MeshMapper team may carry a different limit (the 429 body's `limit` field shows yours).
Access requires an **integration key** (formerly called a Coverage key). Each key is scoped to a specific region, a multiregion group, or a set of adjacent regions (see [Multi-Region Keys](#multi-region-keys)). Self-service keys have a daily limit of 100 requests; keys issued by the MeshMapper team may carry a different limit (the 429 body's `limit` field shows yours).

This same key also works for zones, boundaries, scopes, channels and repeaters, subject to endpoint permissions. Existing keys do not need regeneration. Group keys follow current member IATAs. See [API keys and access](api-keys.md) for the endpoint table, shared read limits and repeater rollout.
The same key also works for zones, boundaries, scopes, channels and repeaters, subject to endpoint permissions. Existing keys do not need regeneration. Group keys follow current member IATAs. See [API keys and access](api-keys.md) for the endpoint table, shared read limits and repeater rollout.

Send `X-API-Key: YOUR_API_KEY` on requests, or keep using the existing `?key=` URLs for Coverage.

### Generating a Key

Regional administrators can generate their own API key directly from the admin panel:
Regional administrators can generate their own integration key directly from the admin panel:

1. Log in to your region's admin panel
2. Go to **User Settings**
3. Scroll to the **API Access** section
4. Enter a description/reason for the key (mandatory)
5. Click **Generate API Key**
5. Click **Generate integration key**

Each administrator is limited to **one API key per region or group**. The key is automatically scoped to that region or group with a fixed rate limit of 100 requests per day. If you need to replace your key, use the **Regenerate** button — this invalidates the old key immediately.
Each administrator is limited to **one integration key per region or group**. The key is automatically scoped to that region or group with a fixed rate limit of 100 requests per day. If you need to replace your key, use the **Regenerate integration key** button. That invalidates the old key immediately.

!!! warning "Unauthorized Access"
MeshMapper utilizes API keys and rate limits to protect server resources and prevent access to data that regions do not wish to have shared externally. As such, accessing unauthorized API's, scraping for data, etc., is strictly prohibited and will result in action taken to protect the server and data (which may include IP or origin bans, removal of a region, etc.). The MeshMapper team is happy to review requests for data not provided in the API's below.
Expand All @@ -35,7 +35,7 @@ GET https://meshmapper.net/coverage.php?key=YOUR_API_KEY

| Parameter | Required | Description |
| --- | --- | --- |
| `key` | Unless using X-API-Key | Your Coverage API key. Existing query-key URLs remain supported. |
| `key` | Unless using X-API-Key | Your integration key. Existing query-key URLs remain supported. |
| `include` | No | Comma-separated list of optional sections to add to the response. Currently supports `repeaters` (e.g. `?include=repeaters`) — see [Repeater Fields](#repeater-fields). |
| `fresh` | No | `fresh=1` skips the 15-minute server cache and builds the grid now. Single-region and group keys only; multi-region and global keys return HTTP 400 `fresh_not_supported`. |
| `f_*` | No | Filter the pings that go into the grid before it is built: by radio configuration, date, power or antenna. See [Filtering](#filtering). |
Expand Down Expand Up @@ -272,7 +272,7 @@ curl -s --compressed -H 'If-None-Match: "THE_ETAG_VALUE"' \

## Rate Limits

Each API key has a **daily** request limit. Self-service keys get 100 requests a day; keys issued by the MeshMapper team may carry a different limit (the 429 body's `limit` field shows yours). Counters are reset by a daily job at midnight UTC. Every request that reaches your data — including cache hits and `304 Not Modified` responses — counts toward this limit.
Each integration key has a **daily** Coverage request limit. Self-service keys get 100 requests a day; keys issued by the MeshMapper team may carry a different limit (the 429 body's `limit` field shows yours). Counters are reset by a daily job at midnight UTC. Every request that reaches your data — including cache hits and `304 Not Modified` responses — counts toward this limit.

When you exceed your limit, the API returns HTTP 429:

Expand Down Expand Up @@ -302,7 +302,7 @@ A separate per-IP throttle protects against bursts: about 30 requests in a rolli
| 400 | `filters_not_supported` | An `f_` parameter (even an empty one) on a multi-region or global key. |
| 400 | `fresh_not_supported` | `fresh=1` on a multi-region or global key. |
| 400 | `too_many_regions` | A multi-region key with more than 6 member regions. |
| 401 | `invalid_key` | API key not found, or not a Coverage key (message: `Invalid or non-Coverage API key`). |
| 401 | `invalid_key` | Key not found, or not an integration key (for example an App key). Message: `Invalid API key, or not an integration key`. |
| 403 | `api_not_allowed` | Coverage access is disabled for this key. |
| 503 | `auth_unavailable` | Authentication policy storage is temporarily unavailable; respect Retry-After. |
| 403 | `no_region` | No region assigned to this key, or the key's region has been deleted. |
Expand All @@ -315,11 +315,11 @@ A separate per-IP throttle protects against bursts: about 30 requests in a rolli

## Managing Your Key

If you have a Coverage API key assigned to your admin account, you can view your current usage and regenerate your key from the **User Settings** tab in your region's Admin Portal. Regenerating a key invalidates the old one immediately.
If you have an integration key assigned to your admin account, you can view your current usage and regenerate your key from the **User Settings** tab in your region's Admin Portal. Regenerating a key invalidates the old one immediately.

## Multi-Region Keys

A Coverage key can be scoped to a **set of up to 6 regions** (for example `PDX,SEA,YVR`) instead of a single region. The response merges every member region's coverage into **one grid** — the same payload shape as a single-region response — so it suits integrations that render adjacent regions as one continuous map.
An integration key can be scoped to a **set of up to 6 regions** (for example `PDX,SEA,YVR`) instead of a single region. The response merges every member region's coverage into **one grid** — the same payload shape as a single-region response — so it suits integrations that render adjacent regions as one continuous map.

Multi-region keys are not self-service: like [global keys](#global-coverage-feed) and keys with a custom limit, they are issued by the MeshMapper team (Master administrators) on request (the admin-panel self-service flow creates keys for its current region or group). Adjacent regions are the intended use — the merged grid serves them as one map.

Expand Down Expand Up @@ -378,7 +378,7 @@ Caching, compression, conditional requests, and the daily quota work exactly as

## Global Coverage Feed

A special **global** Coverage key returns data for **every MeshMapper region in one request** — no region list to maintain on your side. Global keys are not self-service: they are issued by the MeshMapper team on request, for integrations that genuinely need fleet-wide data (reach out via the usual channels if that's you).
A special **global** integration key returns data for **every MeshMapper region in one request** — no region list to maintain on your side. Global keys are not self-service: they are issued by the MeshMapper team on request, for integrations that genuinely need fleet-wide data (reach out via the usual channels if that's you).

The endpoint and authentication are identical — only the key differs:

Expand Down
4 changes: 2 additions & 2 deletions docs/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -229,10 +229,10 @@
??? question "Can I scrape for data or call your API's?"
Unauthorized scraping or access to undocumented API's is strictly prohibited and will result in action being taken to protect MeshMapper's data and servers.

The publicly available APIs are [listed here](coverage-api.md) and require the use of a provisioned API key.
The publicly available APIs are [listed here](coverage-api.md) and require a provisioned [integration key](api-keys.md).

??? question "Can I have access to the MeshMapper MQTT broker or raw data?"
MeshMapper does not offer a public raw MQTT feed. For tools that need map coverage data, use the documented [Coverage API](coverage-api.md) and request an API key. A region admin can configure a broker that sends observer reports *to* MeshMapper; that is separate from read access to MeshMapper's collected data.
MeshMapper does not offer a public raw MQTT feed. For tools that need map coverage data, use the documented [Coverage API](coverage-api.md) and request an integration key. A region admin can configure a broker that sends observer reports *to* MeshMapper; that is separate from read access to MeshMapper's collected data.

??? question "Is MeshMapper open source? Can I run a local copy?"
The MeshMapper wardriving app for Android and iOS is open source. It can also natively be configured to send wardriving data to additional endpoints outside of MeshMapper.
Expand Down
4 changes: 2 additions & 2 deletions docs/scopes-api.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Scopes API

The Scopes API lists the Mesh Scopes a region's repeaters carry, with a repeater count per scope. Use it to show which scopes are active in a region without scraping the map. Send your Coverage API key in the `X-API-Key` header.
The Scopes API lists the Mesh Scopes a region's repeaters carry, with a repeater count per scope. Use it to show which scopes are active in a region without scraping the map. Send your integration key in the `X-API-Key` header.

```
GET https://yow.meshmapper.net/get_scopes.php
Expand All @@ -13,7 +13,7 @@ There are no parameters.

## Authentication

Send your existing **Coverage API key** in the `X-API-Key` header. No new key is needed. See [API keys and access](api-keys.md) for generation, group permissions, custom GLOBAL integrations and the v1.5.117 rollout.
Send your existing **integration key** (formerly a Coverage key) in the `X-API-Key` header. No new key is needed. See [API keys and access](api-keys.md) for generation, group permissions, custom GLOBAL integrations and the v1.5.117 rollout.

Fetch from your backend and serve your own parsed data to visitors. Keep the key out of client-side JavaScript.

Expand Down
Loading
Loading